Side Bars

Executive Summary: Single Sign-On Security Traditional SSO Case Study: Duke Energy Reduces Inefficiencies in User ID Management Web SSO Case Study: Quantum Corp. Moves Toward a Single Web Experience for Customers and Employees

Related Links

Guarding The Flank With RADIUS & TACACS+, Workshops, February 1, 1998 RFP: Security Services, Features, April 1, 1998 "Missing Links: Authentication and Single Sign-On", Features, February 22, 1999

Company Directory

Browse our directory to get data, starting with a particular company.

Reader Service

Allows you to request additional product information from our advertisers.

Print The Full Article

ClickHere

E-mail this URL

ClickHere

Buy the Book

Keyword Search:

		our customizable newsletter, sends you security alerts, product updates and software patches on the products you use. Sign up now at www.networkcomputing.com /express/

While password reduction was the original goal of SSO, other forms of user authentication now in use, such as PKI certificates, smartcards, tokens and biometrics, may also form part of a contemporary SSO solution. But user ID is not the primary function of an SSO solution. Indeed, an SSO solution may rely on completely separate authentication mechanisms. What distinguishes a single sign-on solution is that the user authenticates his or her identity once, and thereafter is transparently granted access to a variety of permitted resources with no further identification required.

Security Is More Than SSO
SSO traditionally has been considered a security technology. In particular, it addresses one or both of two primary security subdisciplines, authentication and authorization. Authentication is the process by which the system verifies the user's identity, while authorization determines what that user is allowed to do (traditionally based on role in the organization). Most SSO approaches simply centralize authentication. Authorization typically continues to be managed on the target resources, though some sophisticated SSO solutions centralize the authorization process. An in-between approach to authorization is taken by centralized "security administration" products, which centralize the administration of user privileges but leave the actual authorization process to target resources. Simply centralizing security administration does not reduce user sign-on complexity, but such solutions are increasingly becoming integrated with available SSO products.

There is, of course, more to security than just SSO and centralized security administration. Today, firewalls, virtual private networks (VPNs), file encryption, hardened operating systems and other technologies can operate independent of an SSO or security administration solution. Over time, many of these technologies will become more user-specific and will be candidates for tighter integration with SSO solutions. For example, rather than just allowing specific kinds of services to reach specific IP addresses, firewalls will rely on additional information about the user attempting the connection. Also, as VPNs become prevalent, it will become common to be a member of more than one VPN (for instance, a corporate VPN and an industry-specific community-of-interest VPN). Validation of user identity and VPN membership will be expected to occur transparently (meaning there's some form of SSO solution in the background).