Multi-Factor Authentication Policy

Purpose: To define the use of multi-factor authentication (MFA) for accessing Pittsburg State University (PSU) computer systems containing sensitive data from both on and off campus. The standards set forth in this policy are intended to minimize potential security risks which may result from unauthorized use of PSU computing resources. MFA adds a layer of security which helps deter the use of compromised credentials.

Applies to: To all PSU faculty, staff, students, and affiliate users. This policy applies to any system that requires an additional layer of protection as determined by Information Technology Services (ITS) in collaboration with campus data stewards.

Policy:

Statement

Systems requiring multi-factor authentication include those supported by ITS as well as systems administered by non-centralized departmental IT staff. Systems requiring the use of MFA include, but are not limited to, virtual private network (VPN), systems utilizing Single Sign-On (SSO), PSU applications/systems that contain sensitive data, system administration tools, and privileged accounts. 

All users must use MFA to access PSU computing resources that require MFA. If users do not use MFA, they will not be able to access these computing resources.

ITS will regularly evaluate and prioritize applications requiring MFA, to enhance the protection of institutional data and personal information.

Consequences

Any individual who violates this policy may lose computer and/or network access privileges and may be subject to remediation and/or disciplinary action in accordance with and subject to appropriate university policy and procedures.

Multi-Factor Authentication Policy Addendum

The State of Kansas Defines Multi-Factor Authentication as follows:
A method of confirming a User's claimed identity in which access is granted only after successfully presenting two or more different pieces of evidence (factors) to an authentication mechanism. Factors include:

• Knowledge: Something the user and only the user knows.
• Possession: Something the user and only the user has.
• Inherence: Something the user and only the user is.