While we’ve talked often about multi-factor authentication and its many benefits, many enterprise applications and consumer products are turning to something else: single sign-on. The convenience is hard to ignore, and in theory, it can help increase security on your accounts.
What is Single Sign-On?
Single sign-on (SSO) is a method of logging in where you enter your credentials in one place, and that grants you access to other systems and software. If you’ve ever clicked “log in using Google/Facebook/Salesforce,” you’re utilizing single sign-on.
Functionally, what’s happening is you are using the same set of credentials to log in to each application. Rather than entering your username and password into each website or software service separately, that portion is handled by the original source telling the new place “it’s okay, they logged in with me first.” The trusted third party is providing the assurance that the person logging in is who they claim to be.
If you think there are some obvious potential issues with SSO, you’d be right – which is why there are few services that act as SSO providers. Most trusted SSO sources are those that can have at least two-factor authentication enabled, such as Google or Salesforce. Others are those used for convenience, and grant access to websites or services that are more consumer-facing, such as Facebook and Twitter.
The security of single sign-on is entirely dependent on how strong the original set of credentials are. If your users are using SSO, and their passwords are all some variant of “password”, then SSO is unlikely to be very secure. If your Facebook account gets hacked, for example, the hacker gains access to all websites where you’ve used Facebook to log in.
Single Sign-On vs Multi-Factor Authentication
Trying to compare single sign-on to multi-factor authentication as an either-or choice isn’t a fair comparison.
With single sign-on, convenience reigns supreme, allowing users to easily access multiple applications without taking time to set up passwords for each one. SSO reduces the need for credentials for each application, and thus reduces the number of potential accounts that your IT team may need to support password resets for. The Achilles heel for SSO is that the security of all systems is reliant on the strength of the original login credentials; if you choose poorly, then multiple accounts are at risk of being compromised.
Meanwhile, multi-factor authentication is quite secure, particularly when using multiple factors. Even if a password gets compromised, requiring one or two additional forms of authentication makes the risk of unauthorized access quite low. It also increases the difficulty of stealing credentials dramatically, requiring matching stolen passwords to additional knowledge-based questions, physical tokens, or spoofing biometrics to gain access. When using biometrics as one of your authentication factors, phishing or credential theft becomes nearly impossible.
So which is better? Convenience, or security?
It doesn’t have to be one or the other.
The Best of Both Worlds
By combining the two login methods, your organization can have the best of both. The credentials that grant access to your internal applications can have a high bar of authentication by requiring multiple factors. Once a user has authenticated securely, they can then use the same credentials to securely log in to all company applications.
This method of combining the two minimizes any potential friction incurred through the use of multiple authentication factors. You can heighten security to gain initial access, then let that initial highly secure access provide secure identity assurance throughout your system. It’s like a more secure version of having a guard at the gate of your castle – only the castle can be a remote network where the only way people can get in is through multiple factors of authentication.
Even better than adding multiple authentication factors to your username and password login flow is to eliminate the need for passwords altogether.
By deploying Q5id within your organization, you can eliminate passwords. When your users first enroll, they spend a few minutes verifying their identity in a highly secure way. This single source of identity can then be used to grant access throughout your organization, and without passwords. Instead, your users can use one or both palms, or a face scan, to verify that they are the correct person and gain access to applications or software.
More secure, more accurate, and incredibly easy to use. To talk to us about how Q5id could be used to improve access security in your organization, you can reach us at contact@q5id.com.
Learn more about Account Fraud Security
Employee and customer accounts hold a treasure trove of sensitive data that is highly desirable to bad actors. How is your organization protecting itself against fraudulent access?
Learn how industry leaders are handling account fraud security in 2021 and with the challenges posed by COVID-19 and a remote workforce.
Get Report Here
