**Single Sign-On Security: Are You Leaving a Backdoor to Your Network?**
A recent breach at the University of Pennsylvania highlights a critical security risk that many organizations may be overlooking: the protection of their single sign-on (SSO) credentials. In this attack, hackers compromised a PennKey SSO account and used it to access internal systems, including VPN, Salesforce, Qlik, SAP, and SharePoint, resulting in the theft of data on 1.2 million individuals.
While SSO simplifies access by allowing users to log into multiple systems with one set of credentials, this convenience can also concentrate risk if not properly secured. When configured and protected correctly, SSO can actually improve security by reducing password sprawl, centralizing access policies, and making it easier to enforce multi-factor authentication (MFA). However, organizations must treat their SSO login as a critical security control, providing robust protection against modern credential attacks.
To determine if your SSO login is secure enough, you need to look beyond whether it’s switched on and focus on how it’s protected. Start by ensuring that your SSO passwords are strong and follow the latest guidance from NIST, which emphasizes length and usability alongside screening for weak or compromised passwords. For scenarios where single-factor passwords are still acceptable, NIST recommends at least 15 characters. When used alongside MFA, passwords should be at least eight characters long, with systems allowing users to create passwords up to 64 characters.
It’s also essential to avoid legacy password rules that can push users toward predictable patterns. Mandatory complexity requirements and routine password resets can lead to users changing one digit or adding a symbol at the end of their password, making it easier for hackers to guess. To prevent this, NIST advises against these outdated practices.
Implementing strong passwords is just the first step in securing your SSO login. Adding MFA is also crucial, but organizations must ensure that it can stand up to modern attacks. Infostealers have made it easier than ever for attackers to scrape passwords and other authentication information, and even passwords that meet regulatory requirements appear regularly in these logs. To combat this, organizations should move toward phishing-resistant methods such as FIDO2 security keys, WebAuthn, or passkeys, especially for privileged users and access to sensitive systems.
Finally, it’s essential to secure the assets behind your SSO login, including IdP administrator accounts. These accounts can change authentication policies, add applications, add and reset users, and approve integrations, making them a prime target for hackers. Protect these accounts with phishing-resistant MFA, separate admin accounts, just-in-time access, and strict access controls.
In conclusion, securing your SSO login is not a one-size-fits-all solution. It requires a multifaceted approach that includes strong passwords, robust MFA, and protection of the assets behind the SSO login. By following these best practices, organizations can reduce their risk of credential-based attacks and protect their network from modern threats.
Source: Bleeping Computer — 2026-07-28