Multi-factor login authentication as a security option
It would be nice to be able to have a multi-factor login authentication as a security option. We have users who work in DocuWare while they are on the road and it would be nice to toggle this feature on/off per user as an extra layer of security.
Anonymous
shared this idea
Of course the security of our users is important to us.
As you have noticed, this idea still has the same status, but was not declined. That means we evaluate it regularly.
One reason why we have decided not to add this security feature yet is that we will first change the authentication flow.
As a first step, we introduced the Identity Service in the DocuWare Cloud with Version 7.3, which allows integration with Azure AD and the use of MFA there.
The next step is to force users to use SSO only. However, to ensure this, we still need to make some changes in our authentication flow.
We are also planning to bring these functions to DocuWare On-Premises.
Afterwards we will evaluate extending the login with DocuWare credentials with MFA/2FA.
We are constantly striving to improve our products and appreciate your feedback and contribution.
-
Louis Marascio
commented
This is a big gap in functionality in today's security environment. 2FA is a must have for any system that holds sensitive information.
-
Hal Hamilton
commented
We have several clients that are already using two factor authentication and are wanting that ability with DocuWare on-premise and cloud. We are also hearing from other clients that they too need to adapt to two factor authentication due to the material and information that their Fortis/DocuWare systems are handling such as SS#, HIPAA information, FERPA, etc. This needs to be added to the road map as soon as possible.
-
DELFORGE Clément
commented
needed onPremise too.
-
Cory Van Dyke
commented
Organizations that store SSN/credit card info must adhere to PCI standards/compliance. Taken from PCI security document "Implement two-factor authentication for all remote network access that originates from outside the network, by employees, administrators, and third parties including vendor access for support or maintenance. Examples of two-factor technologies include remote authentication and dial-in service (RADIUS) with tokens; terminal access controller access control system (TACACS) with tokens; or other technologies that facilitate two-factor authentication. Using one factor twice (e.g. using two separate passwords) is not considered two-factor authentication."