Security Guide
Security best practices for configuring Autional in production environments.
MFA Configuration
Autional supports 5 MFA methods, configurable per tenant:
| Method | Phishing Resistance | Setup |
|---|---|---|
| TOTP (Authenticator App) | Medium | 1 min |
| WebAuthn / Passkey / FIDO2 | ✅ High | 1 min |
| SMS OTP | Low (SIM swap risk) | Instant |
| Email OTP | Medium | Instant |
| Push Notification | Medium | 1 min |
Adaptive MFA (Risk Engine)
The adaptive MFA engine evaluates 7 signals to determine authentication risk:
- Device — trusted device, new device, known fingerprint
- IP — known location, geo-velocity anomalies
- Behavior — time of day, login frequency, action sensitivity
- Velocity — rapid successive attempts, brute force detection
- Credential leak — breached password check (HIBP)
Password Policy
Per-tenant configurable password policies:
- Minimum/maximum length, complexity rules (upper, lower, digit, special)
- Password history (N previous passwords prevented)
- Expiry (configurable days, forced reset)
- Breach detection (HIBP database check)
- Account lockout (threshold + duration)
Encryption at Rest
Field-level AES-256-GCM encryption with key rotation. SM4-GCM for national cryptography compliance. 14 encryption points across the system.
Audit Trail
All authentication events are recorded in an immutable Merkle hash chain audit log. Cryptographic verification ensures tamper-proof integrity.