Multi-Factor Authentication Project

There is an increased and growing cyber threat to Universities. The University of Oxford has a particularly high profile leading the world with COVID-19 research and we are under continuous cyberattack. The pandemic has brought additional risks with increased working from home, accessing University information from a variety of devices.

• In the last 10 months, over 1600 of our colleagues have been presented with convincing fake Webauth pages, quite understandably for busy people, have then typed in their SSO and password giving access to their account, data sets and University services to a cyber-criminal
• The University experienced a serious but contained Ransomware outbreak in January 2020 and that business unit has only recently completed its recovery. Weak authentication played a role in both the initial intrusion and spread of the malware.
• There is significant global interest in our Covid research. A successful cyber intrusion could disrupt clinical trials timetables if a regulator was concerned about the integrity of trials data. At worst, it could require trials to be repeated.
• MFA is a key action in the October 2020 Internal Audit report as a requirement for secure remote working

Therefore, it is vital for us to secure our accounts and systems, now more than ever. Multi-factor authentication is now common across many organisations. It will ‘double-lock’ our systems to protect Oxford’s unique information.

What is an app password?

An App Password is required in situations where you use apps or older devices that are incompatible with the multi-factor authentication method (see list for more information). The App Password proves to the system that you have multi-factor authentication set-up. When accessing an older application, such as Outlook 2013, you will be prompted for your multi-factor authentication details.

App Passwords can only be set up once your initial multi-factor authentication method has been set up, such as the authenticator app or a phone (refer to guides under ‘help and guidance’).

You must enter the App Password in place of your Single Sign-On password for the application or device you have created it for.

You can create up to 40 App Passwords. Each App Password is unique to an application.

Once this is done you will no longer be prompted for MFA for that specific application.

How do I enable an app password?

To enable App password for a personal or generic/secondary email account please use the App Password Enablement – Multi-Factor Authentication (MFA) service request.

For more information please visit the IT Help page, read the guide ‘Setting up App Passwords’ or watch the short video (available soon).

There are technical FAQs for IT support staff.

We also encourage ITSS to join the ITSS Community Teams forum (MFA channel) where you can communicate with the MFA project team and also find recordings of recent ITSS MFA briefings together with full slide decks.

Full MFA rollout details for ITSS are available on the ITSS Wiki as well as a summary of information relevant to MFA section aimed at supporting users.