Q and A with Chief Information Security Officer at Duke University about Yubico

Q and A with Chief Information Security Officer at Duke University about Yubico

Q and A with Chief Information Security Officer at Duke University about YubicoYounger than most other prestigious U.S. research universities, Duke University consistently ranks among the very best. Duke’s graduate and professional schools — in business, divinity, engineering, the environment, law, medicine, nursing and public policy — are among the leaders in their fields. Duke’s home campus is situated on nearly 9,000 acres in Durham, N.C, a city of more than 200,000 people. Duke also is active internationally through the Duke-NUS Graduate Medical School in Singapore, Duke Kunshan University in China and numerous research and education programs across the globe. More than 75 percent of Duke students pursue service-learning opportunities in Durham and around the world through DukeEngage and other programs that advance the university’s mission of “knowledge in service to society.”[1]

(Quotes below are from Richard Biever, Chief Information Security officer at Duke University.)

Why and where has Duke University deployed strong authentication?

"A few years ago, we began looking at alternatives to protect user accounts and passwords.  The threats posed by phishing messages, key loggers, password sniffing, and password re-use as well as the ease of cracking password hashes via GPU led us to look at multifactor alternatives. One of the key requirements for us was to find a solution that would provide multiple ways for a user to log into a system or application. Given the variety of user groups at Duke as well as the wide variety of applications, having multiple “2nd” factors (something you have) was a must.   Early in the pilot, we added Q and A with Chief Information Security Officer at Duke University about YubicoYubikeys as one of the options for our multifactor service, and continue to utilize Yubikeys for staff as a component of our multifactor service."

Why did Duke chose the YubiKey for two-factor authentication?

"We implemented our first multifactor pilot in late 2012. During the pilot, we engaged the security and identity management teams to evaluate the service and authentication mechanisms. These teams are in and out of systems and applications all day long, sometimes logging in via SSH, RDP, or Shibboleth as many as 40 times in a given day. For these teams, the ease of securely authenticating into our systems by touching the button on the YubiKey was a driving force for the inclusion of Yubikeys as a part of our multifactor strategy.”

What work was required to integrate the YubiKey into Duke's authentication?

"We have integrated Yubikeys with our primary multifactor service and have enabled it with our Shibboleth infrastructure. We also extended the service to our key IT systems, requiring multifactor access via SSH, RDP, and specific VPN contexts."

What has the user experience feedback been?Q and A with Chief Information Security Officer at Duke University about Yubico

"Those using Yubikeys for multifactor access appreciate the quick login capabilities.”

What is your experience working with Yubico?

"When we began working with YubiKeys, we initially purchased directly from the Yubico web store.  As our YubiKey user base continued to grow, we began purchasing in bulk orders and continue to add as time goes by.  The Yubico team has been very responsive to our needs and continue to provide excellent support."

Featured

  • Choosing the Right Solution

    Today, there is a strong shift from on-prem installations to cloud or hybrid-cloud deployments. As reported in the 2024 Genetec State of Physical Security report, 66% of end users said they will move to managing or storing more physical security in the cloud over the next two years. Read Now

  • New Report Reveals Top Security Risks for U.S. Retail Chains

    Interface Systems, a provider of security, actionable insights, and purpose-built networks for multi-location businesses, has released its 2024 State of Remote Video Monitoring in Retail Chains report. The detailed study analyzed over 2 million monitoring requests across 4,156 retail locations in the United States from September 2023 to August 2024. Read Now

  • Gaining a Competitive Edge

    Ask most companies about their future technology plans and the answers will most likely include AI. Then ask how they plan to deploy it, and that is where the responses may start to vary. Every company has unique surveillance requirements that are based on market focus, scale, scope, risk tolerance, geographic area and, of course, budget. Those factors all play a role in deciding how to configure a surveillance system, and how to effectively implement technologies like AI. Read Now

  • 6 Ways Security Awareness Training Empowers Human Risk Management

    Organizations are realizing that their greatest vulnerability often comes from within – their own people. Human error remains a significant factor in cybersecurity breaches, making it imperative for organizations to address human risk effectively. As a result, security awareness training (SAT) has emerged as a cornerstone in this endeavor because it offers a multifaceted approach to managing human risk. Read Now

Featured Cybersecurity

Webinars

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3