A Single Sign-On (SSO) Breach Awaits: Are Your Credentials Protected Against Modern Attacks?
The convenience of single sign-on (SSO) comes at a cost. While it simplifies access to multiple systems with one set of credentials, this very convenience can concentrate risk. The 2025 University of Pennsylvania breach serves as a stark reminder that when SSO is configured and protected poorly, the consequences can be catastrophic. Attackers compromised a PennKey SSO account, using that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint, resulting in the theft of data on 1.2 million individuals.
SSO can actually improve security when done correctly. By reducing password sprawl, centralizing access policies, and making it easier to enforce multi-factor authentication (MFA), SSO can be a valuable asset for organizations. However, this only holds true if one login is treated as a critical security control, requiring robust protection.
To determine whether your SSO login is protected enough, you need to look beyond whether SSO is switched on and focus on how it is secured. This involves implementing strong passwords that are both long and usable. According to the latest guidance from NIST, for scenarios where single-factor passwords are still acceptable, at least 15 characters are recommended. When MFA is in place, passwords should be at least eight characters, with systems allowing users to create passwords up to 64 characters.
Moreover, NIST advises against legacy password rules that can push users toward predictable patterns. Mandatory complexity requirements and routine password resets can lead to users changing one digit or adding a symbol at the end of their password, defeating the purpose of strong passwords. By following this guidance, organizations can reduce the risk of stolen credentials being used in attacks.
In addition to secure passwords, MFA is essential for protecting against modern credential attacks. However, just enabling MFA on a handful of “high-risk” accounts or using weak methods like SMS codes and basic one-time passwords won’t suffice. Organizations should move toward phishing-resistant methods such as FIDO2 security keys, WebAuthn, or passkeys, especially for privileged users and access to sensitive systems.
The final layer of protection is securing the assets behind SSO and controlling how identity is issued, trusted, and delegated. This includes protecting IdP administrator accounts with separate admin accounts, just-in-time access, and phishing-resistant MFA.
In conclusion, while SSO can be a valuable asset for organizations when configured and protected properly, it also concentrates risk if not treated as a critical security control. By implementing strong passwords, secure MFA, and securing the assets behind SSO, organizations can reduce the risk of credential attacks and protect sensitive systems.
Source: Bleeping Computer — 2026-07-28