Skip to content

Multi-Factor Authentication (MFA) & Enterprise SSO Provisioning

1. Executive Summary & Value Proposition

Security management platforms hold critical workforce vulnerability data, human risk scores, and campaign telemetry. Protecting administrator access against credential stuffing, password spraying, and session hijacking is paramount. SimuPhish provides enterprise-grade access governance through Multi-Factor Authentication (MFA) (Main Navigation > Settings > Personal Information > MFA) and Enterprise Single Sign-On (SSO) integration. By combining TOTP authenticator app support with enterprise SAML 2.0 / OpenID Connect federation, organizations ensure that only authenticated, authorized security personnel access platform command centers.

2. The Threat Landscape & The Real-World Problem Solved

  • Credential Compromise: Over 80% of data breaches involve compromised administrative credentials. A single cracked administrator password could expose organizational vulnerability heatmaps.
  • Password Fatigue: Administrators forced to manage distinct passwords across dozens of enterprise security tools frequently reuse passwords or resort to insecure notes.
  • Delayed Offboarding: When an IT or security team member leaves the company, relying on manual platform credential revoking creates a dangerous window of orphaned administrative access.

3. How It Works (The User Journey)

graph TD
    A[Administrator Login Workflow] --> B{Authentication Method}
    B -->|MFA Enabled| C[Enter Username/Password + 6-Digit TOTP Authenticator Code]
    B -->|Enterprise SSO| D[Redirect to Corporate IdP: Okta / Entra ID / Google Workspace]
    D --> E[IdP Verifies Biometrics, Corporate MFA & Conditional Access]
    E --> F[Instant Authenticated Session in SimuPhish]
    C --> F

The Administrator Experience

  1. Configuring Multi-Factor Authentication (Settings > Personal Information > MFA):
  2. Click Enable MFA in personal settings.
  3. SimuPhish displays a secure QR code alongside a manual setup key.
  4. Scan the QR code using any standard authenticator application: Google Authenticator, Microsoft Authenticator, 1Password, or Authy.
  5. Enter the current 6-digit code displayed on your mobile device and click Verify OTP.
  6. Multi-Factor Authentication is immediately activated for your administrator account.
  7. Enterprise Single Sign-On (SSO) Integration:
  8. Federate SimuPhish with your central enterprise identity provider using standard SAML 2.0 or OpenID Connect (OIDC):
  9. Microsoft Entra ID (Azure AD)
  10. Okta Enterprise SSO
  11. Google Workspace Identity
  12. Ping Identity / CyberArk
  13. Enforcing Centralized Conditional Access:
  14. Leverage corporate identity policies, including corporate device compliance, network IP whitelisting, and FIDO2/WebAuthn hardware keys.
  15. When an administrator leaves the organization, disabling their account in your corporate identity provider instantly revokes access to SimuPhish.

4. Key Business Benefits & Measurable ROI

  • Eliminate Administrative Account Takeover: Two-Factor Authentication neutralizes credential theft and brute-force attacks.
  • Frictionless Enterprise Logins: Single Sign-On eliminates password fatigue and accelerates daily workflows for security teams.
  • Instant Offboarding Compliance: Automatically terminate platform access the moment an employee is offboarded in your central identity provider.
  • Satisfy Stringent Compliance Audits: Comply with SOC 2 Type II, ISO 27001, and NIST CSF requirements mandating MFA across all administrative consoles.

5. Real-World Attack Scenario & Case Study

Scenario: The Leaked Admin Password

  • The Situation: A security analyst's personal laptop was infected with infostealer malware, leaking browser-saved passwords including their SimuPhish login.
  • Attack Attempt: The attacker attempted to log into the organization's SimuPhish portal using the stolen credentials from an unknown IP address.
  • SimuPhish Defense: Because the analyst had configured Multi-Factor Authentication, the platform immediately prompted for a 6-digit authenticator code. Unable to provide the physical device token, the attacker was blocked, and an automated alert notified the corporate SOC.
  • Outcome: Zero unauthorized access, zero data leakage, and the compromised credentials were reset immediately.