decorative image

Pawprints: Security Best Practices to Keep You and UConn Cybersafe

Welcome to Pawprints! Here, you can review recommendations, tips, and the security best practices you should adopt to enhance your personal and university cybersafety.

Multifactor Authentication

Multifactor authentication neutralizes the security risks caused by compromised credentials, making it an important element to a secure login.   It requires you to verify your identity with both something you know (your login credentials) and something you have (your mobile device, phone, or tablet).  Review the Pawprints Best Practices to best utilize multi factor authentication to protect and secure your online accounts.

The use of multifactor authentication greatly improves your data security.

For more information on using 2FA at UConn, visit: Two-Factor Authentication at UConn.

2FA for Google Workspace

Enable 2FA for your Google Workspace Account

2FA enhances data security by requiring two forms of identification to gain access to an online resource.  When using 2FA, you first login with your credentials and then verify your identity with a physical device linked to your account. This additional layer of protection prevents anyone but you from accessing your accounts, even if they have obtained your username and password. 2FA is required to log into all services protected by Single-Sign On and Microsoft 365 at UConn.

If you have a UConn Google Workspace account, the information hosted in your Google Drive should be equally secure:

It’s Pawprints Best Practice to enroll in two-factor authentication with your UConn Google Workspace account. 

How to Set Up 2FA for your Google Workspace account:

  1. Log into Google at myaccount.google.com with your UConn email address and password.
  2. From the menu bar across the top of your browser window, click Security. 
  3. Scroll down to the How you Sign into Google panel and click 2-step verification. 
  4. Once redirected, click Get Started. 
  5. Follow the prompts to set up 2FA for your UConn Google Workspace account.

When you use 2FA to enhance the security of your online data in Google Workspace, you strengthen both your personal and university security. Note that 2FA for your Google Workspace account is not powered by Duo security. 

For information and guidance on how to access your Google Workspace account, visit: Gmail at UConn. 

Duo Push Notifications

Authenticate with a Push Notification from Duo 2FA

The use of two-factor authentication (2FA), powered by Duo, is mandatory for all faculty, staff, and students at the university.  When users log into UConn systems with their NetID and password, a few options to fulfill the authentication factor of the Duo 2FA login are available:  

  • Duo Push: push notification from the Duo Mobile App (recommended)
  • SMS Text: text message with a code that users can apply in the Duo Mobile App
  • Phone Call: automatic phone call with a key that users can apply in the Duo Mobile App
  • Duo Passcode: a one-time passcode generated and provided in the Duo Mobile App that users can enter into their login screen 

It is Pawprints Best Practice to use the Duo Push option to authenticate your logins.  

It is the quickest option because it allows you to immediately block a fraudulent login in the event that your account becomes compromised and the most secure option because it is the only method that does not require you to enter a code or passkey, eliminating the security risks of unused and unexpired passcodes.

For more information and guidance on how to use the push notification option for Duo 2FA, visit: Logging in with 2FA.

MFA Fatigue

Never Authenticate an Unexpected Duo Push

The Duo Push notification is probably not a stranger to your screen.  When you log into Duo 2FA protected UConn systems like Student Admin, you typically receive a push notification on your mobile device to Approve or Deny the login request.

If you receive a Duo push notification for a login attempt that you did not initiate, click Deny. From the following screen, click Yes, this was a suspicious Login. 

It’s Pawprints Best Practice to report any logins attempts that you did not initiate.

If a hacker is repeatedly sending you repeated requests to authenticate, report it to security@uconn.edu.  This type of attack is designed to make it difficult for you to use your device without approving the notification, but you should never, ever approve these requests.  This security vulnerability is called MFA Fatigue and puts your personal information and privacy at a serious risk. 

Because the Duo push notification screen is so familiar, it may be possible to accidentally hit accept on a Duo Push and authenticate a login that you did not attempt.

If you accidentally hit “Accept” on a Duo Push that you did not initiate, alert ITS and change your password immediately.

  • Change your password at netid.uconn.edu
  • Report the incident to security@uconn.edu
  • Alert the Technology Support Center at 860-486-4357 or techsupport@uconn.edu