Security questions

What are these questions for?

Security questions and responses are an alternative way to "authenticate" yourself -- that is, to prove you are really you.  They can be used if you forget your password, if you mis-type your password repeatedly and cause a "lock out," or if you fail to change your password within the time period required by a security policy and it "expires." 

How will I use them?

When your password is forgotten, locked-out or expired, you are required to provide answers to three of the five security questions you previously selected.  As an additional protection you are asked to provide part of your social security number (SSN) and your full birth date. 

Once this is done, you are allowed to set a new password (if you forgot the old one or it expired), or unlock your account (if it was locked).

If you are unable to provide correct answers -- or you have failed to set security questions and answers in the first place -- you will be required to come to the Medical Information Technology offices with a picture ID to confirm your identity.

Why these questions?

Security questions are designed to use information that only you know, and that you also find easy to remember.  This is a more difficult task than you might imagine.  Most things that you know about yourself can be discovered by others.  Things about yourself that are obscure enough to be unknown to others may also be hard for you to remember.

You are given a range of choices for questions.  You can provide any answers you wish to the five questions you select -- as long as you can remember them.  Usually it's easier to remember truthful answers, but the truth is not required.  (When you answer the partial SSN and date of birth questions, truthful answers are required, as you do not get to set your own answers to these.)

How is this information protected?

All security question responses, partial SSNs and birth dates are stored in an encrypted data repository for maximum security.  These data are used solely for authentication purposes as described here, and are not disclosed to any third parties inside or outside the University.