Your password needs a partner: Turn on two-factor for Weblogin

Strong passwords are essential, but they are not enough anymore. In a recent University Record interview on cyber security at U-M, Chief Information Security Officer Don Welch noted that “higher education has the highest number of IT security breaches among most industry sectors.” Your password needs a partner—two-factor authentication.

Now the U-M community has a great tool to protect personal information by using two-factor authentication from Duo Security. In October, U-M added the option to use Duo when logging into services via the Weblogin page. When you turn on two-factor for Weblogin, you add an extra layer of security to your personal information in Wolverine Access, U-M Google, and more—including your W-2s, direct deposit info, and your U-M Google email.

Protection “worth a few more clicks”

Denise Stegall, senior director for records and information services in University Human Resources, turned on two-factor for Weblogin during the August pilot and endorsed the service: “As one of the HR data stewards, I am aware of many examples of identify fraud. Knowing that I can add a layer of protection to most of my work systems to reduce opportunities for hacking [and] fraud to protect all U-M employees is worth a few more clicks a day using two-factor authentication!”

This fall, the Your Password Needs a Partner: Turn on Two-factor campaign will encourage faculty and staff to turn on two-factor for Weblogin through articles, outreach and education, and awareness materials. Efforts to expand two-factor authentication to new U-M services and individuals on all campuses will continue over the next year. If you would like to promote the Your Password Needs a Partner: Turn on Two-Factor effort in your unit, please contact the project team.

Currently, more than 23,000 individuals use Duo to access U-M systems that require it. Now that Weblogin with Duo is available to the entire U-M community, the university is counting on IT leaders like you to help promote its use and safeguard personal or university data. Be a Duo champion: turn on two-factor for Weblogin and then show your colleagues how easy it is to use.

What is two-factor authentication?
Two-factor authentication combines a password (something you know) with a second factor, like a passcode or push notification sent to your phone (something you have). U-M uses Duo Security.

How do I turn it on?

You first need to enroll in Duo if you haven’t already. Then you can turn on two-factor for Weblogin at UMICH Account Management under the “Two-Factor (Duo)” tab. Click the “Turn on Two-Factor” button, then set the switch to “On.” You can also turn on two-factor from the UMHS profile page. Learn more about Two-Factor Authentication at U-M and the Turn On Two-factor for Weblogin option.

Tips from two-factor champions

  • “Keep your phone with you through the day.”
  • “Bring your smartphone with you to meetings in case you need to reauthenticate on the go.”
  • “Use a wearable! Being able to accept or reject Duo pushes from my wrist has saved a lot of time.”
  • “On the iPhone when you get an notification, you can swipe left to approve or reject the request.”
  • “Sign up for a back-up option like your desk phone in case you forget your phone (like I did!)”