CISSP GLOSSARY · IDENTITY & ACCESS MANAGEMENT
Single Sign-On (SSO)
Authenticate once, then access multiple systems without re-entering credentials. Improves usability and centralises control, but a compromised session unlocks everything at once.
Single Sign-On lets a user authenticate once and then reach many systems without logging in again. Kerberos is the classic on-premises implementation: the TGT obtained at logon is silently exchanged for service tickets as the user moves between resources. Federated protocols such as SAML and OpenID Connect extend the same idea across organisational boundaries.
The exam wants the trade-off, not just the definition. Benefits: fewer passwords to manage and forget, less password fatigue leading to fewer weak or reused passwords, centralised enforcement of authentication policy, and one place to disable a departing user. Costs: the SSO credential becomes the keys to the kingdom, so a stolen session or ticket, as in pass-the-ticket, unlocks every connected system, and the identity provider becomes a single point of failure for access to everything.
Exam relevance: SSO questions usually test judgement. Strengthening the single authentication event with multifactor authentication is the standard compensation for the concentrated risk. If a scenario emphasises “one compromised credential granted access to many applications”, it is testing whether you recognise the inherent SSO trade-off rather than a protocol flaw.