For customers not using SSO, does your application and/or user frontend/portal support multifactor authentication (e.g., Duo, Google Authenticator, OTP, etc.)?
Explanation
For users who aren't authenticating through SSO, reviewers want confirmation that your application or portal still supports multi-factor authentication such as Duo, Google Authenticator, or OTP.
Multi-factor authentication is a security mechanism that requires users to provide two or more verification factors to gain access to a system. These factors typically include:
- Something you know (password)
- Something you have (mobile device, hardware token)
- Something you are (biometrics like fingerprints)
The question specifically mentions examples like Duo (a popular MFA service), Google Authenticator (an app that generates time-based one-time passwords), and OTP (One-Time Passwords).
Why this is asked in security assessments:
- Passwords alone are vulnerable to various attacks (phishing, credential stuffing, brute force)
- MFA significantly reduces the risk of unauthorized access even if passwords are compromised
- Many compliance frameworks and security standards require or recommend MFA
- It demonstrates your commitment to protecting user accounts and data
How to best answer:
- Be specific about what MFA methods your application supports
- Mention if MFA is required or optional for users
- Describe any implementation details that show the robustness of your MFA solution
- If you don't support MFA for non-SSO users, explain any compensating controls or future plans
Example Responses
Example Response 1
Yes, our application supports multiple forms of multi-factor authentication for users not using SSO We currently support time-based one-time passwords (TOTP) via Google Authenticator, Authy, and other compatible authenticator apps We also support SMS-based verification codes and push notifications through Duo Security MFA is enforced for all administrative accounts and is available as an option for standard user accounts Our implementation follows NIST guidelines for MFA, including proper session management and secure storage of MFA verification data.
Example Response 2
Yes, our application supports multi-factor authentication for non-SSO users through several methods We have integrated with Okta Verify for push notifications and TOTP, YubiKey for hardware token authentication, and Microsoft Authenticator MFA is optional for standard users but can be made mandatory through administrative policy settings We also provide a recovery process that requires verification through multiple channels if a user loses access to their MFA device All MFA implementations are tested regularly as part of our security assessment program.
Example Response 3
No, our application currently does not support multi-factor authentication for users not utilizing SSO We recognize this as a security gap and have included MFA implementation in our product roadmap for Q3 of this year In the interim, we have implemented compensating controls including IP-based access restrictions, anomalous login detection, and strict password complexity requirements We also enforce session timeouts after 15 minutes of inactivity and maintain comprehensive login audit logs We recommend that customers who require MFA use our SSO integration capabilities, which do support passing through MFA verification from identity providers.
Context
- Tab
- Product
- Category
- Authentication, Authorization, and Account Management
Related questions
- Does your solution support single sign-on (SSO) protocols for user and administrator authentication?
- For customers not using SSO, does your solution support local authentication protocols for user and administrator authentication?
- For customers not using SSO, can you enforce password/passphrase complexity requirements (provided by the institution)?
- For customers not using SSO, does the system have password complexity or length limitations and/or restrictions?
- For customers not using SSO, do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support?
- Does your organization participate in InCommon or another eduGAIN-affiliated trust federation?
