Two-factor authentication

I am assuming after the data breach this will become a priority:

2FA is not currently on the product roadmap. The majority of our customers use a SSO provider to log in to Sisense, and currently our resources are focused on other projects that will impact greater portions of our users.

Not sure saying most of your customers use SSO is good enough. Surprised its not already available .

Hi YuliyaMotiyets, following your comment here would be my ideal use case:

At our business, we have 1000s of customer accounts using the Sisense platform. For the majority of these, we want users to have quick and easy access to Sisense. It's important for us to make viewing their data as simple as possible. Therefore, mandatory 2FA would actually be negative to our use case.

In our business, we would look for a solution that:

1. Didn't force 2FA on new accounts.
2. Would give the option to enable 2FA on specific accounts (perhaps via the Admin UI, or in bulk via REST API).
3. Would likely use SMS rather than an Authenticator App (appreciate this is less secure, again, this is easier for users to set up - ideally the option for either would be great).
4. Was independent of SSO - we don't use this.

In short, it makes the 2FA:

• Optional for accounts that don't need it.
• When it is needed, it would be easy for Sisense Admins to bulk enable / disable 2FA on individual accounts.
• As simple as possible for our customers to use - no need to download a separate authenticator App.

I appreciate our use-case might be a little different to others, so I think a flexible amount of security is potentially what's key for Sisense customers as a whole here.

Hi Team,

We would like to have MFA (Multi-Factor Authentication) feature to be brought into Sisense On-premise version as soon as possible.

Background:

• With current data breach happened at Sisense, it's high time that Sisense should think of Customer's data security in every aspect
• We understand with SSO security layer is present but not all customers will use SSO for every scenario.
  • Still there will be situations where credential based access will be used by some customers
  • For such situation Multi-factor authentication is really important

Use Case:

• In our case we will use combination of SSO and Credential based access. i.e Few customers will use SSO and few customers who don't have SSO will use credential based access but will have MFA.
• If for any user we are selecting password based access, then there should be one flag to enable MFA for that user (via SMS or via any authenticator application)
  • Sample thought:

Waiting to hear from Sisense to see this feature in their next release.

Hi Andrew,

Many customers has no SSO, and I think that just SSO does not fit the two-factor authentication thing. The definitition of two-factor authentication: 

"2FA is an extra layer of security used to make sure that people trying to gain access to an online account are who they say they are. First, a user will enter their username and a password. Then, instead of immediately gaining access, they will be required to provide another piece of information."

I agree with the earlier post. The current security incident should highlight the need for Sisense to implement MFA.

This is a security issue and has to be a high priority. Environments can be complex and SSO isn't always easy to set up for all users for a variety of reasons. Similar to others here, we have different groups of users that we need to tie into the system, which makes moving to SSO more challenging.

MFA is standard now for good reason. I'd support the approach above of flexibility (authenticator/SMS/none) on a per user basis.

We've worked with a few customers that don't use SSO but need MFA, or customers that use SSO for embedding but would like MFA on the direct login for security compliance reasons.

Hello jirazazabal - can you elaborate on the need?  Most Sisense customers integrate their SSO-provider to accomplish what you are asking for.  Is there a reason you don't want to use SSO?

+1 to this from me. We provide data to our customers via Sisense and have had some asking recently whether we can use 2FA to increase security.

I wouldn't want it as a blanket on/off requirement for all users (in general, I want customers to be able to log in to see their dashboards as easily as possible) but having the option to toggle it for specific users would be perfect.

Thank you for your feedback and continued partnership! We understand the importance of implementing Multi-Factor Authentication (MFA), particularly for those of our clients not utilizing Single Sign-On (SSO) capabilities.

At Sisense, we are committed to continuously improving the security and integrity of our products. We are currently in the exploratory stage of assessing the feasibility and the best possible methods for integrating MFA into our platform. This effort is a high priority for us, aligning with our broader strategy of reinforcing our security measures to better protect all our users.

While we are dedicated to advancing this enhancement, we are not yet in a position to commit to a specific timeline. As we navigate through this exploratory phase, understanding your specific use cases and requirements would greatly assist us. We encourage you to share detailed scenarios where you envision MFA providing the most impact.

We appreciate your patience and support as we work towards this upgrade, and will keep you informed with any updates. We welcome your ongoing feedback and look forward to receiving more information from you regarding your security requirements.