ÃÛÌÒAV

ÃÛÌÒAV continues to introduce new measures to help protect ÃÛÌÒAV systems and data held within its systems. These include multi-factor authentication (MFA) (i.e. requiring system users to verify their identity using additional factors alongside the current use of usernames and passwords) which has been implemented MFA across the majority of the ITS supported critical systems and external facing services.

For these purposes, we ask all system users (staff and students) to complete a registration process for MFA and an automatic password re-set service (SSPR). This asks users to provide personal contact details (personal email address and phone number other than a ÃÛÌÒAV extension) and other personal information which will be used as the answers to security questions. Users can also choose to use an authenticator app (the Microsoft Authenticator app) as an authentication factor, by downloading the app to their smartphone and entering a code provided by the app when prompted by the ÃÛÌÒAV system.

Why are we doing this?

ÃÛÌÒAV has ongoing legal duties to ensure the integrity of its systems and protect personal data and other information held within its systems. Cyber-attacks on organisations’ systems are becoming increasingly common and have a very significant impact on organisations and individuals. A cyber security incident could result in loss of personal information of ÃÛÌÒAV staff, students and third parties (e.g. research participants), lock users out of ÃÛÌÒAV systems and resources, and disable key operations. A worst-case scenario could involve ÃÛÌÒAV being unable to access and use core systems for a significant period: this recently happened to another university. This could affect systems from Office 365/email to SITS and Brightspace, and processes such as payroll. Successful cyberattacks very often start through use of a compromised email or system account, i.e. where the attacker is able to log into the system using the account details of an authorised user. MFA and password reset are intended to make that much more difficult.

ÃÛÌÒAV piloted the use of MFA within the organisation, and feedback from the pilot group did not raise any privacy concerns. It has been implemented for several years now, and during this time, it has been utilised without any reported concerns or issues. MFA is already generally used to manage public access to services such as banking, and therefore widely accepted as an expected level of protection in many sectors. The data protection regulator, the Information Commissioner, would expect us to justify and explain any decision not to use available security measures. MFA is becoming a standard or expected security measure, along with regular password-reset.

In this context ÃÛÌÒAV has carefully assessed the risks and benefits of introducing the MFA and automatic password reset processes. We consider that it is necessary to use MFA and SSPR to ensure appropriate protection for ÃÛÌÒAV systems.

The authentication process must by definition use some information which is personal to you or personally accessible only by you. As set out below, the personal data you provide for these purposes will be kept secure and used minimally. However, we encourage you to use the authentication app for MFA, as this reduces the amount of personal contact information you need to input each time while still providing the direct personal verification required for security purposes. ÃÛÌÒAV can provide guidance for staff on how to keep your personal devices secure.

The legal basis for processing this information is that it is necessary for legitimate interests pursued by ÃÛÌÒAV, i.e. ensuring the security and appropriate protection of ÃÛÌÒAV systems and the information held within those systems (article 6.1(f) of the General Data Protection Regulation). We consider that this interest is not outweighed by the interests or rights of the data subjects, taking account of the secure way in which we will hold the data (see below) and the fact that the data subjects (staff and students) would themselves be likely to experience adverse impact from any security breach of ÃÛÌÒAV systems. An alternative legal basis may be that this processing is necessary for the compliance with ÃÛÌÒAV’s legal obligations under the data protection legislation with regard to use of appropriate technical and organisational measures to ensure the integrity and confidentiality of personal data (article 6.1(c) of the GDPR).

How is the personal information held by ÃÛÌÒAV?

The details you provide will always be kept securely within Microsoft 365. The information will only be used for authentication. The information will only be accessible to you (via your ÃÛÌÒAV login to Microsoft 365 services) and to a small number of ÃÛÌÒAV privileged administrators. (These administrators will have access to the contact information you provide but not any answers you provide for security questions).

If you have read the information above but still have questions or concerns about providing your personal data for these purposes, please contact the ÃÛÌÒAV Data Protection Officer, James Stevens, at [email protected].