2FA in schools

[GRUK]

Hi, could I please ask what school's are using for 2FA? - I'm looking loosely at USB Keys, but I don't think the price and general use, will work too well in a school environment. I guess it could come down to Authenticators on phones, but even that is going to be a culture (and policy) shock.

[DrBeaker]

Use token keys.

 

Pushback the issues to SLT.

 

Otherwise SLT will happily make IT the enemy/scapegoat for it.

 

YMMV and just my 2 cents - but Staff shouldn't have to use their own mobile phones for it, especially so with the lower-paid support staff.

[Rob_D]

Microsoft authenticator app for most people. And Ubikeys for the (in the end, 1 person) who didn't want to use their phone. There are probably a few more people who just don't log-in remotely. (Conditional access is set up to only need the second factor when logging in from outside the school)

 

We tied it in with SSO into Bromcom, and managed to get a couple of key SLT on-side so not much pushback at all.

[Iain.Faulkner]

We use the Microsoft authenticator app with conditional access setup so staff aren't prompted when in school. We had very little push back from staff, and a lot of support from SLT. The key line, from SLT, being that staff aren't expected to work from home, that is a personal choice. This has been done at both our secondary schools now and it's been a very positive process.

[highsky]

As above ms authenticator and the mobile number option for any outdated devices.

Azure conditional access to exclude the school ip.

Hopefully you aren't a Google school for this atm.

 

For any pushbacks key or no access externally.

 

On top geolocation in Azure and firewall.

[ITGuyNW]

I've tried going the "cheap" route of using Microsoft Authenticator on their phones but phone signal is poor here. I've asked them to connect to school Wi-Fi but that's perceived as a "faff".

 

Not in a position to buy dozens of tokens for everyone so going to push this on SLT.

[Mark182]

As others have said, trusted location in school so doesn't ask for MFA when on the school network, this link and this youtube video

[enjay]

I've tried going the "cheap" route of using Microsoft Authenticator on their phones but phone signal is poor here. I've asked them to connect to school Wi-Fi but that's perceived as a "faff".

 

If mobile signal is poor, I'd have thought they'd be glad to connect to your WiFi!

 

We're about to push 2FA as well, using Authenticator app as the default option with the offer of token keys for those who prefer. The use of personal devices should be acceptable for the vast majority here, as our payroll company has already pushed that button for us, insisting on an authenticator app to access pay slips and P60s, also lots of staff like having ClassCharts and email on their phone. We tried a few years ago and had massive pushback, but things have shifted since then.

Edited December 12, 2023 by enjay

[ITGuyNW]

If mobile signal is poor, I'd have thought they'd be glad to connect to your WiFi!

 

You'd think so but I've had the eye rolls, the moaning, the "well I'm not going to remember to connect to that in the morning", "I'm too busy to do this".

 

Unbelievable pushback tbh.

[enjay]

"well I'm not going to remember to connect to that in the morning"

 

Don't worry, your phone will remember for you... just like it does at home!

 

We had concerns around filtering, but that went after a bit of reassurance we don't monitor staff mobiles and they can still access WhatsApp.

 

Our challenge is stopping staff from telling the password to students. We've had to reset it a few times, next time we might just take the provision away (or require all devices to be connected by my team, which would be annoying). I nearly changed the password to "do-not-tell-this-to-students" but I thought that was a bit too passive aggressive!

[Oaktech]

Authenticator app for all staff, OTP C200 generators for Y6 and the 3 members of staff who don't have smartphones, conditional access set up for school.

[TechMonkey]

I've tried going the "cheap" route of using Microsoft Authenticator on their phones but phone signal is poor here. I've asked them to connect to school Wi-Fi but that's perceived as a "faff".

 

Not in a position to buy dozens of tokens for everyone so going to push this on SLT.

 

I'm usually a proponent of conditional formatting to allow on site to bypass 2FA but in this case I think I would ignore it just out of spite!! About to go into 2024 and staff think connecting to a wi-fi point once is a faff!!

[Rob_D]

I've tried going the "cheap" route of using Microsoft Authenticator on their phones but phone signal is poor here. I've asked them to connect to school Wi-Fi but that's perceived as a "faff".

Not in a position to buy dozens of tokens for everyone so going to push this on SLT.

 

Just tested it and once it's been set up, the Microsoft Authenticator app works offline for OTP codes.

[ITGuyNW]

Just tested it and once it's been set up, the Microsoft Authenticator app works offline for OTP codes.

The issue I've found is that it asks for the number notification popup first but you can choose the "I can't use the authenticator app right now" option and you can go through and use the code. Trying to explain to staff just press this option here to use the code option instead and I get the eye rolls etc.

[PrimaryNetMan]

Google School here so Text Message, Google Authenticator App or Yubico Keys. No CA, as well it's Google lol.

[msi_school]

Don't worry, your phone will remember for you... just like it does at home!

 

We had concerns around filtering, but that went after a bit of reassurance we don't monitor staff mobiles and they can still access WhatsApp.

 

Our challenge is stopping staff from telling the password to students. We've had to reset it a few times, next time we might just take the provision away (or require all devices to be connected by my team, which would be annoying). I nearly changed the password to "do-not-tell-this-to-students" but I thought that was a bit too passive aggressive!

 

I used to have an Aerohive network and staff where issued a PPSK with only two concurrent devices allowed this resolved the staff sharing the password issue.

 

Its a bit of in investment though so you might need another solution :-)

[dhicks]

I'm looking loosely at USB Keys, but I don't think the price and general use, will work too well in a school environment.

 

We've issued USB keys to our staff, with relativly little fuss / bother. We have a "no mobile phones visible" policy in the school, so staff shouldn't have their phone out in classrooms anyway. The keys we have can also be used as fobs for printing and door entry, so trhey become staff's handy one-item device for security.

[FN-GM]

Don't worry, your phone will remember for you... just like it does at home!

 

We had concerns around filtering, but that went after a bit of reassurance we don't monitor staff mobiles and they can still access WhatsApp.

 

Our challenge is stopping staff from telling the password to students. We've had to reset it a few times, next time we might just take the provision away (or require all devices to be connected by my team, which would be annoying). I nearly changed the password to "do-not-tell-this-to-students" but I thought that was a bit too passive aggressive!

 

Easily fixed with Radius Authentication. Everyone connects with their own credentials.

[Sylv3r]

We went for the SafeID's - fairly expensive for all 1800 staff - ask me again in about 3 - 4 years time when the batteries start to fail and we may need a plan B !

 

https://deepnetsecurity.com/products/pre-programmed-tokens/

[TwistedHelixis]

I pushed out 2FA to all my schools about 6 years ago. Back then I created a step by step that listed all the different options in my preferred order, starting with Yubi keys, Google authenticator etc, with the last one being text message. Now its so embedded they don't have the steps, new users are walked through by the office staff or teachers.

[GRUK]

Thankyou everyone for your input, learnt quite a lot from the different solutions that you've been through.

[David44]

We've issued USB keys to our staff, with relativly little fuss / bother. We have a "no mobile phones visible" policy in the school, so staff shouldn't have their phone out in classrooms anyway. The keys we have can also be used as fobs for printing and door entry, so trhey become staff's handy one-item device for security.

 

What keys are you using that support 2FA and printing/door entry?

[dhicks]

What keys are you using that support 2FA and printing/door entry?

 

The Feitian K9:

 

https://www.ftsafe.com/products/FIDO/NFC

 

For using them as 2FA USB keys, a couple of small gotcha's: our nice, compact all-in-ones have side-mounted USB ports hidden away behind the screen, and mounted the wrong way around for someone to be able to press the touch pad with their finger when using the key. A short (30cm) USB extension cable solves that. Also, the USB interface is of the thin style, so it can be put in a port upside down, which can confuse some users.

[CyBeRkId2002]

One thing I think a lot (and I mean a LOT) of people miss is there understanding of how conditional access works.

 

Many times I have read that by implementing conditional access to ignore internal addresses staff who are resistant to register for MFA simply don't have to do it as long as they don't want external access. This is not protecting your network. In this scenario the first person to get the registration prompt is the cyber criminal who can just register with their details. All staff members (particularly those with access to sensitive info) should have to enable MFA on their account. We run reports periodically to make sure this is the case and it is part of our IT induction process.

 

I am not saying that there isn't the argument for or against personal devices / hardware keys etc. but conditional access is not a replacement unless you configure a group of those who refuse and actively block their access externally (also possible using conditional access but not what I think most are referring to)

[gaz350b]

I’m pretty sure when you enable on site as a safe location it asks you to register on site. Only know this as I input a rule in for international addresses for students required 2fa and they started getting the registration process on site!