Step-Up Authentication vs 2FA: Implementing Additional Verification for Sensitive Operations in Corporate Systems
Two-factor authentication (2FA) has become a standard for protecting corporate systems, yet it often proves insufficient for handling personal data or other high-risk operations. While 2FA verifies identity only at login and then grants access for the duration of the trusted session, modern attacks increasingly target already-active sessions. This limitation prompted the adoption of Step-Up Authentication, which requests additional confirmation precisely when a user attempts a sensitive action.
Why Standard 2FA Falls Short
Common second factors include SMS or Email OTP, TOTP from authenticator apps such as Yandex Key, Google Authenticator, Microsoft Authenticator, or Authy, and other one-time codes. These methods protect the login process effectively but do not re-verify identity during an ongoing session. As a result, prolonged sessions or shared devices can expose critical resources without further checks.
What Step-Up Authentication Provides
Step-Up Authentication differs by triggering extra verification only at the point of elevated-risk operations. Typical scenarios include work on shared devices, long-lived sessions, or access requests that demand a higher trust level than the initial login provided. In the described project, this mechanism was applied specifically when users attempted to retrieve salary information, requiring re-authentication only for selected APIs.
The technical foundation relies on ACR (Authentication Context Class Reference) values embedded in tokens. These values indicate whether login occurred with password alone or with an additional OTP. Applications inspect the ACR claim and either grant access or redirect the user for further authentication.
Project Implementation Challenges and Solution
Although Keycloak and WSO2 both support Step-Up Authentication out of the box, the project’s business requirements exceeded standard capabilities. The PIN code had to remain valid for six months, external systems needed to treat it as a user password, and verification had to occur at a separate gateway layer independent of the Identity Provider. These constraints made heavy customization of WSO2 impractical.
The team therefore created an independent PIN-code service and a dedicated gateway-2fa microservice. Only requests to protected APIs pass through this gateway; all other traffic follows the normal route. The flow works as follows:
- The web application directs the user to the PIN service to generate a code.
- The service creates an encrypted PIN, stores it, and delivers it via email and SMS.
- After successful entry, the service issues a signed cookie with a defined TTL confirming Step-Up completion.
- On subsequent protected calls, gateway-2fa validates the cookie and cross-checks key JWT fields; mismatches result in denial of access.
User Experience and Monitoring
From the user’s perspective, the additional step appears only when accessing protected data. A 401 response prompts PIN entry; successful validation sets the cookie, after which the user can work with sensitive resources until the TTL expires (set to 20 minutes in this implementation). Incorrect PIN attempts simply keep the resource inaccessible.
Usage statistics are collected in Matomo and technical metrics in ELK, enabling early detection of performance issues or unusual patterns.
Key Considerations for Deployment
Successful rollout requires careful definition of TTL duration, strong encryption for stored PINs, load testing of the additional service, and logging that supports incident investigation without exposing sensitive user data. The resulting architecture strengthens protection for critical operations while preserving a seamless login experience and supporting Zero Trust principles.
Related articles
Why Russian Educators Prepare Sixth Graders for Ninth-Grade All-Russian Olympiads in Robotics and Information Security
Maxim Ivankov, who has run robotics and programming schools for children for nine years in a small Russian town, explains the decision to train students starting from fifth grade for the All-Russian Olympiad for Schoolchildren in the ninth-grade category. The strategy addresses the fact that regional and final stages begin only at ninth grade, while earlier participation yields only certificates with no benefits such as BVI university admission or regional prizes. The approach gives students up to five attempts instead of one, allowing systematic skill building similar to consistent athletic training. Challenges include extremely low enrollment despite free classes and widespread use of neural networks to solve school-stage tasks remotely, which distorts results and lacks regulatory prohibitions. The 2025/26 season introduced four separate profiles under informatics, including information security and robotics, both of which grant the same BVI privileges as mathematics or physics. Detailed analysis of past tasks shows a steep difficulty jump from municipal to regional stages, with topics such as the RANSAC algorithm and ten-dimensional hypercube traversal appearing only at the final level.
Corporate Boomerang: WordPress Founder Matt Mullenweg Survives Board Coup at Automattic
Automattic experienced a rapid corporate power struggle when its board placed founder and CEO Matt Mullenweg on forced paid leave. Within two days Mullenweg regained control by leveraging his shareholder voting rights and removed opposing administrators from the company Slack. The original board members who supported his ouster are now departing the company. The brief conflict highlighted how corporate governance rules allowed shareholders to ultimately determine board composition. Mullenweg described his restored position as that of a pirate before announcing renewed alignment with the board. Public support from WordPress leadership helped solidify his return to leadership.
Russian Transport Ministry Ready to Provide Regulatory Framework for Poplar Fluff Vacuum Robots
The Russian Ministry of Transport has signaled readiness to develop necessary regulations if municipal services express interest in specialized robots designed to collect poplar fluff from city streets. The statement from Minister Andrey Nikitin follows a viral meme that originated from a two-year-old video created by the agency Out Digital. Although no real machines called пухосос exist and no serial production has been launched, the fictional concept gained widespread attention after being presented as an actual Moscow development. The Department of Housing and Utilities in Moscow playfully expanded the joke by introducing additional fictional devices named Zasosyor, Musorozhor, and Gazonyukh. Linguistic experts at Gramota.ru later analyzed the newly coined term, further amplifying the meme's reach across Russian media and social networks. The minister emphasized that any future regulatory support would depend entirely on demand from communal services rather than proactive development by the ministry itself.
Context is Everything: How to Avoid Drowning in Security Incidents and Distinguish Employees from Attackers
The article explains that false positives in security systems often stem from missing business context rather than technical flaws. It outlines three levels of filtering that combine process rules, access logs, and job-specific behavior to rank risk accurately. Behavioral analysis tools like UEBA can help but require proper training and human oversight to avoid generating more noise. Key metrics focus on reducing false alerts, improving MTTD and MTTR, and minimizing daily administration time. For smaller companies without dedicated SOC teams, the guidance emphasizes starting with log collection, identifying existential risks, and aligning policies with real business processes. The piece stresses that technology alone cannot replace analysts who deeply understand company operations.