So recently my work, a mid sized engineering firm, decided to start upgrading their IT security. The rumor is that we have potential DOD work coming our way. Over the past few months there has been multiple company decided changes to our 2 factor authentication mobile app. I willingly installed the app on my phone over a year ago because without it I could no longer use my laptop out of office and couldn’t use Microsoft teams or outlook on my phone.
So about 2 months ago my company updated the 2FA policy and because of that, my phone is no longer compliant on the basis of it being to old. The initial consequences were that I lost access to email and teams on my phone, not a big deal because I prefer not to think about work on my off hours. Fortunately, I could still use a txt message to 2FA into my laptop incase I did need to work from home.
Fast forward to last Friday, our IT director sent out an email saying they were again making changes to the 2FA policy over the weekend. Among other things, the changes included removing the txt 2FA option, meaning I could no longer access anything work related as soon as I step out of my office building. Sounds like a dream right, and a good excuse to fall back on.
Come Monday, I find out that I need to use the 2FA app to access our payroll software to fill out my timesheet, even when I am inside the office sitting at my desk. Luckily, I filled out my previous weeks timesheet on Friday. So next Monday, as far as I’m aware, I will not be able to fill out my timesheet to get paid.
My situation: I will admit I am stubborn about buying new electronics, my phone is a Samsung S8 that I bought in 2017 when it was brand new. I currently see no benefits of anything the new phones have to offer but the day my phone decides to die, I will gladly walk into a store and buy a brand new android phone. My work does not provide cell phones and has refused my request to compensate me for my work related phone usage. I have been very vocal to my manager and bosses that they cannot force me to buy a new phone just to continue doing my job efficiently, and now it seems doing my job at all. The responses I have recieved were very indirect and not at all helpful to my situation. Really, I just want them to give me an ultimatum or some other option. I am not willing to lose my job over this but I dont want to give in and buy a new phone just so I can click OK on an 2FA app.
So Lemmy, how should I approach this ticking time bomb?
Any company taking 2FA seriously will either compensate you for the requirements to fulfill that security, or provide you with the devices necessary. I used to work at Duo. I currently work for another company that does more or less the same thing. Your company’s security team will do whatever it takes to get you compliant because not doing that is on them and not you.
It’s honestly wild for a company to allow an employee to be on the verge of locked out of critical services and not be resolving that on their own. They have the metrics in duo to be able to see that you have no viable device to 2FA with.
Oh they knew my phone was outdated, and so did I based on a direct email to me but I was not made aware of the consequences for non compliance and therefore could not react accordingly. That’s why I am in the spot I’m at, willing to fold but still looking for alternate routes.
Yep!
If they fail to get even 1 employee on 2fa, their insurance against a cyber threat could ultimately deny their claim. Starting to happen a lot.
Ask them to reimburse you the cost of a new phone.
Ask them to give you a yubikey or some other OTP token device.
My dad had this same issue. He spoke to IT, and they sent him a security key he could use instead. Ended up needing a new phone a few months later anyway though…
From the tech point you can always install lineage and your phone will be “new” in the eyes of the app and company. Or request a yubikey or a similar, that’s what my company uses. Security wise company stuff should be done on company hardware. And obviously they should pay for stuff needed to do your job.
If you update your phone it will at least be more secure than an outdated 2020 phone. So that’s what I would do if I did not want to change phone and did not care about hardware security.
https://www.xda-developers.com/unofficial-lineageos-17-1-android-10-samsung-galaxy-s8-plus-note-8/ maybe something newer out there on xda forum
There are two different, and only slightly related, things here:
- Access to company data through your phone (via Teams, Outlook, etc)
- Using your phone as an MFA device to access company data, even on your work-issue laptop and to access browser-based SaaS apps like your payroll system.
The first absolutely can and should depend on the age of your device. MAM or MDM policies combined with Conditional Access should block older devices not receiving security updates from accessing and storing company data.
The second, assuming they are now requiring phishing-resistant MFA, only requires that you have the Microsoft Authenticator app installed (FIDO2 and CBA are alternate PRMFA methods, but more complicated to implement). The MS Authenticator is supported on Android 8.0 and above and your S8 supports Android 9.0.
So unless there is a job requirement to use your phone for email and Teams – in which case they should definitely offer a stipend or CYOD phone – you should be fine just installing the MS Authenticator app on your phone and using your work-issue laptop for email and Teams.
Edit: I just saw your other comment that they use Duo. In that case you might be hosed since it requires Android 11.0. I’d at least start by opening a ticket with the help desk and keep an email trail with your manager of what part of your job you can’t do. But they should be able to provide a method of authentication that complies with their policies.
Update 1.
Talked to my boss and he said dont worry about my upcoming timesheet because he can fill it out for me but he will not do that indefinitely so a new phone is required. He also told me that I can start using the phone bill stipend, which is 40 bucks a month so that almost covers my bill plus a phone payment plan.
I asked about the Yubikey and he told me that in the next policy change we are going to remove usb access on all of our machines to further comply with security demands, so that would defeat the purpose of the 2FA dongle.
Guess I’m getting a new phone. I looked into the lineageOS route and it seems I would have to factory reset my phone anyway and that is probably my biggest problem with getting a new phone anyway so I won’t be attempting that.
Thanks for the advice,
My takeaway is that I should look into a 2FA dongle and offer it up as an alternative. I mentioned in my post that the main IT guy looked into that and said it would not work on most machines, not sure if someone has any insight on that. My company started building custom machines a few years back for the CAD users and everyone ended up getting one eventually. My PC runs windows 11 and is pretty much a gaming computer from 2020, I9 processor, a 2080 super, and some random motherboard. What reason could there be that my computer would not accept one of these dongles?
AFAIK there is zero reason, any standard U2F hardware key like a YubiKey should work.
