Best of…: 2017: The Second Factor

As this is a holiday week, per our usual tradition, we're revisiting some of the most popular articles from the year. We start with The Second Factor, a tale of security gone wrong. -- Remy

Famed placeholder company Initech is named for its hometown, Initown. Initech recruits heavily from their hometown school, the University of Initown. UoI, like most universities, is a hidebound and bureaucratic institution, but in Initown, that's creating a problem. Initown has recently seen a minor boom in the tech sector, and now the School of Sciences is setting IT policy for the entire university.

Derek manages the Business School's IT support team, and thus his days are spent hand-holding MBA students through how to copy files over to a thumb drive, and babysitting professors who want to fax an email to the department chair. He's allowed to hire student workers, but cannot fire them. He's allowed to purchase consumables like paper and toner, but has to beg permission for capital assets like mice and keyboards. He can set direction and provide input to software purchase decisions, but he also has to continue to support the DOS version of WordPerfect because one professor writes all their papers using it.

One day, to his surprise, he received a notification from the Technology Council, the administrative board that set IT policy across the entire University. "We now support Two-Factor Authentication". Derek, being both technologically savvy and security conscious, was one of the first people to sign up, and he pulled his entire staff along with him. It made sense: they were all young, technologically competent, and had smartphones that could run the school's 2FA app. He encouraged their other customers to join them, but given that at least three professors didn't use email and instead had the department secretary print out emails, there were some battles that simply weren't worth fighting.

Three months went by, which is an eyeblink in University Timea. There was no further direction from the Technology Council. Within the Business School, very little happened with 2FA. A few faculty members, especially the ones fresh from the private sector, signed up. Very few tenured professors did.

And then Derek received this email:

To: AllITSManagers
From: ITS-Adminsd@initown.edu
Subject: Two-Factor Authentication
Effective two weeks from today, we will be requiring 2FA to be enabled on all* accounts on the network, including student accounts. Please see attached, and communicate the changes to your customers.

Rolling out a change of this scale in two weeks would be a daunting task in any environment. Trying to get University faculty to change anything in a two week period was doomed to fail. Adding students to the mix promised to be a disaster. Derek read the attached "Transition Plan" document, hoping to see a cunning plan to manage the rollout. It was 15 pages of "Two-Factor Authentication(2FA) is more secure, and is an industry best practice," and "The University President wants to see this change happen".

Derek compiled a list of all of his concerns- it was a long list- and raised it to his boss. His boss shrugged: "Those are the orders". Derek escalated up through the business school administration, and after two days of frantic emails and, "Has anyone actually thought this through?" Derek was promised 5 minutes at the end of the next Technology Council meeting" which was one week before the deadline.

The Technology Council met in one of the administrative conference rooms in a recently constructed building named after a rich alumni who paid for the building. The room was shiny and packed with teleconferencing equipment that had never properly been configured, and thus was useless. It also had a top-of-the-line SmartBoard display, which was also in the same unusable state.

When Derek was finally acknowledged by the council, he started with his questions. "So, I've read through the Transition Plan document," he said, "but I don't see anything about how we're going to on-board new customers to this process. How is everyone going to use it?"

"They'll just use the smartphone app," the Chair said. "We're making things more secure by using two-factor."

"Right, but over in the Business School, we've got a lot of faculty that don't have smartphones."

Administrator #2, seated to the Chair's left, chimed in, "They can just receive a text. This is making things more secure."

"Okay," Derek said, "but we've still got faculty without cellphones. Or even desk phones. Or even desks for that matter. Adjunct professors don't get offices, but they still need their email."

There was a beat of silence as the Chair and Administrators considered this. Administrator #1 triumphantly pounded the conference table and declared, "They can use a hardware token! This will make our network more secure!"

Administrator #2 winced. "Ah" this project doesn't have a budget for hardware tokens. It's a capital expense, you see""

"Well," the Chair said, "it can come out of their department's budget. That seems fair, and it will make our network more secure."

"And you expect those orders to go through in one week?" Derek asked.

"You had two weeks to prepare," Administrator #1 scolded.

"And what about our faculty abroad? A lot of them don't have a stable address, and I'm not going to be able to guarantee that they get their token within our timeline. Look, I agree, 2FA is definitely great for security- I'm a big advocate for our customers, but you can't just say, let's do this without actually having a plan in place! 'It's more secure' isn't a plan!"

"Well," the Chair said, harrumphing their displeasure at Derek's outburst. "That's well and good, but you should have raised these objections sooner."

"I'm raising these objections before the public announcement," Derek said. "I only just found out about this last week."

"Ah, yes, you see, about that" we made the public announcement right before this meeting."

"You what?"

"Yes. We sent a broadcast email to all faculty, staff and students, announcing the new mandated 2FA, as well as a link to activate 2FA on their account. They just have to click the link, and 2FA will be enabled on their account."

"Even if they have no way to received the token?" Derek asked.

"Well, it does ask them if they have a way to receive a token""

By the time Derek got back to the helpdesk, the inbox was swamped with messages demanding to know what was going on, what this change meant, and half a dozen messages from professors who saw "mandatory" and "click this link" and followed instructions- leaving them unable to access their accounts because they didn't have any way to get their 2FA token.

Over the next few days, the Technology Council tried to round up a circular firing squad to blame someone for the botched roll-out. For a beat, it looked like they were going to put Derek in the center of their sights, but it wasn't just the Business School that saw a disaster with the 2FA rollout- every school in the university had similar issues, including the School of Sciences, which had been pushing the change in the first place.

In the end, the only roll-back strategy they had was to disable 2FA organization wide. Even the accounts which had 2FA previously had it disabled. Over the following months, the Technology Council changed its tone on 2FA from, "it makes our network more secure" to, "it just doesn't work here."

[Advertisement] Application Release Automation for DevOps - integrating with best of breed development tools. Free for teams with up to 5 users. Download and learn more today!