CLNG AuthN Security Measures

Authentication & Authorization Security

Our platform uses Auth0, a leading identity platform, for all authentication (AuthN) and authorization (AuthZ) needs. Auth0 offers enterprise-grade security controls, including:

Attack Protection

Auth0 includes built-in features to defend against automated and malicious login attempts:

1. Suspicious IP Throttling: Protects your accounts against high-velocity attacks that target multiple user accounts from a single IP address.
2. Brute-force Protection: Safeguard against brute-force attacks that target a single user account.

Phishing Protection

1. Universal Login with Custom Domains:
   • We utilize Auth0's hosted Universal Login pages, which reduce exposure to phishing by centralizing authentication. We also configure custom domains to align with your organization's branding, helping users more easily identify legitimate login screens.
2. Multi-Factor Authentication (MFA):
   • M⁠FA works by requiring additional factors during the login process to prevent unauthorized access. NG uses a One-Time Password (OTP) factor using Microsoft Authenticator or similar.

Other Protections & Best Practices

1. TLS Encryption: All sign-in traffic is encrypted via TLS end-to-end.
2. OAuth 2.0 / OpenID Connect: Auth0 uses secure, industry-standard protocols to handle sessions and tokens.
3. Session Management: We enforce short-lived access tokens and refresh tokens, with mechanisms in place for revocation and session expiration.