We just introduced multi-factor authentication (MFA) to access a remote business network. This has a re-authentication option: to prompt the user to re-enter the password and MFA code periodically. Like most topics in information security, the re-authentication interval has a tradeoff between security and convenience: a short amount (like 1 hour) has greater security but is inconvenient, while a longer amount (like 8 or 12 hours) is more convenient but has lower security.

Our workers need to access this network throughout the business day. What is a reasonable duration? 4, 6, 8, 12 hours? Something else? Thanks.

  • 1
    To me a long interval means the MFA is less likely to get ripped out by a pissed off powerful exec. I would much prefer 2fa with a long reauth interval than no 2fa at all...but the answer to what that number is depends on how sensitive the access and your company risk tolerance. – DarkMatter Jun 14 '19 at 14:49
  • 1
    What risk are you trying to address by forcing users to reauthenticate? Having to redo 2FA every hour is not better for security, it is just inconvenient. In fact it's probably going to reduce security, as people will have their token out all day long, in plain sight for everybody to peek, or they'll find a way to export their 2FA secret token to their desktop and use some sort of auto filler to automate the nag response. – Lie Ryan Jun 14 '19 at 19:32
  • 2
    Can people access the network from anywhere using any device? If access is only allowed from the local network, and only from authorised devices, then ensuring devices lockout after a minute of inactivity is probably more secure and convenient. – Ahmad Jun 15 '19 at 2:30
  • @Ahmad : It's a remote network where you connect via WAN, not LAN. I updated the question accordingly. – Greg Glockner Jun 15 '19 at 20:47

As best as I can tell, there is no standard or best practice for this. Based on the comments and a discussion with management, we set the re-authorization interval to 16 hours, meaning that it will prompt the users once per work day.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.