📖 What is Single Sign-On (SSO)?
Single Sign-On (SSO) is an authentication scheme that allows a user to log in with a single set of credentials to access multiple related, yet independent, software systems. It reduces password fatigue and streamlines identity management for the organization.
"SSO creates a single point of failure. If the SSO account is compromised, the attacker potentially gains access to all integrated systems simultaneously."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Single Sign-On (SSO)?
- ▸ Federated Identity Management allows SSO to work across different organizational boundaries by establishing trust between an Identity Provider and a Service Provider.
- ▸ Standard protocols like SAML, OAuth 2.0, and OpenID Connect facilitate the secure exchange of authentication and authorization data between systems.
- ▸ Centralized lifecycle management enables administrators to provision or revoke access to all integrated applications instantly by modifying a single user account.
- ▸ Token-based authentication uses digitally signed tokens to prove identity, ensuring that the user's actual password is never shared with the service provider.
- ▸ Implementing Multi-Factor Authentication (MFA) is a critical security control to mitigate the risk of a single point of failure inherent in SSO.
🎯 How does Single Sign-On (SSO) appear on the CISSP Exam?
You may be asked to identify the best solution for a company merging with another entity that requires employees to access resources across both domains without creating duplicate accounts.
A scenario might describe a need to reduce administrative overhead for password resets while improving user experience across a diverse portfolio of SaaS applications.
Expect questions about the security trade-offs of SSO, specifically focusing on how to mitigate the risk of a single compromised credential granting access to all systems.
❓ Frequently Asked Questions
What is the primary difference between SSO and Federation?
SSO typically refers to accessing multiple applications within a single organization or trust zone. Federation extends this capability across different organizations or domains using a formal trust agreement and standards like SAML.
Does implementing SSO eliminate the need for strong password policies?
No. Because SSO creates a single point of failure, the primary credential becomes a high-value target. Strong password policies and mandatory MFA are even more critical for the SSO account than for individual apps.