Authentication Security Testing: Passwords, MFA, SSO, and Session Management สำหรับองค์กรไทย

Authentication — verifying that users are who they claim to be — is the foundation of application security. Authentication security testing covers: password policy enforcement (complexity, length, breach-list checking), brute-force and credential-stuffing resilience (rate limiting, account lockout, CAPTCHA), multi-factor authentication implementation (can MFA be bypassed through fallback flows, session manipulation, or social engineering?), single sign-on (SSO) security (SAML, OAuth, OIDC implementation flaws), session management (token generation, session fixation, concurrent sessions, timeout, secure cookie attributes), and password reset flows (can the reset process be abused to take over accounts?). Each of these areas has well-known attack techniques that human testers probe systematically.