Authentication for Fluid Attacks staff

Last updated: Mar 5, 2026

Centralized authentication

We use a centralized authentication platform (IAM) to manage all our internal applications. Our talent does not know any of the passwords of the managed applications; they only know their own IAM passphrases. Once they log in to IAM, they can access the applications assigned to them .

Some of our IAM specifications and requirements are listed below:

• We use passphrases instead of passwords  (more information in our blog ).
• Passphrases expire every 30 days .
• We can only reuse previous passphrases after a 24 reset cycle .
• We must set up multi-factor authentication  (MFA) on mobile devices.
• Our MFA uses OOB , a mechanism that transports all the MFA data through a different channel than the application’s channel itself. Text messages and emails are examples of OOB. It reduces the risk in case a communication channel becomes compromised.
• We use both SAML  and OAuth 2.0  for authentication. These two protocols allow us to log in to external applications with only our IAM active account. No passwords or users are needed.
• In case a mobile phone supports biometric authentication , our IAM enforces its usage.
• All successful sessions have a duration of 9 hours.

Authentication criteria

At Fluid Attacks, we check the internal rights for internal users on a monthly basis, complying with the following:

• User rights are reviewed at regular intervals and after any change, promotion or termination of employment.
• Authorizations for privileged access rights are reviewed at frequent intervals.

SSH signature for repository commits

In order to prevent identity hijacking, all our source code repositories require developers to use a SSH digital signature  that verifies the developer’s identity on the Internet. The signatures can be found in the repository commit histories linked in the Open source section.

Requirements

• 096. Set user’s required privileges 
• 129. Validate previous passwords 
• 130. Limit password lifespan 
• 132. Passphrases with at least 4 words 
• 153. Out of band transactions 
• 231. Implement a biometric verification component 
• 328. Request MFA for critical systems 

Other secure authentication measures

• Authentication for clients 
• Password policies