Identity and Access – Part 1 – Single Sign-On (SSO)

Introducing Single Sign-On (SSO) Solution in any Organization can offer greater security and improved usability.

Most Organizations have multiple applications running across cloud, SaaS, and On-Premise environments, These heterogeneous environments bring complexity, cost, and user identity Management security challenges, especially when they are not integrated into a central authentication. On the other hand, Users find it difficult to manage their multiple application passwords. No one likes remembering all these credentials. What’s worse is many use the same username and password, irrespective of the application they are using – resulting in passwords more prone to the dictionary and brute force attacks to visible passwords on sticky notes around desks. This is where the Single Sign-On technology comes into focus and works like a champ and with cloud being prevalent, it is effective for organizations to consolidate the existing identity and authentication across applications and systems.

What is Single Sign-On?

Single Sign-On (SSO) is a method of authentication that allows applications, web portals to use other trustworthy systems, applications to verify users. OR Single sign-on enables users to securely authenticate with multiple applications and web portals by logging in only once—with just one set of credentials (normally domain username and password). SSO is an essential feature of an Identity and Access Management (IAM) platform for controlling access and identity. Verification of user identity is important when it comes to knowing which all accesses and permissions a user could have.

How It Works

Single Sign-On works by having a central server(s) or as a service (SaaS options), that all the organization applications are configured to trust and integrate to. When you log in for the first time a cookie/token gets created on this central server. Then, whenever you try to access a second application at its login, you get redirected to the central server, if you already have a cookie there, you will get redirected directly to the app with a token, without login prompts, which means you’re already logged in.

Authentication with SSO depends on trust between domains (websites/ applications). With single sign-on, this is what happens when you try to log in to an application or website connected to SSO:

1. The website first checks to see whether you’ve already logged in to the SSO solution, in which case it gives you access to the required website.
2. If you not logged in, it redirects you to the SSO login screen.
3. You enter the single username/password that you use for corporate access normally a domain username and password.
4. The SSO solution requests authentication from the identity provider or authentication system that your company uses like Active Directory. It verifies your identity and notifies the SSO solution.
5. The SSO solution passes authentication data to the website and returns you to that site.
6. After login, the site passes authentication verification data with you as you move through the site to verify that you are authenticated each time you go to a new page.

For example, Google implemented a Single Sign-On (SSO) Solution in its various services. Google’s central server is https://accounts.google.com. Here, once we login to this server, we will be able to access Gmail, Youtube, and Google Docs without entering your credentials again.

What Are the Benefits of Single Sign-On

Single Sign-On clearly minimizes the risk of poor password habits and the increased productivity of users.

1. Seamless user experience: Customers can use a single identity to navigate multiple web and mobile domains or service applications. As customers no longer need to do repeated logins they can enjoy a modern digital experience.
2. Stronger password protection: Since users only need to remember one password for multiple applications, they are more likely to create a stronger (harder to guess) passphrase beyond policies, and less likely to write it down. These best practices reduce the risk of password theft. We can integrate this with MFA for additional security
3. It increases employee and IT productivity: Reduce support calls, improve user experience and Mitigate security risks
4. It combines with Risk-Based Authentication (RBA): You can combine SSO with risk-based authentication (RBA). With RBA, you and your security team can monitor user habits. This powerful combination can prevent cybercriminals from stealing data, damaging your site, or draining IT resources
5. It reduces password fatigue: To prevent cybercrime, security professionals insist on unique passwords for every single application. This means that the average user must remember dozens of passwords for personal and office use. Unfortunately, this often leads to “password fatigue.”
6. It prevents Shadow IT.
7. Reduces User time: Users will spend less time logging into various apps to do their work. Ultimately it enhances the productivity of businesses.

With more applications moving to the cloud, security and data are a prime concern, CASB Cloud Access Service Broker solution with SSO single sign-on as a framework greatly improves system and application security.

We would be covering the CASB Part in our next blog post in this series.