{"id":2660,"date":"2024-12-06T11:20:41","date_gmt":"2024-12-06T11:20:41","guid":{"rendered":"https:\/\/www.overtsoftware.id\/?p=2660"},"modified":"2024-12-06T11:20:44","modified_gmt":"2024-12-06T11:20:44","slug":"sso-in-action-real-world-business-case-studies","status":"publish","type":"post","link":"https:\/\/www.overtsoftware.id\/index.php\/sso-in-action-real-world-business-case-studies\/","title":{"rendered":"SSO in Action: Real World Business Case Studies"},"content":{"rendered":"

How Single Sign-on Helps You Outsmart Cybercriminals<\/span><\/span> <\/span><\/h3>\n

In general, when users are so overwhelmed by remembering passwords, users will start getting careless. This is why hackers despise single sign-on (SSO).<\/span> <\/span><\/p>\n

How? Single sign-on (SSO) removes the need for individual passwords for each account and replaces them with a single set of corporate credentials. Your users can sign in with one set of credentials to access all their applications and services. This not only enhances their experience and boosts productivity but also strengthens your security. <\/span> <\/span><\/p>\n

Since SSO enables a single login, it reduces the number of passwords your users have to manage. This effectively reduces your password-attack surface, decreasing the likelihood of a successful data breach.<\/span> <\/span><\/p>\n

The right SSO solution is simple to integrate and easy to administer, offering self-service capabilities that enable users to manage their access to enterprise data and applications, including resetting passwords. Furthermore, implementing single sign-on can decrease your IT and administrative costs.<\/span> <\/span><\/p>\n

How Password Resets Affect Your Finances<\/span><\/span> <\/span><\/h3>\n

According to a <\/span>report<\/span><\/span><\/a> sponsored by Yubico, the average user spends 10.9 hours annually on password resets. This results in an average productivity loss of $5.2 million per year for an organisation with 15,000 users, based on an average hourly rate of $32. While the Yubico report focused on end-users, the time investment extends beyond just them.<\/span> <\/span><\/p>\n

\"\"<\/span><\/p>\n

Is a Single Password Really Stronger than Multiple?<\/span><\/span> <\/span><\/h3>\n

As a thorough decision-maker, most people are wise enough to weigh your options. When considering whether to use SSO or not, you may question if having just one password is a good idea. If one password grants your users access, wouldn\u2019t it do the same for bad actors? Not necessarily, and there are a couple of reasons why.<\/span> <\/span><\/p>\n

Firstly, by only needing to create one password, your users are already practising one of the strongest and best password habits: avoiding password reuse. As discussed earlier, the more passwords you require, the more opportunities hackers have to exploit them. Additionally, users are more likely to create strong passwords when they only have to remember one instead of many.<\/span> <\/span><\/p>\n

However, a discussion about SSO shouldn\u2019t end with passwords. An enterprise SSO solution should enable you to easily add additional security measures beyond passwords alone. For example, it should allow you to limit access based on user attributes (ABAC) and require extra authentication methods based on risk.<\/span> <\/span><\/p>\n

A contextual MFA solution combined with SSO allows you to apply authentication policies based on context, such as the risk of the action being taken or the sensitivity of the resource being accessed. You can use ABAC policies or variables like IP address and web session attributes to further ensure users are who they claim to be before approving certain actions or access.<\/span> <\/span><\/p>\n

Lessons from the Field: The Risks of Poor Password Management<\/span><\/span> <\/span><\/h3>\n

Understanding the consequences of poor password management is essential for businesses aiming to enhance their cybersecurity. Here, we present real-world case studies demonstrating the potential dangers of weak password practices.<\/span> <\/span><\/p>\n

1.Norton LifeLock Breach<\/span><\/span> <\/span><\/h4>\n

In December 2022, Norton LifeLock, a cybersecurity company specialising in antivirus software and identity theft protection, experienced a significant <\/span>data breach<\/span><\/span><\/a> affecting over 6,000 customer accounts. The breach was the result of a credential stuffing attack, where attackers use lists of previously exposed usernames and passwords to gain unauthorised access to accounts on other platforms.<\/span> <\/span><\/p>\n

The breach was first detected on 12 December 2022, when Norton LifeLock’s intrusion detection systems noticed an unusually high volume of failed login attempts, indicating a credential stuffing attack. The investigation traced the attack back to 1 December 2022, when an unauthorised third party began using credentials obtained from the dark web to attempt logins on Norton customer accounts.<\/span> <\/span><\/p>\n