Identity management SSO security: Hardening single sign-on systems

Identity management SSO security: Hardening single sign-on systems

What would you say are the key best practices for hardening a single sign-on (SSO) system? Our organization has grown to the point where we could really use SSO to tie together several dozen systems, but some senior managers are concerned that a compromise to the SSO system would instantly grant unauthorized access to every system we tie into it. What would you recommend in terms of managing that risk?

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Two recommendations come to mind. One is to establish a good security and compliance awareness program. Generally, if people are told not to do something -- like access another person's account without proper authorization -- they'll comply.

Second, for extremely sensitive data applications, use two-factor authentication. Username/password authentication in an SSO environment is much riskier than two-factor authentication, as you note. And two-factor authentication doesn't mean all users have to carry a smart card; tokenless two-factor authentication services are readily available and not as expensive as their hard-token counterparts.

But the biggest recommendation I have to offer is to do a market study on whether hardening single sign-on environments is even necessary. (Ask the single sign-on vendor(s) you're working with to help with this.) Generally, organizations are able to implement single sign-on internally with few to no issues of compromise using username/password schemes. Also, be sure to discuss security concerns with the senior managers to better understand what their actual fears are and address them directly.

This was first published in June 2010

Back to top