Single Sign-On and Federated Identity
Understand SSO and federated identity concepts, protocols, benefits, risks, and audit considerations for CISA exam preparation.
Single Sign-On Overview
Single Sign-On (SSO) allows users to authenticate once and gain access to multiple applications and systems without re-entering credentials. For CISA candidates, understanding SSO is important because it affects the security and usability of an organization's access management infrastructure. While SSO improves user experience and can strengthen security, it also introduces risks that auditors must evaluate.
SSO reduces the number of passwords users must manage, which can decrease password fatigue and reduce the likelihood of weak or reused passwords. However, it also creates a single point of failure: if SSO credentials are compromised, the attacker potentially gains access to all connected systems.
SSO Architecture and Protocols
Common SSO Protocols
Several protocols and standards enable SSO functionality:
- SAML (Security Assertion Markup Language): An XML-based standard for exchanging authentication and authorization data between identity providers and service providers, commonly used in enterprise environments
- OAuth 2.0: An authorization framework that enables applications to obtain limited access to user accounts, widely used for API access and mobile applications
- OpenID Connect (OIDC): An authentication layer built on top of OAuth 2.0 that provides user identity verification, commonly used for web and mobile SSO
- Kerberos: A network authentication protocol used in Windows Active Directory environments for transparent SSO within the domain
Components of SSO
An SSO architecture typically includes an Identity Provider (IdP) that authenticates users and issues security tokens, Service Providers (SPs) that rely on the IdP for authentication, a token or assertion that carries identity information between the IdP and SPs, and a trust relationship established through certificate exchange or shared secrets.
Federated Identity
Federated identity extends SSO across organizational boundaries, allowing users from one organization to access resources in another without creating separate accounts. Federation is built on trust agreements between participating organizations. Key concepts include:
- Identity federation: Linking user identities across multiple security domains
- Trust frameworks: Agreements defining how organizations authenticate users and share identity information
- Attribute sharing: Exchanging user attributes (role, department, clearance) between organizations
- Cross-domain access: Enabling seamless access to partner applications and cloud services
Benefits and Risks
Benefits of SSO and federation include improved user productivity, reduced help desk calls for password resets, centralized access management, and consistent authentication policy enforcement. Risks include the single point of compromise concern, dependency on the IdP's availability, complexity in managing trust relationships, and the potential for excessive access if SSO session management is weak.
Audit Considerations
IS auditors evaluating SSO and federated identity should assess the security of the IdP infrastructure, verify that session timeouts and re-authentication requirements are appropriate, review trust relationship configurations with federated partners, evaluate whether SSO tokens are properly protected against interception and replay, and confirm that access logging captures SSO events with sufficient detail for investigation. Auditors should also test the account lockout and credential revocation processes to ensure they effectively terminate SSO sessions across all connected applications.