(No Ratings Yet)

Loading...

• Facebook
• Twitter
• LinkedIn
• Mail

February 6, 2018 Comments closed

Is Single Sign-On Right for your Website?

in Hashing Out Cyber Security

Convenience at the expense of security? Maybe… Maybe Not.

Single Sign-On (SSO) is an exceptionally convenient tool for users. If you’re not familiar, SSO allows a user to login with one credential, and then gain access to a network of connected systems and applications.  Have you ever gone to log in somewhere and it gives you the option to log in via Facebook? That’s Single Sign-On. But is Single Sign-On right for your website?

Let’s Hash it Out…

What is Single Sign-On?

Single sign-on is a mechanism used to simplify the login process for a connected group of website and applications. You sign in through one entry point, using one set of login credentials, and then gain access to the rest of the connected network. To put it another way, the SSO authenticates the user for all sites and applications, which removes further login prompts if the user changes applications in the same session.

For the websites and applications themselves, SSO is helpful when attempting log user activity or monitoring accounts.

“SSO also helps to simplify the administration of user access for system administrators,” said Patrick Tiquet, Director of Security & Architecture from Keeper Security. “Administrators are able to quickly authorize or revoke access to users and/or individual services in a single location or interface. For an organization that must manage access to dozens or hundreds of internal and external services, SSO may be the only practical solution to securely manage access.”

The advantages are obvious, users only have to remember one password, it cuts down on login prompts, which are an interruption to users. And it has back-end benefits as we just discussed.

“Businesses should implement Single Sign-On because the #1 reason why people call the help-desk is forgotten passwords. And each one of those calls is expensive,” said Mark Wilcox, VP of Business Development at ICSynergy. Wilcox has worked on Single Sign-On since 1996. “The #2 reason is that Single Sign-On can improve overall security. When you have fewer passwords to type then you reduce the number of passwords that can be compromised.”

But there are security drawbacks, too.

What are the Risks with Single Sign-On?

“Multi-partner SSO worries me tremendously,” Kenneth S. Robb, a Cyber Security & Risk Consultant at Citadel Cyber Solutions. “It falls squarely in the “Convenience” model for users to hop back and forth between related systems. This escalates 3^rdparty risk to a higher level but most firms will not recategorize their relationships with SSO partners once they have changed the relationship using SSO. It effectively extends your network and now you need to be seriously concerned with your 3^rd party to ensure they are following the highest standards for security.”

Then there’s the risk if a password is ever compromised. One of the biggest benefits of SSO is that eliminates the need to have a unique password for every site. You DO have a unique password for every site, right? Well instead of remembering all of those you can just remember the ID and password you use SSO and still have access to all of your accounts.

You can probably see where this is going… If your ID and password are every compromised, now an attacker has access to all of your accounts. This is particularly dangerous at the Enterprise level because you can’t contain the access, the attacker has access to anything that the compromised user has permissions for. That has the potential to be disastrous.

“Simplicity should never be put before security, especially with all of the data breaches we’ve seen over the past year,” said Kari Lindemuth of KDG. “SSO severely hampers password security, leaving users’ data more susceptible to being stolen. If a hacker is able to access your SSO password, all of your accounts are out in the open.”

“Another drawback of SSO is that all authentication must be performed through the SSO IDP, which is a potential single point of failure and a high-profile target for malicious parties,” added Tiquet. “If the SSO IDP becomes unavailable, users will not be able to authenticate to a service.  If the SSO IDP is compromised, all services relying on SSO for authentication are at risk of being compromised. All services connected to the SSO implementation are only as secure as the SSO IDP. A rogue administrator or hacker need only to obtain access to a single location to potentially compromise services relying on SSO for authentication.”

How to Secure Single Sign-On

It’s not all bad, though. Single Sign-On by itself may present some security risks but you can add a layer of security in the form of two-factor authentication (2FA).

With modern Single Sign-On using systems like Okta or Oracle Identity Cloud then it becomes much easier to implement stronger authentication using multi-factor authentication,” said Wilcox. “Multi-factor authentication is when an end-user must provide at least 2 forms of identity. Typically a password and a one-time pin.”

“Whether it comes to emails or cloud databases, we always recommend that our clients activate two-step authentication on any of their accounts,” said Lindenmuth. “It’s one extra step a user has to follow, but it adds an extra layer of security that they’ll be glad they have when the next cyber attack occurs.”

Wilcox also provided some additional tips on securing SSO.

1. Implement multi-factor authentication

2. Use a proven solution based around standards such as SAML, OAuth, OpenID Connect or Kerberos (Windows only environments)

3. Integrate session monitoring to look for suspicious activity such as a login that starts at one location but the next request comes from a distant location. Or a login from an unknown device.

“Anyone considering the deployment of SSO for their website or organization should carefully weigh the risks vs. benefits of Single Sign-On.,” said Tiquet. “For most organizations [that] must manage access to many different services, the benefits of centralized access management and the convenience to end-users offered by SSO far outweigh any architectural security concerns.”

• #Passwords
• #Single Sign-On