Deployed multi-factor authentication for non-conformance mod

QMS Sparta Systems TrackWise
, , , , , , , ,
1

We recently completed a comprehensive MFA deployment for our non-conformance module in Trackwise 10.0, driven by increasing regulatory scrutiny and several unauthorized quality record access attempts. Our implementation focused on TOTP-based authentication as the primary method with hardware security key fallback for high-severity cases. The challenge was balancing security with usability-quality engineers needed quick access during investigations while maintaining strict controls for critical non-conformances.

Our approach included risk-based conditional access policies that escalate authentication requirements based on non-conformance severity levels. For standard NCRs, users authenticate with TOTP via mobile apps. Critical NCRs (severity 1-2) trigger hardware security key requirements. We also implemented unauthorized access attempt detection that automatically escalates authentication requirements and notifies security teams when suspicious patterns emerge. The system now tracks failed authentication attempts and temporarily locks accounts after three failures within a 15-minute window, with automatic escalation to management for quality-critical records.

2

We tuned the detection algorithms to distinguish between authentication failures and suspicious access patterns. Simple password failures trigger standard account lockout after three attempts. Unauthorized access detection specifically monitors for: attempting to access NCRs outside assigned areas, accessing records after hours without prior approval, rapid sequential access to multiple critical NCRs, and geographic anomalies. We integrated with our SIEM system to correlate these patterns. False positives dropped significantly once we added a learning period-the system establishes baseline behavior for each user over 30 days before enforcing strict detection. Users can also submit access justifications through a self-service portal when working on cross-functional investigations.

3

This is exactly what we’ve been exploring for our FDA-regulated environment. How did you handle the hardware security key provisioning logistics? We have quality engineers across multiple sites, and I’m concerned about the overhead of distributing and managing physical keys for critical NCR access.

4

Let me provide a comprehensive overview of our implementation approach and lessons learned:

TOTP Multi-Factor Authentication Configuration: We deployed Microsoft Authenticator and Google Authenticator as approved TOTP providers, with QR code enrollment integrated directly into Trackwise user profiles. Configuration included 30-second time windows with one-step tolerance to handle clock drift. Users complete initial enrollment during their first login after the policy activation, with IT support available for troubleshooting.

Hardware Security Key Integration: YubiKey 5 NFC devices were selected for their FIDO2 support and NFC capability for mobile access. We registered keys in Trackwise’s authentication service with user-specific binding. Critical NCR access triggers a challenge-response flow where users must physically tap their security key. Backup keys are stored in secure IT facilities for emergency access scenarios.

Risk-Based Conditional Access Policies: Our policy engine evaluates multiple factors: NCR severity (1-5 scale), user role, access location, time of day, and historical access patterns. Severity 1-2 NCRs always require hardware keys. Severity 3 requires TOTP with manager notification. Severity 4-5 uses standard TOTP. Off-hours access to any critical NCR triggers additional email verification. Geographic access outside normal work locations requires pre-approval workflows.

Non-Conformance Severity-Based Authentication Escalation: When users access increasingly severe NCRs within a session, the system automatically escalates authentication requirements. Moving from severity 4 to severity 2 prompts immediate hardware key authentication, even within an active session. We implemented graceful escalation with 60-second warnings, allowing users to complete current actions before re-authentication. This prevents data loss while maintaining security boundaries.

Unauthorized Access Attempt Detection and Escalation: Our detection system monitors audit logs in real-time, flagging: 5+ failed authentication attempts from a single IP, access attempts to NCRs outside user’s assigned quality areas, bulk NCR queries (10+ records in 5 minutes), and access pattern anomalies based on ML models trained on 90 days of historical data. Detected incidents trigger automated workflows: immediate session termination, temporary account suspension, email notifications to user’s manager and security team, and creation of security incident tickets with full audit trail. For repeated violations, accounts are locked pending security review.

Key Metrics Post-Implementation: Unauthorized access attempts dropped 87% in first quarter. Average authentication time: 8 seconds for TOTP, 12 seconds for hardware keys. User satisfaction remained at 4.2/5 after initial adjustment period. Zero security breaches related to NCR access since deployment. Audit preparation time reduced 40% due to comprehensive authentication logs.

Lessons Learned:

  1. Phased rollout by department reduced support burden significantly
  2. Executive sponsorship was critical for user adoption
  3. Hardware key backup procedures are essential-we had three emergency access situations in first month
  4. Mobile access required additional UX consideration for NFC key tapping
  5. Integration with HR systems for automatic role-based policy assignment saved significant administrative overhead

The investment in this layered MFA approach has dramatically improved our security posture while maintaining operational efficiency for quality investigations. Happy to share our policy templates and configuration details if helpful for your implementations.

5

What about the user experience during investigations? I worry that multiple authentication prompts could slow down root cause analysis when we’re already under time pressure to close critical non-conformances.

6

Great question. We implemented session persistence with risk-aware timeout policies. For standard NCRs, TOTP authentication provides a 4-hour session. For critical NCRs requiring hardware keys, sessions last 2 hours with activity monitoring. Users aren’t re-prompted unless they’re idle for 30 minutes or access a different severity-level NCR. We also added contextual authentication-if a user is already working on a critical NCR and accesses related documents or CAPAs, the existing authentication context carries over. This reduced authentication prompts by 60% during typical investigation workflows while maintaining security boundaries between different risk levels.