Duo two-factor identification now needed to access BannerWeb off campus

Duo two-factor identification is now required for all students to access BannerWeb while off campus, which could cause problems during housing selection and course registration if students don't have the extra security measure installed.

Duo is an app that is installed on a phone. According to the company's website, anytime someone tries to access a BannnerWeb account from an off-campus wireless network or a device that has not been registered, the Duo app sends a confirmation code to plug into BannerWeb.

The code allows students to confirm or deny access to their BannerWeb account from an off-campus Wi-Fi network or an unregistered device. With Duo, even if someone is able to obtain the username and password, they will not be able to hack into the BannerWeb account without a verification code, unique to each log-in and sent exclusively to the account owner.  

Shana Bumpas, director of information security, is responsible for cyber security across campus and protecting staff and student information. 

“In this day and age, username and password are becoming obsolete,” Bumpas said.  

Duo adds an extra layer of protection to BannerWeb accounts in addition to entering the username and password. 

“Duo is actually a benefit to you,” said Kevin Creamer, manager of communications and engagement for information services. “It is one more step you have to go through, but it really does make your information that much safer.” 

University systems have been breached to the point where hackers have been able to go into BannerWeb, Creamer said. Duo will make BannerWeb more secure, he said. 

Duo requirements went into effect on Feb. 5, meaning that all students trying to access BannerWeb off campus need Duo to do so. Information Services wants to make sure off-campus students don’t have any issue accessing BannerWeb, Creamer said. 

“I know how important the housing and course registration times are, and we want to make sure that everyone is set up by then so that they don’t have any issues,” Creamer said. 

Information Services has already contacted students who went abroad and students who currently live off-campus, in addition to sending school-wide emails. 

Nevertheless, if by the time course registration begins students still have not downloaded Duo, Bumpas assures them not to panic. 

The help desk staff members had been discussing having a few people available at 7 a.m. to accommodate last-minute registration difficulties, said Scott Tilghman, student help desk manager. 

Students who live on campus should still download Duo, Creamer and Bumpas said. Although on-campus students may not get push notifications from Duo prompting them for verification each time they log on to BannerWeb, they would still benefit from the protection of two-factor identification. 

Senior Jamie Katz can attest to a lack of push notifications from her phone prompting her to verify herself from the Duo app. Katz, a student associate to the office of alumni in the Jepson Alumni Center, downloaded the app last semester. 

“At work, I have to prompt Duo for an access code which gets sent to my boss every time I want to access a file,” Katz said. “But on my personal computer, unless I am on off-campus Wi-Fi working with BannerWeb, it hasn’t affected me.”

Julie Neville, a technical support consultant with Information Services, said some problems students may face stemmed from getting a new phone or registering for Duo only partially. 

“Once their phone number has been entered, if they try to go back in afterwards to finish registration or to use a new phone, the help desk will have to send them an activation code,” Neville said. 

Otherwise, registration from Duo’s true start point is straightforward and should take only a few minutes, Tilghman said.  

Contact contributor Maddie Kelley at madeline.kelley@richmond.edu.