Two-step verification is an extra layer of security designed to ensure that you're the only person who can access your Touro account, even if your password is stolen. Verify your identity with a device in your possession, commonly a mobile phone, as part of your TouroOne login.
Accessing TouroOne-protected resources and applications will work a little differently with two-step verification.
Step 1: Log in to TouroOne with your username and password
Step 2: Verify the login with a device in your possession. You can authenticate with a mobile app, a code sent via text message, or a phonecall (even to a landline)
Authenticate using the DUO Mobile app passcode generator (the green key on the app's homepage) in areas with weak or unavailable cellular service, or for VPN access.
Use two-step verification every time you log in, or just once a month if you click the "Remember me for 30 days" checkbox in the DUO login prompt. The 30 day period must be set for each browser and computer you use. So, if you use DUO at home, you will have to check the "Remember me for 30 days" again, even if you checked it at work.
If you prefer not to use the DUO app, you have the option to receive a login passcode via text message. In the DUO login prompt, click the Passcode option and then click the blue text option at the bottom of the screen.
If you receive a DUO login request but you did not initiate the login, you should deny the DUO request immediately. This will prevent unauthorized access to your account, and will cause Touro's Information Security office to be notified so that the potential security breach can be investigated.
Register multiple devices so that you have a backup in case you lose access to your primary device (ex. If you lose your cell phone). You can do this by clicking "Add a new device" on the left-hand side of the DUO login prompt. After registering additional devices, you will see them appear in the dropdown at the top of the DUO login prompt.
If you prefer not to use the DUO app you can also select "Call Me" to authenticate via a phone call to your mobile phone or landline.
Why is Touro requiring the use of two-step verification?
Touro is a high priority target for hackers, including foreign nation state-sponsored entities who attempt to access University systems with ever-increasing sophistication and frequency. Two-step verification is designed to provide an extra level of security, and to make it more difficult for an impersonator to use Touro credentials to access our systems. This step will greatly enhance our information security, and help to protect direct deposit information, research data, and intellectual property, as well as faculty, staff, and student personal information.
What is two-step verification (Also known as two-factor authentication)?
Two-step verification adds an extra layer of security to your Touro account. You sign in with something you know (your TouroOne password) and use something you have (commonly a mobile phone) to verify your identity. This way, cybercriminals cannot access your Touro account, even if they have your password. Touro has partnered with Duo Security to provide this service.
What devices can I use? What if I don't have a smartphone, or don't wish to use my personal device?
While a smartphone with the Duo Security mobile app installed is highly recommended for ease of use, you can use a variety of devices and authentication methods to meet your needs. You can receive your login passcode via text message, or you can receive a phonecall.
What happens if I don't have access to my primary device? What if I forget or lose my mobile phone?
If you add a second device (strongly recommended) when setting up your two-step verification account, you may use that second device to authenticate. Additionally, the Help Desk has the ability to provide a one-time bypass code over the phone (additional information will be required to verify your identity). Call the TouroOne Nonstop Helpdesk at 1-844-868-7666, or email firstname.lastname@example.org
What if I travel often or work overseas?
Anyone who travels or works internationally and needs to log in to TouroOne-protected resources can set their two-step verification method to "DUO passcode." You can use the DUO Mobile app passcode generator (the green key on the app's homepage) to generate a passcode without internet or cellular connection.