From an end user’s perspective, single sign-on (SSO) is a great idea. You log into one platform, then get access to multiple applications, programs and sites. No need to log into each one individually. It’s convenient, quick, and hassle free. But for IT, SSO brings security risks.

Each individual Windows login is like a troop on the frontline, defending access to the network. The stronger your passwords and access security controls, the stronger that front line will stand against attacks.

But once you implement single sign-on, you lower the number of troops on the front line. So what’s left is extremely vulnerable.

If a breach happens, attackers will have access to huge amounts of data in your Active Directory network. They've got the keys to the kingdom.

And all it takes for a breach to occur is bad user behaviour (like password sharing or unlocked workstations), exploited users (through phishing) or malicious users stealing colleague’s credentials.

Gartner financial fraud analyst Avivah Litan is spot on in this Krebs on Security article, arguing that using cloud-based single sign-on services is the digital equivalent to an organisation putting all of its eggs in one basket.

Litan goes on to explain:

“It’s just such a massive single point of failure. And this breach shows that other [cloud-based single sign-on] services are vulnerable, too.

This is a big deal and it’s disruptive for victim customers, because they have to now change the inner guts of their authentication systems and there’s a lot of employee inconvenience while that’s going on.”

It goes without saying: If your organization is effectively "putting all your eggs in one basket," you'd best make damn sure you protect that basket.