How to Harden SSO Against Modern Credential Attacks
Summary
This sponsored guide recommends strengthening SSO with robust passwords, consistently enforced phishing-resistant MFA, protected identity-provider accounts and keys, managed app credentials, and tighter controls on delegated permissions.
Key points
- The article says reports linked the 2025 University of Pennsylvania breach to a compromised PennKey SSO account, which attackers used to access internal systems; it reports data theft affecting 1.2 million individuals.
- The guide cites NIST guidance: passwords should be at least 15 characters for single-factor use, at least eight when used with MFA, and systems should allow passwords up to 64 characters and check them against blocklists.
- Enforce MFA consistently across users, applications, and access scenarios; prefer phishing-resistant methods such as FIDO2 security keys, WebAuthn, or passkeys, especially for administrators and sensitive systems.
- Protect identity-provider administrator accounts with phishing-resistant MFA, separate admin accounts, just-in-time access, and close monitoring.
- Restrict access to SAML certificates and token-signing keys, alert on changes, and rotate certificates before expiry; store OAuth secrets and credentials securely and rotate them regularly.
- Restrict user consent to third-party apps, require administrator approval for sensitive permissions, and remove stale or excessive delegated grants.
Article Details
- Defense Focus
- Harden SSO against credential compromise and misuse by strengthening passwords and MFA, protecting identity-provider assets, and limiting long-lived delegated access.
- Detection Methods
- Closely monitor identity-provider administrator accounts and alert on changes to authentication policies, applications, users, or integrations.
- Alert on changes to SAML certificates and token-signing keys.
- Review app registrations for excessive permissions and review consent grants and delegated permissions for stale or overprivileged access.
- Data Sources
- SSO and identity-provider authentication activity
- Identity-provider administrator activity and policy changes
- SAML certificate and token-signing key changes
- App registrations, permissions, consent grants, and delegated permissions
- Platforms
- Identity providers
- SSO-connected SaaS applications
- Windows logon, RDP, and VPN authentication
- Defensive Actions
- Use passwords of at least 15 characters where single-factor passwords are accepted; allow passwords up to 64 characters and check new passwords against blocklists of common, expected, or compromised passwords.
- Avoid mandatory password complexity rules and routine password resets.
- Enforce MFA consistently across users, applications, and access scenarios; prefer phishing-resistant FIDO2 security keys, WebAuthn, or passkeys, especially for privileged users and sensitive systems.
- Protect identity-provider administrator accounts with phishing-resistant MFA, separate admin accounts, just-in-time access, and close monitoring.
- Restrict access to signing certificates and keys, alert on changes, and rotate certificates before they expire.
- Store OAuth client secrets, app credentials, and refresh tokens in a secrets vault and rotate them regularly.
- Restrict user consent, require administrator approval for sensitive permissions, and remove stale or overprivileged grants.
MITRE ATT&CK
Vendors
Products
Microsoft SharePointAccording to reports, attackers compromised a PennKey SSO account and used that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint.QlikAccording to reports, attackers compromised a PennKey SSO account and used that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint.SalesforceAccording to reports, attackers compromised a PennKey SSO account and used that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint.SAPAccording to reports, attackers compromised a PennKey SSO account and used that access to reach internal systems including VPN, Salesforce, Qlik, SAP, and SharePoint.Specops Password PolicySpecops helps here with Specops Password Policy, helping organizations simplify policy management and continuously block over 6 billion unique compromised passwords.Specops Secure AccessSolutions like Specops Secure Access help organizations defend against password attacks and includes support for SSO for SaaS applications via OIDC and SAML.