Last year, the University began requiring multi-factor authentication (MFA) for all students, faculty, and staff to access systems such as Banner and email. MFA requires people to identify themselves with more than a username and password, which are prone to being stolen or cracked by third parties. Adding an additional verification method, such as accepting a push notification to a phone app or entering a code sent via text message, drastically reduces the likelihood an account will be compromised. However, MFA is not fool proof.

The FBI has recently been warning companies to beware of attacks to circumvent MFA. Most of these attacks use “social engineering” to trick people into approving an MFA prompt that will grant unauthorized access to a system. Often, attackers will use that approved MFA prompt to enter the MFA enrollment portal. This allows them to enroll their own device so they can accept MFA prompts for accessing other resources in the future. Below is a list of variations of these attacks.

• Most MFA providers allow people to receive a phone call and push a key as the additional factor for authorizing an account. Attackers will place repeated calls, often in the middle of the night, until the person finally accepts the MFA request to make the calls stop.
• Attackers will repeatedly attempt to access a system requiring MFA until the person approves the request out of habit – How often do we say “No” to an MFA request? – or to make the prompts stop.
• Attackers will only attempt to access a system requiring MFA one or two times a day to avoid attracting attention but hoping the person will eventually accept an MFA prompt.
• Attackers will call someone pretending to be a fellow employee, usually a member of the information technology team, and asking the person to accept an MFA request as part of a company process or to resolve a technical issue.

While multi-factor authentication is a critical part of protecting accounts from being compromised, we still need to remain vigilant. Cybercriminals are constantly changing tactics in response to the technologies we use to protect information assets. In the end, we are the most important factor in keeping our data safe.

ITS will continue to simulate phishing and assign training to those most susceptible. If you believe you’ve been targeted by phishing, see Reporting a Phishing Message (How-to).

— Chris Mielke, ITS

The project team reviewing faculty recruitment strategies will soon start drafting recommended tools and templates for consideration and possible adoption. The workgroup—consisting of Jennifer Harvey, Ann Guddall, and Drinda Williams in Academic Affairs; Maureen De Armond and Marli Jefferson in Human Resources; and Renée Cramer and Sue Mattison as the project’s executive sponsors—remains excited about opportunities to modernize practices and refine strategies when it comes to recruiting new faculty.

Through due diligence efforts, the project team also dove into some recent faculty searches to draw more data-informed conclusions about what we are seeing in current pools. We found that recent applicant pools have ranged in size from 3 to 277. We are seeing that more and more candidates are finding our job postings on sites like HigherEdJobs, professional organizations, and through word of mouth. Gone are the days when The Chronicle was “the place” to look for faculty openings.

One topic of interest shared by deans was interest for a dual career/spousal hiring program. Many universities offer a range of support to the spouses and partners of top candidates, who will also be seeking work in Des Moines. The project team listened to suggestions from deans, benchmarked practices at peer institutions and other universities, and are working up the outline of an initial program for Drake University. While this project’s focus is recruitment, the adoption of a dual career program will also support faculty retention.

In consultation with Kevin Saunders, director of institutional research and academic assessment, the project team will be very intentional in assuring any draft documents it proposes speak to the faculty qualification standards established by the Higher Learning Commission. HLC standards should co-exist with Drake’s faculty recruitment materials and the project team will assure this happens.

The project team will also be reviewing search committee chair and search committee training to assure we are using the most modern and best practices to assure our search committees are informed, supported, and prepared to manage searches.

The project team has been thrilled with the feedback and input it has received from new faculty, former search chairs, academic chairs, business office managers, and deans. While the list of work yet to do remains long, this is an ideal time to revisit recruitment. More updates to come in August.

If you have questions or suggestions relating to faculty recruitment that you would like the project team to hear, please email drakehr@drake.edu, subject line: Faculty Recruitment and the team will get the message.

— Jennifer Harvey, Campus Equity and Inclusion; and Maureen De Armond, Human Resources

To ensure the safety and security of the Drake community and remain compliant with federal and local regulations, ITS will be enabling E911 calling within the Teams Phone System. This will allow Teams to send an approximate location to emergency services personnel when a user dials 911 from that device. 

E911 services will roll out to Drake faculty and staff using the Teams client in early August. It will not impact any other calling features. Once the feature has been released, individuals calling from the Teams app on their computer or cellphone may receive a notification within the Teams Calls module to confirm or manually update their approximate location displayed in the lower left corner of the Calls module. This location will update as a wireless device is moved around campus. The location of “fixed” handsets will be configured by ITS and no action will be needed by the user.

The location feature is only used to send to emergency services personnel when a 911 call is made and is not available to any other individual or organization you call.

To learn more about the E911 calling feature within Teams please see E911 Calling with Teams (FAQ).

— Jeff Regan, ITS

Drake University will be transitioning their procurement card program from PNC Bank to UMB Bank on Sept. 1, 2022. This was a decision made by the University for several reasons.  First, Drake recently negotiated a debt restructure.  As part of this agreement, Drake agreed to consider moving the Pcard program to UMB.  After researching UMB’s Procurement Card Program, it was determined UMB is able to offer better overall customer service compared to our current Pcard provider.  The contract terms were also more favorable for the University.  Although cardholders will log into the UMB system, the platforms are very similar which should allow for a seamless transition.

What does this mean for cardholders?  All cardholders will receive a new card.  We have worked with UMB to design a card with a picture of Old Main on it.  We are hopeful the new design will make the Pcard more distinguishable from cardholders’ personal credit cards. UMB will be providing in person training Aug. 22, 23, and 24 at various times to review the online platform where cardholders will submit receipts/documentation and approvers will approve charges.  They will also be reviewing the mobile app option.  This option allows cardholders a convenient way to manage receipts.  An online option will be offered at a later date for those not able to attend in person.  Please note: all cardholders are required to attend one of the trainings in order to receive their Pcard.  A separate calendar invite will be sent for the training sessions. You can reach out to us at any time with questions at pcard@drake.edu.

— Erica McGowan, Finance and Administration