Security benefits of Single Sign-On

Question

What are the benefits of a single sign-on implementation from the point of view of security?

From my point of view, if the account is compromised the attacker has access to any resource, so according to this, SSO is far from secure.

Answer 1

I can see three main benefits.

1. Reduce the amount of passwords users have to remember. Users are encouraged to use vastly different passwords for different sites. Managing that many different passwords can be problematic. Obviously this isn't an issue if the user uses a password manager tool but let's be realistic, how many users can you expect to do that? A SSO solution can greatly reduce the number of passwords a user has to remember, which might encourage the user to choose a much stronger password.

2. Provides convenience to the users. A SSO solution literally means the user has to sign on just one single time to access multiple services. This is a huge timesaver especially if a company provides multiple services. A good example of this would be Google. While this might not strictly be accurate, I have a feeling that by reducing the number of times a user has to enter his credentials, the risk of an attacker intercepting the credentials through something like a keylogger will be reduced.

3. Reduce the headache of assisting users with password recovery. Imagine a company running ten different services. A SSO solution can greatly reduce the amount of helpdesk manpower needed as users only need to recover a single account. Whilst not a security concern, this is a very tangible benefit to companies.

Of course, a SSO solution concentrates a lot of power on the authentication solution. One should probably spend a lot more time and effort securing that single point of failure.

Answer 2

In the words of Shwetha on the Cymfony System Testing blog, Some of the common advantages are :

1. Users select stronger passwords, since the need for multiple passwords and change synchronization is avoided.

2. Inactivity timeout and attempt thresholds are applied uniformly closer to user points of entry.

3. It improves the effectiveness/timeliness of disabling all network/computer accounts for terminated users.

4. It improves an administrator's ability to manage users and user configurations to all associated systems.

5. It reduces administrative overhead in resetting forgotten passwords over multiple platforms and applications.

6. It provides users with the convenience of having to remember only a single set of credentials.

7. This also improves security as users find it easier to remember their credentials and do not have to write them down, allowing for a more efficient user log on process.

8. It reduces the time taken by users to log into multiple applications and platforms