We use a centralized authentication platform (IAM) to manage all our internal applications. Our talent do not know any of the passwords of the managed applications; they only know their own IAM passphrases. Once they log in to IAM, they can access the applications assigned to them.

Some of our IAM specifications and requirements are listed below:

1. We use passphrases instead of passwords (more information here).

2. Passphrases expire every 30 days.

3. We can only reuse previous passphrases after a 24 reset cycle.

4. We must set up multi-factor authentication (MFA) from mobile devices.

5. Our MFA uses OOB, a mechanism that transports all the MFA data through a different channel than the application's channel itself. Text messages and emails are examples of OOB. It reduces the risk in case a communication channel becomes compromised.

6. We use both SAML and Oauth2 for authentication. These two protocols allow us to log in to external applications with only our IAM active account. No passwords or users are needed.

7. In case a mobile phone supports biometric authentication, our IAM enforces its usage.

8. All successful sessions have a duration of 9 hours.

At Fluid Attacks, we check the internal rights for internal users on a monthly basis, complying with the following:

1. User rights are reviewed at regular intervals and after any change, promotion or termination of employment.

2. Authorizations for privileged access rights are reviewed at frequent intervals.