Is this a valid use case for email 2FA?

Question

We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their employees, and they must have a valid institutional email (not gmail.com, outlook.com, etc).

Recently we have discussed what to do if one of our client's employees quits or is fired, since our clients usually do not inform us if that happens. This means the account in our system could be compromised with the risk of having data leaks.

One of the solutions we have thought of is to do email 2FA. The reasons for this are:

• The passcode will always be sent to the institutional email. In theory, if one of our client's employees quits or is fired, the email would be disabled so they may no longer access our site.
• SMS or App 2FA requires a cell phone. However, we don't know whether our clients provide those to our users or they use their personal phones instead. If it is the latter, they will still have access after leaving.

On the other hand, we already know the issues about email 2FA like this or this.

Would it be acceptable for this use case? Am I missing something? Is there an alternative?

Answer 1

Often when considering if something is a good idea or not in information security, there is no clear "yes" or "no" answer. You have to consider what benefits and detriments a given solution presents.

In this case, your current state has a relatively large risk of compromise - Employees can be fired for malfeasance, then turn around and log into your tool and do "bad stuff".

While email 2FA is not a perfect solution, it does not present new risks compared to single-factor authentication.* You should think about things like "What if the employee has a legitimate login request, but can't access their email?" and other new edge cases this situation creates, but there is nothing inherently wrong with your proposal. You have to consider whether the loss of convenience, simplicity, and efficiency is worth the increased security, and no one online can do that calculus for you.

You should weigh the added complexity against the gain in security, as well as consider if things like simple policy controls will solve the problem. (Sometimes you just need to have a conversaion with your customers, and sometimes it's hopeless and it's easier to just do something like your proposed solution).

*: assuming you implement it properly, of course. Anything can be a horrible idea if done wrong.

Answer 2

The best way would be to implement SCIM but this probably won't be supported by your client.

The System for Cross-domain Identity Management (SCIM) specification is designed to make managing user identities in cloud-based applications and services easier. The specification suite seeks to build upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authentication, authorization, and privacy models. Its intent is to reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using standard protocols. In essence: make it fast, cheap, and easy to move users in to, out of, and around the cloud.