ComplianceAuthenticationAuthentication for staff

Authentication for staff

Last updated: Nov 3, 2026

Centralized authentication

Fluid Attacks uses a centralized authentication platform (IAM) to manage all its internal applications. The staff of Fluid Attacks does not know the passwords of the managed applications. Each person only knows their own IAM passphrase. After they log in to IAM, they can get access to the applications assigned to them.

These are some of the IAM specifications and requirements of Fluid Attacks:

  • Fluid Attacks uses passphrases instead of passwords. For more information, read the blog post.
  • Passphrases expire every 6 months.
  • The staff can use a previous passphrase again only after a 24 reset cycle.
  • The staff must configure multi-factor authentication (MFA) on mobile devices.
  • The MFA of Fluid Attacks uses OOB. This mechanism sends all the MFA data through a channel that is different from the channel of the application. Text messages and emails are examples of OOB. It decreases the risk if a communication channel becomes compromised.
  • Fluid Attacks uses SAML and OAuth 2.0 for authentication. With these two protocols, the staff can log in to external applications with only their active IAM account. They do not need passwords or users.
  • If a mobile phone supports biometric authentication, the IAM makes its use mandatory.
  • All successful sessions continue for 9 hours.

Access checks

Fluid Attacks checks the access rights of internal users each month, in accordance with these rules:

  • Fluid Attacks reviews user access rights at regular intervals and after each change, promotion, or termination of employment.
  • Fluid Attacks reviews the authorizations for privileged access rights at frequent intervals.

SSH signature for repository commits

To prevent identity hijacking, all the source code repositories of Fluid Attacks require developers to use an SSH digital signature. This signature verifies the identity of the developer on the Internet. The signatures are in the repository commit history.

Requirements

These Fluid Attacks requirements apply to the controls on this page:

Other secure authentication measures

Password policy

Fluid Attacks follows a password policy covering minimum length, complexity requirements, expiration, account lockout, history, and generated password rules.

Authorization

Next Page

On this page

Centralized authenticationAccess checksSSH signature for repository commitsRequirementsOther secure authentication measures