PeopleSoft MFA: The Need, Challenges, and Considerations

What Is PeopleSoft Multi-Factor Authentication (MFA)?

PeopleSoft is a workforce management suite for large and medium-sized organizations. The PeopleSoft software is part of Oracle’s product line. Initially intended for HR and finance teams, PeopleSoft has since grown to include several applications and tools for business operations tasks. Organizations use it to manage various aspects such as payrolls, materials, and communications.

Multi-factor authentication (MFA) provides an added layer of protection when users sign in to protected networks. It requires users to enter multiple identity proofs to access their work accounts or applications. For example, users might scan a fingerprint or enter a one-time password (OTP) sent to their phones, in addition to their username and password.

This is part of our series of articles about Oracle security.

The Importance of MFA and SSO for PeopleSoft

Standard security measures for sensitive applications include patching, safety configurations, strong backups, and access control. Organizations should use MFA to restrict administrative and other privileges and ensure that users are legitimate. Stronger authentication is especially important for privileged actions and sensitive data repositories.

An effective security strategy should implement a zero-trust security model that eliminates implicit trust from the network and assumes any user could be an imposter. Enterprise resource planning (ERP) solutions like PeopleSoft are popular among large organizations and government agencies. However, these applications can be attractive targets for hackers due to their access to sensitive information.

Legacy ERP systems are not well-suited to Internet exposure. Organizations often open them up to provide remote access and ensure business continuity at the risk of exposing sensitive data. However, with minor adjustments to a company’s user authentication mechanism, it is possible to strengthen the security of systems like PeopleSoft. Notable approaches include MFA and single sign-on (SSO).

SSO encourages users to maintain stronger passwords, as there is only one password to remember to access multiple (or all) systems. MFA helps reconfirm user identity, especially when access requests come from unknown locations or the target is a high-risk asset.

PeopleSoft applications require extensive customization and additional infrastructure to support such solutions. Few SAML-based identity providers work with PeopleSoft due to its lack of native support for SAML. Organizations can avoid the high cost and effort of customization by building native SAML support in PeopleSoft.

Some MFA solutions present a challenge for PeopleSoft applications because they require implementation at the login level. Users can get impatient when required to pass the MFA process every time they sign in. Another issue is when users have full access to information, which remains accessible if they forget to log out.

Conditional implementation of MFA is useful to balance ease of use with security. For example, organizations might limit MFA challenges to access requests from unusual locations or when users request access to sensitive fields.

Related content: Read our guide to PeopleSoft SSO

How Does MFA Work?

Multi-factor authentication is an access control mechanism that uses two or more forms of authentication to verify users’ identities before providing access to an application. This control measure can restrict access to specific actions, processes, or data in an application with granular MFA.

Robust MFA typically uses three authentication factors:

• The user’s knowledge—a secret, such as a username and a password.
• The user’s possession—something the user owns, such as a mobile device receiving an OTP.
• The user’s body—biometric data, such as fingerprints or retina scans.

MFA is the security standard for protecting sensitive applications and data. While traditional authentication relies on a username and password, it is increasingly easy for hackers to steal credentials, so an added layer of protection is often necessary.

Common MFA techniques include physical access tokens such as smart cards and key fobs, soft (device-based) tokens, biometrics scans, and mobile authentication via phone call or SMS verification. All these techniques share the principle of allowing access in response to successfully passing an MFA challenge. MFA providers can set configurations that determine the life of an access token, with tokens deactivated at a certain time or due to inactivity.

Considerations for Effective Multi-Factor Authentication for PeopleSoft

When implementing multi-factor authentication, it is important to consider the following measures that can help strengthen an organization’s security posture:

Implementing Zero Trust

The MFA strategy should incorporate the zero trust approach, ensuring that all access requires robust verification and eliminating default trust. Successful MFA requires deep integration with PeopleSoft to ensure the use of dynamic, context-based, and risk-aware rules. This approach enhances the MFA effectiveness and adapts to the risk of every access request according to factors such as time, location, and device.

Enabling Transaction-Level Step-Up Authentication

Few MFA solutions integrate with the underlying rulesets of PeopleSoft or support implementation at the transaction level. Most solutions don’t provide further access control capabilities after a user passes an MFA challenge at the login level. Additional re-authentication after the first login can help mitigate insider threats and imposters who’ve managed to steal MFA secrets.

Preventing MFA Fatigue

MFA fatigue is when users become frustrated with the repeated MFA challenges they must pass. Each additional authentication step can disrupt a user’s workflow, impacting productivity. Users also typically try to race through the process—in some cases, users won’t recognize a challenge they didn’t set up, responding instinctively instead.

Another risk of MFA fatigue is that it can tempt users to keep their sessions open when they leave the computer, presenting an opportunity for unauthorized access. Organizations should only apply tedious MFA challenges to sensitive applications, actions, and data.

Supporting Compliance

Data privacy and security regulations typically focus on preventative security approaches, such as designing systems to ensure restricted access. Personal and confidential data requires protection at the application (login) or transaction level. MFA effectively complies with regulatory requirements, especially when integrated at both the login and transaction levels.

PeopleSoft MFA with Pathlock

Fortunately, requiring dynamic MFA that is integrated inside ERP applications is one of the most common use cases our Pathlock Security Platform solves.

Pathlock enforces zero trust security policies that can dynamically secure data and regulate access based on contextual attributes (e.g., IP address, time of day, location, user security clearance, data classification, device used, max dollar amounts, etc.). Additionally, Pathlock can help bring your zero trust strategy to life with:

• Context-Aware Access Controls (with ABAC) – Fine-grained controls help you set dynamic access permissions for users down to the transaction and field level 
• Step-Up Authentication – Integrate enterprise MFA at the field level for re-authentication when a user requests access to sensitive data
• Transaction Monitoring & Control – Monitor high-risk transactions and automatically remove privileged access rights to stop potentially high-risk user activity
• Data Masking – Enforce full, partial, or click-to-view data masking to obscure sensitive data and protect against unnecessary data exposure
• Logging & Analytics – Capture detailed logs to get real-time visibility and insights into user access, IP address of frequent transactions, asset inventory, and other vital data.

Contact Us today for a demo to learn how we develop native integrations between Oracle and SAP ERP applications and some of the top MFA providers in the market.