ISO 27001 A.8.5: Secure authentication

Match authentication strength to risk level. Standard access might use strong passwords with SSO. Access to sensitive data should require MFA. Privileged access needs enhanced MFA with phishing-resistant methods. External-facing systems should always require MFA, no exceptions. Roll out MFA across the organisation. Use authenticator apps (TOTP), push notifications, or FIDO2 hardware security keys as second factors. Avoid SMS-based MFA where possible because of SIM-swapping risks. Deploy MFA at the identity provider level so it covers all integrated applications automatically. Use modern authentication protocols. Implement OAuth 2.0, OpenID Connect, or SAML 2.0 for federated authentication. Set up SSO to reduce password fatigue and centralise security. Make sure all authentication traffic runs over TLS 1.2 or later. Configure sensible security controls around authentication. Lock accounts after 5-10 failed attempts with progressive delays. Use generic error messages that do not reveal whether the username or password was wrong. Add CAPTCHA or rate limiting to block automated attacks. Log every authentication event - successful and failed - with enough detail to investigate incidents. Get credential storage right. Hash passwords with bcrypt, scrypt, or Argon2 using unique salts. Never store passwords in plain text or reversible encryption. Only transmit credentials over encrypted channels. Check passwords against known breach databases to catch compromised credentials before attackers do. Start planning for passwordless authentication. FIDO2/WebAuthn, certificate-based auth, and passkeys are phishing-resistant by design and improve the user experience. Deploy these for high-security access now and consider broader rollout as adoption matures.