What is Multi-Factor Authentication?
Single factor authentication, such as typing a password, is increasingly insufficient protection for online accounts. The combination of phishing, malware, and brute-force guessing present a formidable threat to single factor authentication.
Multi-Factor Authentication (MFA) requires you provide more than one factor to authenticate. Most commonly, MFA requires typing a password (first factor) and entering a one-time code (second factor) generated by a device, such as Google Authenticator. With MFA, an attacker will not be able to impersonate you, even if they know your password, whether from hacking a database, or by phishing attack. Access will be denied because they will not have the physical token in their possession.
Integration of One-Time Passwords with User Credentials
For access to most Lab resources other than privileged server access, Berkeley Lab has implemented an MFA strategy requiring the use of your Berkeley Lab Identity credentials in conjunction with a one-time password (OTP). An OTP can be generated either by a software or hardware solution. Berkeley Lab IT has enabled the ability to use either. Software OTPs are generated using Google Authenticator, whereas hardware OTPs are generated from an authentication device known as a YubiKey. Berkeley Lab IT is the organization that issues the hardware authentication device.
MFA at Berkeley Lab
Berkeley Lab uses MFA for access to:
- Multi Factor Authentication for FMS - MFA for FMS is required for any users that have been opted or required to use MFA
- Multi Factor Authentication for HRIS - MFA for HR personnel logging into Berkeley Lab HR databases and accessing Personally Identifiable Information (PII) data
- Multi Factor Authentication for Windows (StrongID) - MFA for Operations personnel logging into Windows Active Directory computers (sometimes known as StrongID)
- Multi Factor Authentication for Single Sign-On (SSO) - MFA for Single Sign-On providing Lab personnel access to Berkeley Lab resources like email, calendar, LETS, etc.
- Multi Factor Authentication for Privileged Server Access - MFA for access to critical servers and services via gateways (sometimes known as L4 Gateways, or L4 StrongID)
- Lawrencium HPC Cluster - MFA for HPCS Clusters
How do I get started using MFA?
- If you are a member of the Science staff, an affiliate, a student/post-doc, or otherwise not an Operations staff member, you should get started in MFA by following this link.
- If you are a member of the Operations staff, follow this link.
If you have questions regarding MFA enrollment, please submit a help ticket.
