What is 2-Step Authentication?
California State University, Bakersfield employs 2-Step Authentication to bolster the security of your CSUB account and safeguard university data, systems, and services. Utilizing the hosted Duo security cloud-based two-factor authentication service, this system enhances protection.
The initial layer of security (something you know) consists of your CSUB user ID and password. The second layer (something you have) involves a smartphone. This additional layer ensures heightened security for your account and university-related information, systems, and services.
CSUB’s 2Step process involves two steps: initially logging in with your password (something you know), followed by verification through your smartphone (something you have).
Currently, CSUB’s 2Step is implemented across various services including Microsoft Office 365 (Outlook, Word, etc.), MyCSUB, Canvas, and PeopleSoft.
To be able to manage your devices on your Duo account, visit the CSUB 2Step page. You can also call the CSUB Service Center at 661-654-HELP(4357).
Remember to NEVER share your Duo code with anyone requesting it, whether they contact you through phone, text, or email.
Duo Verified Push
Multifactor authentication (MFA) adds an additional layer of security to your account by requiring an approval from another factor (like your smart phone or hardware token) to login. However, hackers have started a new method, known as MFA fatigue, to try and gain access to your accounts. MFA fatigue works by bombarding your device with texts, calls, or push notifications to grant them access to your accounts. To stay one step ahead of these hackers, we’re introducing Duo’s Verified Push to help keep your accounts and information secure.
What is Verified Push?
Verified Push is Duo’s additional security against MFA fatigue. It works by sending a push notification to your device with a 4-digit passcode to login. If you are not currently attempting to login to a CSUB service, you can click the “I’m not logging in” button to report the attempt as fraudulent and notify the Information Security team.
You can activate your mobile push notifications by logging into the CSUB 2Step management portal, or by contacting the Service Center at 661-654-HELP(4357).
How do i login with verified push?
Logging in with Verified Push follows the same process as logging in with regular push notifications.
- Enter your CSUB email and password:
- The Duo Universal Prompt will appear on your computer and ask you to verify the login with Duo Mobile. You can also select the “Other options” to use a hardware token.
- In the Duo Mobile app, you will receive the Verified Push notification asking you to enter the 4-digit code shown on your screen. If you receive this message when you are not trying to access a CSUB resource, click the “I’m not logging in” button to report the attempt as fraudulent.
- Enter the 4-digit code shown on the screen in your device and click the "Verify” button to finish the authentication process. Once you’ve successfully authenticated, Duo Mobile will approve the login and you can access CSUB resources as you normally would.
What if i authenticate with texts or phone calls?
Duo Verified Push is not available for authentication with texts or phone calls. We recommend using the Duo Mobile app to take full advantage of these security features.
The Duo Mobile app is completely safe to use. CSUB and the Office of Information Security is committed to making the Duo Mobile app the quickest and most secure way to verify your identity with multifactor authentication. The app uses hardly any data and does not give the university any access or visibility into your phone.
Duo Mobile cannot read your emails, track your location, or see your browser history.
2Step Hardware Fob
If you do not have access to a smartphone, using a hardware fob offers a dependable alternative to Duo Push authentication. Users can authenticate logins by generating unique codes directly from the device itself. This method provides a tangible and reliable means of authentication, irrespective of internet connectivity or smartphone dependence. By pressing a button on the fob, users can generate a one-time passcode, enhancing the security of their login process. This approach is particularly advantageous for those who prefer a physical token for authentication or operate in environments where smartphone usage may be impractical or restricted.
If you'd like to get set up with a hardware fob for Duo authentications, you can call the Service Center at 661-654-HELP(4357). You can also create a request on ServiceNow using the 2Step Fob Request.
Duo Code Phishing
Remember to NEVER share your Duo code with anyone requesting it, whether they contact you through phone, text, or email.
Below is an example of attackers successfully tricking a student into giving them their Duo authentication code. Once they got the code they were able to login to the student's email and send out phishing emails to a majority of campus.
