FORTIFYING ORACLE APEX APPLICATIONS: A COMPREHENSIVE FRAMEWORK FOR MULTI-FACTOR AUTHENTICATION IMPLEMENTATION

International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 349 FORTIFYING ORACLE APEX APPLICATIONS: A COMPREHENSIVE FRAMEWORK FOR MULTI-FACTOR AUTHENTICATION IMPLEMENTATION Ashraf Syed [email protected] Abstract Multi-Factor Authentication (MFA) has emerged as a critical security mechanism to safeguard web applications against unauthorized access. Oracle Application Express (APEX) provides a robust platform for developing secure, scalable applications, but its authentication mechanisms require enhancement to meet modern cybersecurity challenges. This article explores the implementation of MFA in Oracle APEX applications, detailing the types of MFA, integration strategies with APEX authentication schemes, and their benefits and limitations. The study details MFA types—token-based, biometric, push notification, and smart card and their integration with APEX authentication schemes, including SSO and custom solutions. The study evaluates the effectiveness of MFA in preventing credential-based attacks compared to traditional security question verifications. Results indicate that MFA significantly enhances security, though challenges such as user adoption and integration complexity persist. Future trends, including AI-driven dynamic MFA, are discussed to provide a forward-looking perspective. This article contributes to the scholarly discourse by offering a comprehensive framework for implementing MFA in Oracle APEX, supported by empirical analysis and practical recommendations. Keywords: Multi-Factor Authentication, Oracle APEX, Cybersecurity, Authentication Schemes, Adaptive Authentication, Biometric Authentication, Token-Based Authentication, Security Questions, Application Security. I. INTRODUCTION In the era of escalating cyber threats, securing web applications has become an imperative for organizations worldwide. According to projections from 2023, global cybercrime costs were expected to reach $8 trillion annually, marking a significant increase from previous years. This staggering figure underscores the urgency for robust security measures in digital ecosystems. Oracle Application Express (APEX), a low-code development platform, is extensively utilized for rapid application development in enterprise settings, enabling developers to create scalable and feature-rich applications with minimal coding [1]. However, the platform's inherent security features, while comprehensive, must evolve to counter sophisticated attacks such as phishing, credential stuffing, and ransom ware, which have proliferated in recent years [2]. MFA emerges as a pivotal defense mechanism, mandating multiple verification factors to authenticate users, thereby drastically mitigating the risk of unauthorized access [3]. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 350 An alarming rise in breaches characterizes the contemporary threat landscape. Reports from 2023 indicate that 25,081 vulnerabilities were disclosed in 2022, with expectations of further increases, and a high percentage of web applications remaining vulnerable to attacks. Furthermore, 74% of breaches involve the human element, including errors like weak password practices. Traditional single-factor authentication, predominantly reliant on passwords, is inherently flawed due to its susceptibility to compromise through social engineering or bruteforce attacks [4]. In contrast, MFA integrates factors such as something the user knows (password), something they have (token or device), and something they are (biometrics), blocking over 99.9% of account compromise attempts as evidenced by Microsoft research in 2019. The MFA process typically involves an initial login with a password, followed by a second factor, such as an OTP sent to a mobile device or a biometric scan. This layered approach ensures that even if one factor is compromised, access is not granted. Different types of MFA include token-based (hardware or software tokens), biometric (fingerprint or facial recognition), and push-based (app notifications). Each type offers varying levels of security and usability, with biometric providing high security but potential privacy concerns. Oracle APEX offers a suite of authentication schemes, including built-in APEX authentication, Oracle Database credentials, LDAP integration, and Single Sign-On (SSO) protocols like OAuth2 and SAML, which can be customized to incorporate MFA [5]. For instance, integrating with Oracle Identity and Access Management (IAM) enables MFA using authenticator apps or hardware tokens. This integration is crucial for APEX applications, as it addresses the platform's limited native MFA support, often requiring third-party services like Okta or Microsoft Azure Entra ID for enhanced protection. The benefits of MFA extend beyond mere access control; it significantly reduces the impact of phishing attacks, with studies showing high effectiveness in preventing unauthorized logins. However, MFA is not without limitations, including user inconvenience from additional steps and potential costs for implementation. Despite these, it is superior to security question verifications, which are prone to guessing or social engineering since answers can be researched or shared. This article proposes a novel adaptive MFA framework for Oracle APEX, where authentication stringency adapts dynamically based on contextual risk factors, such as geolocation, device fingerprinting, and behavioral anomalies. This approach not only bolsters security but also optimizes user experience by minimizing unnecessary verifications in low-risk scenarios. The study delineates the superiority of MFA over antiquated methods like security question verifications, which are prone to predictability and exploits. The objectives of this research are multifaceted: (1) to dissect various MFA types and their compatibility with APEX environments, (2) to outline a detailed methodology for integrating MFA with adaptive International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 351 elements, and (3) to empirically evaluate the framework's benefits, limitations, and performance metrics. Through a proof-of-concept implementation and simulated testing, the article provides actionable insights for developers. Structured comprehensively, the paper proceeds with a background and literature review, followed by an exposition on authentication types in APEX, the proposed methodology, results and discussions, future trends including AI-driven enhancements, and a conclusive synthesis. This scholarly endeavor aims to bridge gaps in existing APEX security literature, fostering more resilient web application development practices in an increasingly hostile digital landscape. II. BACKGROUND AND RELATED WORK The rapid evolution of cyber threats has necessitated a shift from traditional password-based systems to more robust authentication mechanisms. Passwords, once the cornerstone of digital security, are increasingly vulnerable due to their susceptibility to phishing, brute-force attacks, and credential theft [3]. MFA addresses these vulnerabilities by requiring multiple independent factors for verification: something you know (e.g., a password), something you have (e.g., a token or smartphone), and something you are (e.g., biometric data like fingerprints or facial recognition) [4]. Research consistently demonstrates that MFA reduces the risk of account compromise by over 99% compared to passwords alone, as it significantly raises the bar for attackers even if one factor is compromised [8]. In the context of Oracle Application Express (APEX), a low-code platform for building web applications, authentication is managed through a variety of schemes, including built-in APEX authentication, Oracle Database credentials, LDAP integration, and SSO protocols such as OAuth2 and SAML [9]. These schemes provide flexibility but lack native MFA support, often requiring developers to integrate third-party identity providers or custom solutions [11]. Oracle’s official documentation highlights the extensibility of APEX authentication schemes, noting their compatibility with external systems but also their limitations in providing out-ofthe-box MFA capabilities [2]. This gap has driven research and practical implementations to enhance APEX security. Scholarly literature underscores MFA’s critical role in modern cybersecurity. A 2022 study by Gao et al. in PEARC ’20 explores token-based MFA, emphasizing its effectiveness in thwarting phishing attacks by requiring time-sensitive one-time passwords (OTPs) [13]. However, the book by Grimes also notes vulnerabilities, such as SMS-based OTP interception, highlighting the need for more secure delivery methods like authenticator apps [14]. Similarly, LienChi-Wei in ACM Computing Surveys (2023) examines biometric authentication, praising its high security but cautioning against challenges like false positives and the need for specialized hardware [15]. These findings are particularly relevant for APEX applications, where hardware constraints may limit biometric adoption in certain environments. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 352 Security questions, a traditional alternative to MFA, have been widely criticized for their weaknesses. Rabkin’s article in the 2021 ACM Other conferences details how users often select predictable answers, making security questions susceptible to social engineering and data mining from social media [16]. A blog by Komenda in 2024 further reinforces this, noting that security questions fail in practice due to user behavior, recommending MFA as a more reliable alternative [17]. In contrast, MFA’s multi-layered approach offers robust protection, though it introduces challenges such as user resistance due to added authentication steps and integration complexity with legacy systems [18]. A blog post by Mulvaney outlines the integration of Okta for MFA in APEX, leveraging SSO to enable token-based and push notification MFA [19]. Similarly, the Oracle Cloud Infrastructure documentation demonstrates the use of authenticator apps for MFA, highlighting the feasibility of custom implementations in APEX [20]. These resources emphasize the need for third-party identity providers like Okta or Microsoft Azure Entra ID to bridge the gap in native MFA support [11]. A blog post by Herwix on Identity and Access Management (IAM) further details how to configure MFA using authenticator apps or hardware tokens, offering a standardized approach for enterprise applications [10]. Recent research also explores emerging trends relevant to APEX. A 2023 systematic review in the Digital Health journal examines MFA in the Internet of Healthcare Things (IoHT), highlighting its applicability in sensitive domains where data security is paramount [21]. The article by Almadani et al. discusses token-based and biometric MFA, noting privacy concerns and the need for user-friendly designs. This article explores blockchain-based MFA, suggesting that decentralized verification could enhance security for web applications[22]. These studies underscore the versatility of MFA but also highlight integration challenges, particularly in platforms with limited native support. Adaptive authentication, a key component of the proposed framework, is gaining traction. A 2023 IEEE article by Misbahuddin et al. discusses how machine learning can analyze contextual factors like IP address, login time, and user behavior to dynamically adjust authentication requirements [23]. This approach aligns with the zero-trust security model, which assumes no user or device is inherently trustworthy [24]. Adaptive authentication could optimize user experience by requiring MFA only in high-risk scenarios, a concept explored by Ryu et al. in an article published by ICT Express[25]. Furthermore, a study by Grabatin et al., published in the ACM Digital Library, highlights user adoption challenges, noting that complex MFA processes can lead to frustration, particularly in non-technical user bases [18]. Cost is another concern, as biometric systems require specialized hardware, and third-party services like Okta incur subscription fees [19]. Despite these challenges, MFA’s benefits, such as compliance with standards like NIST 800-63B and reduced breach risks, make it a superior choice over security questions [24]. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 353 This article builds on these insights by proposing a novel adaptive MFA framework for Oracle APEX, addressing gaps in seamless integration and user experience. By synthesizing scholarly research, industry blogs, and Oracle documentation, this section establishes a foundation for the proposed methodology, emphasizing the need for a balanced approach that enhances security while maintaining usability. III. TYPES OF MULTI FACTOR AUTHENTICATIONS MFA enhances security by requiring multiple verification factors, significantly reducing the risk of unauthorized access. In Oracle Application Express (APEX), implementing MFA is critical due to the platform’s widespread use in enterprise applications and its exposure to sophisticated cyber threats [2]. This section explores the primary types of MFA: token-based, biometric, push notification, and smart card authentication, focusing on their characteristics, benefits, limitations, and relevance to Oracle APEX integration. A. Token-Based MFA Token-based MFA involves generating one-time passwords (OTPs) delivered via SMS, email, or authenticator apps like Google Authenticator or Microsoft Authenticator. This method is widely adopted due to its low cost and ease of implementation [13]. In APEX, token-based MFA can be integrated using SSO with identity providers like Okta or Oracle Identity and Access Management (IAM) [10]. For instance, Okta’s SSO integration allows APEX applications to prompt users for an OTP after entering their credentials, leveraging APIs to validate the code [19]. The primary benefit is its accessibility, as most users own smartphones capable of receiving OTPs. However, SMS-based OTPs are vulnerable to interception through SIM swapping or phishing, making app-based authenticators a more secure option [14]. In APEX, token-based MFA is suitable for applications with moderate security requirements, as it balances cost and protection. B. BIOMETRIC MFA Biometric MFA utilizes physiological or behavioral traits, such as fingerprints, facial recognition, or voice patterns, to verify identity [15]. This method offers high security due to the uniqueness of biometric data, making it difficult for attackers to replicate. In APEX, biometric MFA can be implemented through custom authentication schemes, where APIs integrate with device-based biometric systems or third-party providers like Microsoft Azure Entra ID [11]. For example, an APEX application can use a mobile device’s fingerprint scanner as a second factor after password entry, leveraging OAuth2 protocols for secure communication. The advantage is enhanced security, as biometrics are harder to steal than passwords or tokens. However, limitations include the need for compatible hardware, potential privacy concerns, and false positives due to environmental factors like lighting for facial recognition [15]. In APEX, biometric MFA is ideal for high-security applications but may be impractical for users without biometric-enabled devices. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 354 C. PUSH NOTIFICATION MFA Push Notification MFA sends authentication requests to a user’s registered device, typically a smartphone, requiring approval via an app like Okta Verify or Duo Mobile [29]. This method is user-friendly, as it eliminates the need to manually enter codes, and secure, as it relies on encrypted communication. In APEX, push notification MFA can be integrated through SSO schemes, where the identity provider sends a push notification after the user enters their credentials. For instance, Oracle IAM can be configured to send push notifications to a user’s device, which they approve to gain access [10]. The benefit is a seamless user experience, with studies showing a 20% increase in user satisfaction compared to token-based methods [18]. However, it requires users to have a registered device and a stable internet connection, which may pose challenges in remote or low-connectivity environments. In APEX, push notification MFA is well-suited for enterprise applications where usability is a priority. D. SMART CARD MFA Smart Card MFA involves physical cards with embedded chips that store cryptographic keys, requiring users to insert the card into a reader or use NFC-enabled devices [24]. This method offers very high security, as the physical card is difficult to duplicate, making it suitable for high-risk environments like financial or government applications. In APEX, smart card MFA can be integrated through custom authentication schemes, where the application validates the card’s credentials via a secure API. For example, a smart card can be paired with Oracle Database authentication to verify user identity [27]. The primary limitation is low usability, as users must carry a physical card, and implementation costs are high due to hardware requirements. In APEX, smart card MFA is less common but viable for organizations with stringent security needs. Integrating these MFA types with APEX authentication schemes enhances security but requires careful consideration of the platform’s architecture. APEX’s built-in authentication is limited, necessitating third-party identity providers for robust MFA implementation [2]. SSO schemes with OAuth2 or SAML protocols are particularly effective, as they allow seamless integration with providers like Okta or Azure Entra ID [29]. Custom authentication schemes offer flexibility for advanced MFA types, such as biometrics, but require significant development effort [19]. Figure 1 illustrates the integration architecture, showing how MFA factors interact with APEX authentication schemes. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 355 Figure 1: MFA Architecture in APEX Authentication Schemes with Third Party Providers TABLE I. MFA TYPES FOR APEX INTEGRATION MFA Type Security Level Usability Integratio n Complexi ty Cost Token-Based High Moderate Low Low Biometric Very High High High High Push Notifications High High Moderate Moderat e Smart Cards Very High Low High High MFA’s superiority over security questions lies in its multi-layered approach, which mitigates risks from predictable or easily researched answers [16]. In APEX, selecting the appropriate MFA type depends on the application’s security requirements, user base, and infrastructure capabilities. IV. METHODOLOGY The proposed methodology for implementing MFA in Oracle Application Express (APEX) applications is designed to enhance security while maintaining usability by integrating MFA with existing authentication schemes. This approach addresses the platform’s limited native MFA support by leveraging third-party identity providers and custom solutions, including local email-based OTP verification. The methodology is structured into four phases: requirement analysis, authentication scheme selection, MFA integration, and testing and deployment. Each phase is carefully designed to ensure robust security, seamless integration, and minimal user friction, with detailed technical steps for implementation. A. REQUIREMENT ANALYSIS The initial phase involves a comprehensive assessment of the application’s security requirements, user demographics, and infrastructure capabilities. This step determines the suitable MFA types and integration strategies. For example, biometric MFA requires devices with fingerprint scanners or facial recognition capabilities, which may not be available to all International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 356 users [15]. The sensitivity of the application’s data is evaluated; financial or healthcare applications may demand high-security MFA types like biometrics or smart cards, while less sensitive applications may use token-based or email-based OTPs [2]. User characteristics, such as technical proficiency and device ownership, are analyzed to ensure accessibility. Infrastructure constraints, including network reliability and existing identity management systems, are assessed for compatibility with third-party providers like Twilio for SMS/email OTPs or Okta for SSO-based MFA [10]. Stakeholder consultations align security objectives with business needs, ensuring the MFA solution balances protection and usability. B. AUTHENTICATION SCHEME SELECTION Selecting an appropriate APEX authentication scheme is crucial for effective MFA integration. APEX supports built-in APEX authentication, Oracle Database authentication, LDAP, SSO, and custom authentication [9]. SSO schemes, using OAuth2 or SAML protocols, are preferred for third-party MFA integration with providers like Okta or Microsoft Azure Entra ID due to their robust MFA capabilities [29]. Custom authentication schemes offer flexibility for local MFA implementations, such as email-based OTPs or advanced types like biometrics, but require more development effort [19]. Oracle Database authentication can be extended with triggers to support MFA, while LDAP integrates with directory services like Active Directory [27, 28]. The selection considers scalability for enterprise applications and compatibility with chosen MFA types. For instance, email-based OTPs are suitable for custom authentication, while push notifications align with SSO schemes [11]. This phase ensures the authentication scheme supports the application’s security and performance needs. C. MFA INTEGRATION This phase focuses on integrating MFA types with the selected authentication scheme, leveraging both third-party services and local APEX capabilities. For third-party integration, services like Twilio are used for token-based MFA via SMS or email. The integration involves configuring REST API calls to Twilio’s messaging or email services (e.g., SendGrid, acquired by Twilio) to send OTPs. Below is an example PL/SQL code snippet for sending an OTP via Twilio’s REST API within an APEX application: DECLARE l_url VARCHAR2(4000) := 'https://api.twilio.com/2010-0401/Accounts/YOUR_ACCOUNT_SID/Messages.json'; l_wallet_path VARCHAR2(100) := 'file:/path/to/wallet'; l_wallet_pass VARCHAR2(100) := 'wallet_password'; l_response CLOB; l_otp VARCHAR2(6) := DBMS_RANDOM.STRING('N', 6); -- Generate 6-digit OTP BEGIN -- Store OTP in APEX application item APEX_UTIL.SET_SESSION_STATE('F_OTP', l_otp); -- Configure HTTP request to Twilio International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 357 APEX_WEB_SERVICE.G_REQUEST_HEADERS(1).name := 'Authorization'; APEX_WEB_SERVICE.G_REQUEST_HEADERS(1).value := 'Basic ' || UTL_RAW.CAST_TO_VARCHAR2(UTL_ENCODE.BASE64_ENCODE(UTL_RAW.CAST_TO_RAW( 'YOUR_ACCOUNT_SID:YOUR_AUTH_TOKEN'))); -- Make REST API call to send OTP via SMS l_response := APEX_WEB_SERVICE.MAKE_REST_REQUEST( p_url => l_url, p_http_method => 'POST', p_wallet_path => l_wallet_path, p_wallet_pwd => l_wallet_pass, p_param_name => 'To:From:Body', p_param_value => '+1234567890:+YOUR_TWILIO_NUMBER:Your OTP is ' || l_otp ); -- Log response for debugging DBMS_OUTPUT.PUT_LINE(l_response); EXCEPTION WHEN OTHERS THEN DBMS_OUTPUT.PUT_LINE('Error: '|| SQLERRM); END; This code generates a 6-digit OTP, stores it in an APEX application item (F_OTP), and sends it via Twilio’s SMS API. The API requires an Account SID and Auth Token, configured securely in the APEX wallet. For email-based OTPs, a similar approach uses Twilio’s SendGrid API: DECLARE l_url VARCHAR2(4000) := 'https://api.sendgrid.com/v3/mail/send'; l_wallet_path VARCHAR2(100) := 'file:/path/to/wallet'; l_wallet_pass VARCHAR2(100) := 'wallet_password'; l_response CLOB; l_otp VARCHAR2(6) := DBMS_RANDOM.STRING('N', 6); l_json CLOB; BEGIN -- Store OTP in APEX application item APEX_UTIL.SET_SESSION_STATE('F_OTP', l_otp); -- Construct JSON payload for SendGrid l_json := '{ "personalizations": [{"to": [{"email": "[email protected]"}]}], "from": {"email": "[email protected]"}, "subject": "Your OTP for Login", "content": [{"type": "text/plain", "value": "Your OTP is ' || l_otp || '"}] }'; International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 364 4. OPEN-SOURCE INTEGRATION Leveraging open-source MFA libraries, such as those supporting TOTP (Time-based One-Time Password) algorithms, can reduce implementation costs and provide customizable solutions for APEX applications [28]. These libraries can be integrated into custom authentication schemes to support token-based MFA without third-party dependencies. 5. EXPLORATION OF ADAPTIVE AUTHENTICATION Future research should focus on implementing adaptive authentication in APEX, using machine learning to analyze contextual data and dynamically adjust MFA requirements. This could involve developing plugins for Oracle AI Services to integrate risk-based logic seamlessly [27]. These recommendations align with the evolving cybersecurity landscape, emphasizing the need for flexible, user-friendly, and robust authentication mechanisms. By adopting these strategies, Oracle APEX developers can enhance application security, ensure compliance with standards like NIST 800-63B, and prepare for future threats in an increasingly interconnected digital ecosystem [24]. VII. CONCLUSION The implementation of MFA in Oracle Application Express (APEX) applications represents a pivotal advancement in bolstering web application security amid escalating cyber threats. This article has comprehensively explored the integration of MFA types, such as token-based, biometric, push notification, and smart card, with APEX authentication schemes, proposing a novel methodology that addresses the platform's inherent limitations in native MFA support. By leveraging third-party services like Twilio for SMS and email OTPs, and local APEX functionalities such as APEX_MAIL for email-based verification, the framework ensures a layered defense mechanism that significantly mitigates risks associated with single-factor authentication, such as password vulnerabilities [7]. The empirical results from the simulated enterprise environment underscore MFA's superiority, with success rates exceeding 95% in preventing unauthorized access compared to a mere 65% for traditional security questions, highlighting its efficacy in real-world scenarios [8], [16]. The benefits of MFA extend beyond security enhancement; they include improved user satisfaction through user-friendly methods like push notifications and email OTPs, which balance protection with usability [18]. Token-based MFA, in particular, offers accessibility and cost-effectiveness, making it suitable for moderate-risk applications. At the same time, biometric and smart card methods cater to high-security needs despite their hardware dependencies [15, 24]. However, the study also acknowledges limitations, such as integration complexity in custom schemes and potential user resistance due to additional steps, which necessitate careful planning and training [19]. These challenges, while notable, are outweighed by MFA's ability to reduce breach risks by over 99%, as evidenced by industry research [8]. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 365 This research contributes to the scholarly discourse by providing a practical, step-by-step guide for developers, complete with code snippets for REST API integrations and local OTP verification, empowering them to implement robust MFA solutions in APEX. By adopting this methodology, organizations can foster scalable, secure applications that comply with standards like NIST 800-63B and adapt to evolving threats [24]. Looking ahead, future trends such as AIdriven adaptive authentication and blockchain-based MFA promise to further revolutionize APEX security, enabling dynamic risk assessment and decentralized verification [23, 22]. Developers are encouraged to prioritize hybrid models and open-source tools to mitigate costs and enhance flexibility [4, 28]. Ultimately, this study paves the way for a more resilient digital ecosystem, where APEX applications not only withstand current threats but also anticipate future challenges, ensuring data integrity and user trust in an interconnected world. ACKNOWLEDGMENT The author would also like to disclose the use of the Grammarly (AI) tool solely for editing and grammar enhancements. REFERENCES 1. C. Magazine, “Cybercrime To Cost The World 8 Trillion Annually In 2023,” Cybercrime Magazine. Accessed: June. 20, 2024. [Online]. Available: https://cybersecurityventures.com/cybercrime-to-cost-the-world-8-trillion-annually-in2023/ 2. Oracle, “Oracle APEX Release 22.2 - Oracle APEX Release 22.2,” Oracle Help Center. Accessed: June. 20, 2024. [Online]. Available: https://docs.oracle.com/en/database/oracle/apex/22.2/ 3. N. Rahimi, "A Study of the Landscape of Security Issues, Vulnerabilities, and Defense Mechanisms in Web Based Applications," 2021 International Conference on Computational Science and Computational Intelligence (CSCI), Las Vegas, NV, USA, 2021, pp. 806-811, doi: 10.1109/CSCI54926.2021.00194. 4. A. K. Nag, A. Roy and D. Dasgupta, "An Adaptive Approach Towards the Selection of Multi-Factor Authentication," 2015 IEEE Symposium Series on Computational Intelligence, Cape Town, South Africa, 2015, pp. 463-472, doi: 10.1109/SSCI.2015.75. 5. Intel 471, “Vulnerabilities Year-in-Review: 2023,” Website, Mar. 27, 2024. Accessed: June. 22, 2024. [Online]. Available: https://www.intel471.com/blog/vulnerabilities-year-in-review2023 6. J. Peters, “Infosec Institute,” Infosec. Accessed: June. 20, 2024. [Online]. Available: https://www.infosecinstitute.com/resources/ security-awareness/human-errorresponsible-data-breaches/ 7. I. Mannuela, J. Putri, Michael and M. S. Anggreainy, "Level of Password Vulnerability," 2021 1st International Conference on Computer Science and Artificial Intelligence (ICCSAI), Jakarta, Indonesia, 2021, pp. 351-354, doi: 10.1109/ICCSAI53272.2021. 9609778. International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 366 8. M. Maynes, “One simple action you can take to prevent 99.9 percent of attacks on your accounts,” Microsoft Security Blog. Accessed: Jul. 7, 2024. [Online]. Available: https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-youcan-take-to-prevent-99-9-percent-of-account-attacks/ 9. A. Chatterjee, “Understanding Preconfigured Authentication Schemes,” Oracle Help Center. Accessed: June. 22, 2024. [Online]. Available: https://docs.oracle.com/en/database/oracle/apex/22.2/ htmdb/preconfiguredauthentication-schemes.html 10. T. Herwix, “Enabling Multi-Factor Authentication in APEX using Oracle Identity and Access Management,” TM-APEX, Feb. 02, 2024. Accessed: Jul. 5, 2024. [Online]. Available: https://tm-apex.hashnode.dev/enabling-multi-factor-authentication-in-apex-using-oracleidentity-and-access-management 11. M. Michel, “Using Authenticator Based MFA in Oracle APEX - The Cattle Crew Blog,” The Cattle Crew Blog - All about Digital Transformation, BI & Big Data, Cloud & Infrastructure, Software Development, BPM & Integration. Powered by OPITZ CONSULTING Deutschland GmbH. Accessed: Jul. 7, 2024. [Online]. Available: https://thecattlecrew.net/2023/10/11/38201/ 12. R. Grimes, “Stop the Insanity: MFA Does Not Stop 99% of Attacks,” LinkedIn, Jun. 08, 2022. Accessed: June. 24, 2024. [Online]. Available: https://www.linkedin.com/pulse/stopinsanity-mfa-does-99-attacks-roger-grimes 13. Y. A. Gao, J. Basney, and A. Withers, “SciTokens SSH: Token-based Authentication for Remote Login to Scientific Computing Environments,” in PEARC ’20: Practice and Experience in Advanced Research Computing, Association for Computing Machinery, Jul. 2020, pp. 465–468. Accessed: June. 24, 2024. [Online]. Available: https://dl.acm.org/doi/10.1145/3311790.3399613 14. R. Grimes, “Access Control Token Tricks,” in Hacking Multifactor Authentication, Wiley, 2021, pp. 141–161. Accessed: Jul. 2, 2024. [Online]. Available: https://doi.org/10.1002/9781119672357.ch6. 15. LienChi-Wei, “Challenges and Opportunities of Biometric User Authentication in the Age of IoT: A Survey,” ACM Computing Surveys, vol. 56, no. 1, Aug. 2023. 16. A. Rabkin, “Personal knowledge questions for fallback authentication,” ACM Other conferences. Accessed: Jul. 2, 2024. [Online]. Available: https://dl.acm.org/doi/10.1145/1408664.1408667 17. E. Komenda, “Are security questions terrible for account security?” Proton. Accessed: Jul. 4, 2024. [Online]. Available: https://proton.me/ blog/ security-questions-flaws-solutions. 18. M. Grabatin, M. Steinke, D. Pohn, and W. Hommel, “A Matrix for Systematic Selection of Authentication Mechanisms in Challenging Healthcare related Environments,” ACM Conferences. Accessed: June. 10, 2024. [Online]. Available: https://dl.acm.org/doi/10.1145/ 3445969.3450424. 19. M. Mulvaney, “Oracle APEX + OKTA Identity Cloud Authentication & Authorization guide,” Pretius. Accessed: Jul. 1, 2024. [Online]. Available: https://pretius.com/blog/apexokta-guide International Journal of Core Engineering & Management Volume-7, Issue-11, 2024 ISSN No: 2348-9510 367 20. Oracle, “Managing Multifactor Authentication,” Oracle Cloud Infrastructure. Accessed: Jul. 7, 2024. [Online]. Available: https:// docs.oracle.com/enus/iaas/Content/Identity/Tasks/usingmfa.htm 21. T. Suleski, M. Ahmed, W. Yang, and E. Wang, “A review of multi-factor authentication in the Internet of Healthcare Things,” DIGITAL HEALTH, vol. 9, Jan. 2023, doi: 10.1177/20552076231177144. 22. M. S. Almadani, S. Alotaibi, H. Alsobhi, O. K. Hussain, and F. K. Hussain, “Blockchainbased multi-factor authentication: A systematic literature review,” Internet of Things, vol. 23, p. 100844, Oct. 2023, doi: 10.1016/j.iot.2023.100844. 23. M. Misbahuddin, B. S. Bindhumadhava and B. Dheeptha, "Design of a risk based authentication system using machine learning techniques," 2017 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computed, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/ CBDCom/IOP/SCI), San Francisco, CA, USA, 2017, pp. 1-6, doi: 10.1109/UIC-ATC.2017.8397628. 24. National Institute of Standards and Technology, “Zero Trust Architecture: NIST Publishes SP 800-207,” NIST. Accessed: June. 7, 2024. [Online]. Available: https://www.nist.gov/news-events/news/ 2020/08/zero-trust-architecture-nistpublishes-sp-800-207 25. R. Ryu, S. Yeom, D. Herbert, and J. Dermoudy, “The design and evaluation of adaptive biometric authentication systems: Current status, challenges and future direction,” ICT Express, vol. 9, no. 6, pp. 1183–1197, Dec. 2023, doi: 10.1016/j.icte.2023.04.003. 26. A. Chatterjee, “Custom Authentication,” Oracle Help Center. Accessed: Jul. 7, 2024. [Online]. Available: https://docs.oracle.com /en/database/oracle/apex/22.1/htmdb/custom-authentication.html 27. A. Chatterjee, “Database Accounts,” Oracle Help Center. Accessed: Jul. 7, 2024. [Online]. Available: https://docs.oracle.com/en/database/ oracle/apex/22.1/htmdb/databaseaccounts.html 28. rolyon, “Microsoft Entra ID documentation - Microsoft Entra ID,” Microsoft Learn. Accessed: Jul. 10, 2024. [Online]. Available: https://learn.microsoft.com/enus/azure/active-directory 29. OKTA, “Add an Oracle Application Express app,” Okta Access Gateway. Accessed: Jul. 6, 2024. [Online]. Available: https://help.okta.com/oag/en-us/content/topics/accessgateway/add-oracle-appx.htm