IT division combats email phishing attempts with multi-factor authentication

In an effort to combat a significant increase in the number of email phishing campaigns this semester, Western Carolina University’s Division of Information Technology is expanding its multi-factor authentication efforts.

The enhanced MFA implementation will better protect WCU faculty, staff and student credentials and university data. Since the start of spring semester, email phishing attempts have resulted in more than 400 students and more than 40 faculty and staff members surrendering their username and passwords, said Joel McKenzie, WCU information security officer.

“We’ve had these email phishing campaigns going on the last few years, but starting after Christmas this year, they’ve just started attacking us really hard,” McKenzie said. “It’s the same thing that’s going on across the state, and universities across the country have just become a target for these things. We’ve got to try to find some ways to combat that, but also to protect the accounts.”

After a WCU computer user enrolls in MFA, logging on from off-campus will require an additional step. After entering a username and password, users will receive either a text on their cellphone or a notification via a phone application prompting them to verify their log-in. This added level of security is designed to prevent unauthorized people from logging into accounts.

“It’s not going to stop the phishing, but it’s simply going to protect the account if one does successfully get phished,” McKenzie said. “The MFA is designed to protect their account if they do give up their username and password. It will take something more than just their username and password to get back into their account.”

At this time, the enhanced MFA will protect applications such as myWCU, Office 365, GradesFirst, ChromeRiver and Digital Rivers.

An added benefit is that, once enrolled, WCU computer users will have to change their password only once a year, instead of every 90 days.

Faculty and staff members are required to enroll in the enhanced MFA by Monday, Feb. 26. They can early enroll by visiting Students will be enrolled by the start of fall semester, McKenzie said.