A method, apparatus, and computer program are disclosed. The method may be performed by one or more processors and may comprise receiving an indication of a request from a client device. The request is for establishing an access session to perform one or more actions on data of a data processing platform and includes a client identifier. The method may also comprise establishing a challenge session associated with the request. The challenge session indicates one or more challenges required of a user associated with the client identifier to successfully respond to in order to establish the requested access session. The method may also comprise sending a challenge identifier associated with a first challenge of the challenge session to the client device using the client identifier for requesting the first challenge from a user manager, and receiving from the user manager a post-challenge response, indicative of a success or a failure of a first challenge response received at the user manager to the first challenge.