University of California Human Resources and Benefits

Home < Frequently Asked Questions < Why am I required to answer six security questions?

Why am I required to answer six security questions?

Since May 18, 2007, as part of the At Your Service Online (AYSO) Sign In process, we have been requiring all users to set a Username and answer "challenge question" before they can proceed to the Main Menu. In the first month alone, more than 57,000 employees, retirees, and former employees answered these questions.

Answers to the Challenge Questions are being collected so we can expand our “Forgot Password” routine beyond emailing temporary passwords to individuals. Soon you will have the ability for immediate access to your AYSO account by correctly answering a rotating series of four of your six Challenge Questions. Those who cannot correctly answer the Challenge Questions will still be able to access their accounts by remembering their password, and if they forget the password, by having a temporary password emailed to them.

These security changes are being implemented as part of our continuing efforts to promote security and safeguard personal information on AYSO. To date, AYSO has never experienced a confirmed breach of security.

How did you come up with these Challenge Questions?

As we were formulating the challenge questions, we researched many sites to see the industry trend challenge questions (for example, it’s no longer common to see “What’s your mother’s maiden name?” as a challenge question), and we visited many financial sites to learn about their practices. Bank of America, Vanguard, and Cal State 9, to name only a few, use challenge questions.

None of our challenge questions are original, and most sites require users to answer a series of questions. We narrowed ours down to a choice of six from 12 set questions, based on the dozens we had seen used elsewhere.

We even considered allowing individuals to pose their own challenge questions, but we learned that this practice tends to make challenge questions less secure, as most people will pose overly simple questions such as: “What’s my spouse’s name?”

What if I can’t find six questions to answer?

There is no right or wrong answer for each question; the questions are posed to elicit responses that only the you will know. The answers do not even have to be truthful. For instance, for the question, “what is the name of your elementary school,” if you attended multiple schools or can’t recall the name, you can respond with the first school that comes to mind (e.g., a school you pass on the way to work, or the high school you attended). The answers should be something you can remember in the future, and, like the password, the answers should not be shared with anyone. The answers can always be modified later by signing in and going to the Security Preferences section.