1. CIO Council Identity and Access Management
September 11, 2015
Friday
2:40-3:10 p.m.
Smith Center 561

2. Agenda HarvardKey Implementation Schedule
Multifactor Authentication in HarvardKey

3. Proposed HarvardKey Timeline
8/28/2015
Proposed HarvardKey Timeline
2016
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sept
HarvardKey rollout
Claim HarvardKey
Harvard Phone
my.Harvard
Simplified Sign-On
Integration of School and local systems
Integrated Users and Resources
New HKS/HLS students provisioned via HarvardKey
Security Groups
Strategy (now – 3/16)
Grouper (4/16 – 6/16)
HarvardKey in use
HKS / HLS Provisioning
HMS Provisioning
Strategy
Grouper Buildout

4. HarvardKey Implementation Schedule
8/28/2015
HarvardKey Implementation Schedule
School
Number of Users
Rollout Date
Provisioning Date
Alumni
350,000
9/22
DCE
10,842
11/12
n/a
HBS
3,678
12/3 (Proposed)
FAS / College
29,616
GSD
1,585
TBD
GSE
1,922
HKS
5,882
3/31
HLS
3,622
11/19
HSPH
3,926
HDS
750
SEAS
265
HMS
25,534
12/3
later in 2016
Radcliffe
158
CADM
9,355
since July 2015

5. Multifactor Authentication: The Factors
Something you know
Something you have
login/password, SSN
physical keys, smartphone app, FOB
fingerprint, retina, voiceprint, DNA
Something you are

6. Multifactor Authentication: Starts With “Who Are You?”
Usernames and passwords are the most common method of authentication, but have significant weaknesses
Multifactor authentication (MFA) plays a pivotal role in improved authentication
Answers the question “Who are you?” with a higher degree of certainty than passwords alone
Often confused with authorization, which answers the question “What are you allowed to access?”
Duo Security was selected as the platform for Harvard’s multifactor solution
Over time, Duo will replace other vendor MFA solutions in use at Harvard and extend protection to additional applications

7. Multifactor Authentication in HarvardKey
Multifactor authentication using Duo Security will be available at time of HarvardKey rollout in November
Participation per user is optional for HarvardKey web applications
In the future, applications may be configured to require multifactor authentication for access
Demand is high for enabling MFA with additional Harvard applications; through the end of CY15, IAM is evaluating the use of MFA with VPN, Windows administration tools, and Office 365 services

8. Thank you!