Making Access Seamless — and Shutting It Down When Necessary
The clear benefit of SSO is removing the administrative burden of logging in to individual applications. This typically manifests in simple passwords that are easy to crack, or lists of passwords, which are easy to misplace. And when it comes to modern authentication standards, such as those spelled out in the National Institute of Standards and Technology Digital Identity Guidelines, it’s also more than passwords.
“Identity platforms can apply flexibility in how they authenticate,” says Dan Cinnamon, principal solution architect for healthcare at Okta. Options could include multifactor authentication (MFA), biometrics or the detection of a user’s physical presence. “When there’s one login process for everything a user needs, you can create a consistent experience.”
On the back end, SSO works by transitioning authentication from the application layer to a centralized IAM system. Because academic applications no longer collect or store password information, or communicate them over the network to be authenticated, an organization’s potential attack surface shrinks significantly, Cinnamon says.
EXPLORE: These are the top three reasons to modernize your IAM program.
Once a user is logged in, SSO and IAM platforms work in tandem to monitor how they move from one application to another. This also extends to machine identities, which can be assigned to numerous devices.
Over time, this helps establish patterns of normal behavior. Under typical circumstances — a trusted ID, device and endpoint — authentication can be seamless. For Traffanstedt, it’s less about frictionless access and more about transferring the friction from the end user to the SSO and IAM systems that set controls and enforce policies.
That said, if it appears an ID has been compromised or a device has been breached, access will be denied. As Cinnamon puts it, “Once something’s fishy, the roadblocks come up.” In this case, the momentary frustration an end user may experience is offset by the effectiveness of the quick clampdown on lateral movement throughout the organization’s network.
SSO’s Close Alignment With Zero Trust Supports New Models
Traffanstedt says SSO aligns nicely with the core principles that require authentication and continuous validation before a user is granted access to an application, device or data set.
“Continuous validation of access is easier when ingress and egress are centralized,” as they are with SSO platforms, he says. “This hardens the security environment in ways SSO wasn’t originally conceived to do.”
As an example, Traffanstedt points to adaptive MFA, which applies business rules to determine which authentication factors make the most sense in each scenario. An administrator who works at the main campus some days and a branch campus on other days may be subject to different access controls based on location.
LEARN MORE: Bust the top three identity and access management myths to boost security.
Cinnamon describes this scenario as access at rest and in transit, similar to the key principles of data encryption. Access at rest is comparable to traditional IAM, based on a user’s position in the organization and hiring status. It’s role-based, relatively static and built on an expectation of trust.
Access in transit is more like modern authentication, powered by SSO. While no assumptions are made and authentication is required, “you can apply layers of authentication and validation in flexible ways, given a user’s context,” Cinnamon says. This can dramatically benefit a university’s embrace of new security and IT models.
Source link
#SSO #Streamlines #Identity #Management #Improve #Workflows
