Due to recent high profile data breaches users have a heightened awareness of security and how they manage or don’t manage their various account credentials. People are beginning to pay more attention to the advice given to them by security professionals. Advice regarding using strong passwords, using a different password for every account and so on. Inevitably a user will come across an advertisement for a SSO product and go to their IT Department requesting the implementation of SSO, “It’s the answer to our endless list of passwords.”
Well, kind of is the real answer. SSO breaks down into two basic types; enterprise SSO and account credential management. Enterprise SSO provides authorization and access across multiple systems each of which has its own security layer. Starting with a directory server, typically Active Directory or another Lightweight Directory Access Protocol (LDAP) compliant directory, identity information can be shared in a variety of ways. Integrated Windows Authentication is a term used to refer to several different Microsoft protocols, Kerberos, SPNEGO and NTLMSSP that allow for cross system authentication. Security Assertion Markup Language (SAML) is an XML based method for exchanging identity information between a directory and web based service. Finally, if an integrated method cannot be used, there are many third party SSO and identity management tools that can be implemented in the enterprise. Beyond helping to alleviate user password fatigue, implementing a SSO solution can provide increased security control and auditing capabilities. It can also be leveraged to assist in the implementation of Role Based Access Control (RBAC) which I discussed in a previous post.
Account credential management applications are also often referred to as SSO solutions. These are typically applications installed at the workstation level that gather and maintain account credentials and auto insert them for the user when it recognizes credential fields in a system or application. Such applications typically only require the user to authenticate against its account, thus the single sign on. Be aware however when selecting which SSO application to use. If it is ‘cloud’ based, be sure the provider is utilizing proper security . If is completely workstation based, be sure the application has a way to back up your credentials should you change computers for whatever reason.