This document discusses single sign-on (SSO), including the pros and cons. It outlines different SSO standards and categories like network-based, federated, and outlines who typically owns SSO implementations. It notes that while SSO provides benefits like a consolidated user experience and cost savings, it also presents challenges like being a large effort, requiring flexibility, and creating a single point of failure. The document discusses how SSO requirements can be complex due to a variety of user and application types and factors. It concludes by examining trends like the move to APIs and cloud/mobile and how users want more options, and provides examples of SSO challenges in different industries.

1. Single Sign-On (SSO): The Good, The
Bad & The Ugly
Steven C. Markey, MSIS, PMP, CISSP, CIPP/US , CISM, CISA, STS-EV, CCSK, Cloud +
Principal, nControl, LLC
Adjunct Professor

3. • Presentation Overview
– SSO
– Pros & Cons
– Where Do We Go From Here
– Examples
SSO: Good, Bad & Ugly

4. Source: Flickr

5. Source: Flickr

6. Source: Flickr

7. Source: Flickr

9. • SSO Standards & Categories:
– Network: LDAP, Kerberos, RADIUS, RDBMS
–e.g., OpenLDAP, AD, Tivoli Access Manager
– Federated: SAML, OpenID, OAuth, WS-Federated, XACML
–e.g., Keycloak, PingFederate, ADFS, RSA Federated
SSO: Good, Bad & Ugly

10. SSO: Good, Bad & Ugly
Source: Microsoft

11. SSO: Good, Bad & Ugly
Source: OASIS

12. SSO: Good, Bad & Ugly
Source: OASIS

14. • SSO Ownership:
– Business App Owners
– Ecosystem: Partners / Vendors / Regulators
– Centralized CIO / CISO
– Decentralized CIO / CISO
SSO: Good, Bad & Ugly

15. • SSO Implementation Pros & Cons:
– Pros:
–Consolidated & Centralized
–Uniform Standards & Reqs
–Cost Savings: Support, etc.
–Improved User Experience
– Cons:
–Large Effort
–Inflexible Requirements
–Vendor Reliance
–Single Point of Failure
–Coding & Rework
SSO: Good, Bad & Ugly
Source: TechTarget

16. • SSO Requirements = Ugly:
– Users:
–Internal / External
–Internal: Function, Role
–External: Customers / Partners
–On-site / Remote = Jurisdiction
– Applications:
–Thin / Thick
–Internal / External
–API / ERP / Office Automation / Cloud / Mobile / OLTP
–Old / New
–Prod / QA / UAT
SSO: Good, Bad & Ugly

17. • SSO Requirements = Ugly:
– Synchronization:
–Password
–User IDs
–Roles
–Profile
–Security Questions
SSO: Good, Bad & Ugly

19. SSO: Good, Bad & Ugly

20. • Where Do We Go From Here:
– Drive for Cost Savings
– Common Standards = Options
– Apps  Web APIs
• Legacy Apps Will Still Be Around
– Cloud & Mobile  SSO Requirements
• Blurring Work / Personal Differential
– Users Want Options
• Customers & Suppliers
• Self-service
SSO: Good, Bad & Ugly

24. • Examples:
– Financial Services
• ICE / NYSE: Multiple M&As, Large Portfolio of Apps
– Higher Education
• Traditional / Online: Vendor Reliance
– Healthcare
• HITECH / PPACA “Obamacare”: Digitizing Medical Records
SSO: Good, Bad & Ugly

25. • Questions?
• Contact
– Email: smarkey@ncontrolsec.com
– Twitter: @markes1
– LI: http://www.linkedin.com/in/smarkey