Is Your SSO Protected Against Modern Credential Attacks?

Single sign on (SSO) simplifies access by letting users log into multiple systems with one set of credentials. While this delivers clear benefits to the authentication process, that convenience can also concentrate risk, as the 2025 University of Pennsylvania breach showed.

According to reports, attackers compromised a PennKey SSO account and used that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint. The attack also resulted in the theft of data on 1.2 million individuals.

That does not mean SSO is insecure. When it is configured and protected properly, SSO can improve security by reducing password sprawl, centralizing access policies, and making it easier to enforce multi-factor authentication (MFA).

However, organizations can only enjoy those benefits when SSO is treated as a critical security control. If one login opens the door to multiple systems, that login needs robust protection.

So, is your SSO login protected enough? To answer that, organizations need to look beyond whether SSO is switched on, and focus on how it is secured.

Start with strong SSO passwords

‘Implement strong passwords’ isn’t new advice, but it is especially crucial if one credential can unlock multiple systems. However, strong doesn’t have to mean frustrating; after all, SSO is designed to reduce friction during authentication.

The latest guidance from NIST puts the emphasis on length and usability, alongside screening for weak or compromised passwords. For scenarios where single-factor passwords are still acceptable, NIST recommends at least 15 characters.

Passwords used alongside MFA must be at least eight characters, and systems should allow users to create passwords up to 64 characters. NIST also says organizations should check new passwords against blocklists of commonly used, expected, or previously compromised passwords.

Just as importantly, NIST advises against some legacy password rules that still appear in many organizations. Mandatory complexity requirements and routine password resets can push users toward predictable patterns, such as changing one digit or adding a symbol at the end.

... continue reading