Multi-Factor Authentication (MFA) has become essential for strengthening the security posture for PeopleSoft. However, integrating a 3rd party MFA can present challenges

1. DATA SHEET
Effective Multi-Factor Authentication for PeopleSoft:
4 KEY CONSIDERATIONS
1) An effective MFA Must Enable Zero Trust
Your MFA should follow the principle of zero trust, which dictates that no access is trusted by default. Without
deep integration with PeopleSoft, an MFA would use static rules that do not consider the context of access
(IP, time of day, location, device, etc.) or are risk aware. Adapting to the risk of each authentication attempt, despite
the privilege of the user, can substantially enhance an MFA's effectiveness.
2) An Effective MFA Should Enable Step-up Authentication at Transaction Level
Most MFA solutions do not integrate with PeopleSoft's underlying rulesets and can only be implemented at the
application (login) level. Once an MFA challenge is passed at login, there is no additional control over what users
can access. With phishing and insider threats being common, organizations must seek methods to re-authenticate
if a user is trying to access particularly sensitive information (after initial login.)
Multi-Factor Authentication (MFA) has become essential
for strengthening the security posture for PeopleSoft.
However, integrating a 3rd party MFA can present
challenges. As a work-around, many organizations scope
extensive customizations that delay project completion
and interfere with future PeopleSoft application updates.
Also, these custom projects force the implementation of
arbitrary rules that commonly lead to user friction due to
‘over-challenging’ during routine, low-risk transactions.
How do organizations ensure their MFA works effectively
with PeopleSoft without causing user friction?
Here are four key considerations:

2. DATA SHEET
8111 Lyndon B Johnson Fwy. Dallas, TX 75251 +1 (469) 906-2100
info@appsian.com
© Appsian 2020
3) An Effective MFA Does Not Cause ‘MFA Fatigue’
MFA adds an extra (authentication) step to a user’s workflow. This disruption is typically not welcomed. Recurring
challenges at login can lead to MFA fatigue, causing users to approve MFA challenges instinctually, without
considering if they initiated the challenge. MFA fatigue can impact user-productivity and can force security teams
to adopt risky practices like allowing users to stay logged in for an extended amount of time. Customers should
enable a balance between security and user-experience by limiting MFA challenges to only sensitive fields and
high-risk transactions.
4) An Effective MFA Enables GDPR, CCPA, etc. Compliance
Data privacy regulations require preventive data security strategies. It is stipulated that organizations must design
systems that protect and secure personal data - and whether its application or transaction level, an integrated MFA
does this effectively. It should be noted that only utilizing MFA at login still leaves you exposed to insider risks.
Enable the Native Integration of Enterprise MFA with PeopleSoft
The Appsian Security Platform (ASP) allows organizations to quickly and efficiently integrate enterprise MFA
solutions from Duo, Microsoft, SafeNet, and more, with PeopleSoft. With Appsian's adaptive MFA, companies can
enforce MFA at login and inside the application at the field, page, and component levels. Every authentication
request is analyzed for level of risk and MFA challenges are deployed accordingly.
Configurable Solution
Plugs directly into the PeopleSoft Web Server
without any additional infrastructure or customi-
zations and provides regular updates aligned to
PeopleSoft releases.
Fastest Path to MFA Integration
With a simple plug-in, Appsian enables
organizations to deeply integrate their MFA with
PeopleSoft in as little as 2 weeks. No added
customizations, hardware or complexity.
Context-Aware
Enforce challenges based on existing PeopleSoft
artifacts and/or contextual attributes like location,
device, time-of-day, # of access attempts, etc.
User Activity Logging
Implement ‘click-to-view’ or ‘MFA to view’
to create a logged record of access.