1. Two Factor Authentication
Steven Burke U.S. Department of Education 2012 Software Developers Webinar #3

2. Agenda Project Overview
Postsecondary School Federal Financial Aid Eco-System
Project Scope
Project Phases and Deployment Status
TFA Attestation Lifecycle
TFA Attestation/Confirmation Process
Registration Scenarios
Frequently Asked Questions
Additional Resources

3. Project Overview
In 2010 an estimated 90,000 accounts were identified accessing FSA systems without a second factor authentication. FSA hosts at least 80 million records - all currently unprotected in accordance with industry best practices and Office of Management and Budget (OMB) mandate M
The U.S. Department of Education is implementing a security protocol through which all authorized users will be required to enter two forms of “authentication” to access Federal Student Aid systems via the Internet.
This process is referred to as Two Factor Authentication (TFA).

4. Postsecondary School Federal Financial Aid Eco-System
6,400 unique institutions of higher education
Over 3,000 financial partners
Over 90K privileged accounts
Over 70M unique identities
Over 320M loans
Over 96M grants
Supporting students in 35 countries
$1T loan book
Over 13M students
Over 30M aid awards
Over $120B injected into the eco-system each year
FSA
Staff: ~1,300
Contractors: ~ 10,000
Services
Aid Apps
Grants
Loan Origination
Loan Servicing
Debt Collection
Compliance

5. Two Factor Authentication Scope
Provide safe and secure access to FSA network services
Primary systems impacted across the enterprise
NSLDS, CPS, COD, AIMS, PM, FMS, and SAIG
This project encompasses approximately 90K users
FSA employees, Dept. of ED employees
Partners
Postsecondary School Destination Point Administrators (DPA)
Guaranty Agencies
Servicers, PCAs, NFPs
Call Centers, Developers, Contractors, and Sub-Contractors
TFA project is focused on privileged users
A privileged user is anyone who can see more than just their own personal data

6. What is Two Factor Authentication?
Something that you know is the First Factor:
User ID and Password
Something that you have is the Second Factor: Token with a One Time Password
The One Time Password (OTP) will be generated by a small electronic device, known as the TFA Token, that is in the physical possession of the user
To generate the OTP, a user will press the “power” button on the front of the token
A different OTP will be generated each time the button
is pressed
Alternative Methods of obtaining OTP without TFA Token:
A) Answer three Challenge Questions online
B) Have the OTP sent to your Smart Phone

7. TFA Project Phases
Phase 1 To ensure the successful deployment of two factor tokens for FSA – Citrix users; 1,300 completed 5/1/2011 Phase 2 To ensure the successful deployment of two factor tokens for Department of Education Staff and FSA Contractors; approximately 5,200 users and FSA Contractors completed 10/28/2011 Phase 3 International users, Foreign Schools (FS) and Domestic Schools, when logging into FSA systems across 35 countries; completed12/31/2011 Domestic users, to ensure the successful deployment of two factor tokens for users when logging into FSA systems; 88,600 users by 12/31/2012 Phase 4 Guaranty Agencies, TIVAS, Third Party Servicers, Not-for-Profits, Payment Collection Agencies (PCA), and VPN users connecting through Virtual Data Center (VDC)

8. TFA Deployment Status
Total TFA Tokens Deployed: 48,280 in the USA and 35 Countries
Tokens Deployed to Phase III & IV for Partners: 41,698
Partner tokens registered: 23,357
Percent Registered: 56%
System Update: % Complete
NSLDS moved behind AIMS, completed on 12/18/2011
COD TFA enabled on 1/28/2012
SAIG Enrollment TFA enabled 2/12/2012
EDconnect TFA enabled 3/4/2012

9. TFA Attestation Lifecycle

10. TFA -Token Deployment Forecast As of 8/17/2012
Group
State
Initial Estimated Schools/Users
Estimated Completion Lockout Date
Revised
Lockout
Date
Attestation Completed
Estimated Completion Lockout
3/ Schools 1,529 Users
10/30/2011
10/30/ Schools ( 1,444 ) Users 6 AR
3/ Schools 6, Users
8/3/2012
8/17/2012
( ) Schools ( ) Users FS CO
DeVry GA KS MO 1 DC
3/ Schools 2, Users
2/27/2012
6/8/2012
6/8/ Schools ( 2,913 ) Users DE 7 AZ
3/ Schools 7,158 Users
9/7/2012
11/23/2012
As of 8/17/2012 ( ) Schools ( ) Users MD CT VA IA WV IL IN 2 NC
3/ Schools 5,154 Users
3/16/2012
6/8/ Schools ( 4,791 ) Users LA NJ NY 8 AL
3/ Schools 3, Users
10/12/2012
( ) Schools ( ) Users SC AS FC 3 KY
3/ Schools 6,615 Users
4/20/2012
7/20/2012
As of 8/17/2012 ( 788 ) Schools ( 6,360 ) Users FM MI GU NE HI NH MA OH ME PA MH RI MP VT MS TN 4
3/ Schools 8,155 Users
5/25/2012
As of 8/17/2012 ( 513 ) Schools ( 5,524) Users CA 9 MT
3/ Schools 3, Users
11/16/2012
( ) Schools ( ) Users FL NM NV PR 5 AK
3/ Schools 5,740 Users
6/29/2012
As of 8/17/2012 ( 469 ) Schools ( 3,852 ) Users PW ID UT MN WA ND WI OR WY SD TX

11. Attestation/Confirmation Process
For each school, the Primary Destination Point Administrator (PDPA) and the COD Security Administrator need to work together to ensure all users have been identified and receive tokens
Step 1: Confirmation/Attestation
Confirm/Attest to the individuals (unique users) at your school who are authorized users of one or more of the identified Federal Student Aid systems. This confirmation will only be used to determine the TOTAL NUMBER of tokens you will receive
Identify any Third Party Servicer(s) supporting your school
Confirm the physical street address to which tokens should be shipped, and provide a telephone number where we can contact you    
NOTE: We cannot ship to PO Boxes

12. Attestation/Confirmation Process
Step 2: Federal Student Aid Ships Tokens to School
The tokens will be sent to the attention of the PDPA via UPS
Step 3: Token Receipt, Distribution, and Registration
After the tokens are shipped, FSA will send an with more information about token distribution and registration
The tokens are to be registered within 7 days of receipt

13. Attestation/Confirmation Process
To expedite the attestation/confirmation process:
Click “reply” to respond to the attestation message
(Please do not change the subject line.)
Example Subject Line:
GR6 - AR - University Of Central Arkansas Attestation Required
Complete the TFA Attestation form embedded in the attestation

14. Attestation/Confirmation Process

15. How do I register my token?
Once you receive your token you must register it once for the systems behind PM (NSLDS, CPS and SAIG/EDconnect) and once for each COD account.
Each FSA System website will be slightly different when logging in and registering your token
Next Steps:
Click on the following link:
Then click on the Register/Maintain token URL on the top right hand side of the screen.

16. TFA Registration Scenarios
John has access to NSLDS, CPS and SAIG. He will need to register his token only once.
Participation Management (PM) COD NSLDS, CPS FFA, SAIG
John Doe
FSA user ID: John.Doe.FSA
Token S/N: AVT
N/A
TFA Registration Scenario 2
John has access to NSLDS, CPS and SAIG and has (1) COD user ID. He will need to register his token (2) times.
Participation Management (PM) COD NSLDS, CPS FFA, SAIG
John Doe
FSA user ID: John.Doe.FSA
Token S/N: AVT
John Doe
COD user ID: JDOE01 Token S/N: AVT

17. TFA Registration Scenarios
John has access to NSLDS, CPS and SAIG and has (3) COD user IDs. He will need to register his token (4) times.
Participation Management (PM) COD NSLDS, CPS FFA, SAIG
John Doe
FSA user ID: John.Doe.FSA
Token S/N: AVT
John Doe
COD user ID: JDOE01
COD user ID: JDOE02
COD user ID: JDOE03
Token S/N: AVT
TFA Registration Scenario 4
John has access to COD and has (1) COD user ID. He will need to register his token only once.
Participation Management (PM) COD NSLDS, CPS FFA, SAIG
N/A
John Doe
COD user ID: JDOE01 Token S/N: AVT

18. TFA Registration Scenarios
John has access to COD and has (3) COD user IDs. He will need to register his token (3) times.
Participation Management (PM) COD NSLDS, CPS FFA, SAIG
N/A
John Doe
COD user ID: JDOE01
COD user ID: JDOE02
COD user ID: JDOE03
Token S/N: AVT

19. TFA Frequently Asked Questions
Will I be locked out of FSA systems if I don’t have a token?
Once your school has been TFA enabled (locked) a token will be required to access FSA systems
I received more tokens than I have authorized users. What do I do with the extra tokens?
Each token shipment will include at least one (1) extra TFA token, for use as a replacement for a lost or broken token, or for issue to a new authorized user
I need more tokens. How do I get them?
For additional tokens please send an to We can only send tokens to the Primary DPA
Do I need to provide tokens to my Third Party Servicer?
No, however please indicate the name and point of contact if you have engaged a Third Party Servicer

20. Support Contacts
Two Factor Authentication Questions: For general questions about TFA
Central Processing System – Financial Aid Administrators (CPS-FAA) Student Aid Internet Gateway (SAIG) Phone: / TTY Website: FAA Access CPS Online ( National Student Loan Data System (NSLDS) Phone: Common Origination and Disbursement (COD) Phone: COD School Relations Center (for Grants) Phone: COD Direct Loans
 Employee Enterprise Business Collaboration (EEBC)
Support Hours: Monday-Friday, 8 AM – 5 PM
Phone:
eCampus-Based (eCB)
Support Hours: Monday-Friday, 8 AM – 8 PM
Phone:
Website: The eCampus-Based System (   

21. Contact Information
We appreciate your feedback and comments. Please contact:
Leslie A. Willoughby
Phone: (202)