This is a reposting of an email sent to Rice community on 4-10-19.
Dear colleagues,
As you may know, attackers were able to steal the usernames and passwords of employees with access to admissions portals at several higher education institutions. The attackers took advantage of flaws in those institutions’ password recovery process. Once they had access, the attackers were able to download private admissions data.
While our password recovery process does not have the same flaws and is not susceptible to the same type of attack, this incident illustrates that attackers are targeting our account passwords and the tools that manage them.
What we are doing to protect Rice
Two weeks ago, we enhanced our account portal, My NetID, to send email notifications when certain key changes are made. This includes updates to your password, contact information, and email addresses. The notifications will be sent to your Rice email address along with the external contact email address listed in the My NetID portal. If you receive an email notification and you did not make any changes, you should contact the OIT Help Desk at 713-348-HELP or helpdesk@rice.edu.
Additionally, on April 22nd, we will begin requiring Duo, our multi-factor authentication (MFA) system, to access the My NetID portal. Anyone that has not already set up Duo will be required to do so upon login to https://mynetid.rice.edu. This change will make it more difficult for attackers to use stolen usernames and passwords to access the account portal and make changes to our accounts.
This enhanced protection will soon be available on other services on campus, starting with those that store or process sensitive, confidential, or other private information, including Slate, our admissions portal, and general access to employee payroll and direct deposit information.
More Information
If you would like to enable this protection now, simply log into https://mynetid.rice.edu and click on “Two-Factor Authentication” in the left hand menu and then click on “Enable Two-Factor Authentication” to start the Duo setup process.
You can also set up or change your external contact address, the one that will receive account change notifications, while logged into the portal. You can do this by clicking on the menu option titled “Contact Information” in the left hand menu of the page.
A full walk through of this process can be found here:
https://kb.rice.edu/duoguide
For information about managing your Duo devices visit:
https://kb.rice.edu/manageduo
For information about traveling with Duo visit:
https://kb.rice.edu/duotravel
For information about Multi-Factor Authentication visit:
https://kb.rice.edu/whatismfa
Thank you for helping us protect our resources and the privacy of our data. If you have any questions, please contact the OIT Help Desk at 713-348-HELP or helpdesk@rice.edu.
Thank you,
Marc Scarborough
Chief Information Security Officer