A manufacturing group is consolidating thirty business applications behind a single sign-on platform. The CISO is briefing the steering committee on the security trade-offs of SSO and must explain the principal risk the programme introduces, so that the committee approves the corresponding compensating control. Which risk should the CISO emphasise as the most material?
- ASSO removes the user's ability to choose distinct passwords per application, which weakens entropy across the estate and increases the effectiveness of offline cracking.
- BSSO requires SAML or OIDC libraries on each relying party, and historical vulnerabilities in those libraries have led to assertion forgery attacks.
- CSSO centralises audit logs at the identity provider, making the IdP a single point of failure for forensic evidence if its log store is tampered with.
- DSSO concentrates authentication assurance on a single credential, so compromise of that credential or its session gives the attacker access to every federated application. Correct
Why A is wrong: Per-application password entropy is a weak argument because users tend to reuse passwords anyway; the structural risk of SSO is concentration of trust, not loss of per-app entropy.
Why B is wrong: Library vulnerabilities are real but are an implementation risk addressed by patch management; they are not the principal architectural risk the committee needs to weigh against the benefits of SSO.
Why C is wrong: Centralised logging is a benefit more than a risk and is straightforward to address with log forwarding and integrity controls; it is not the dominant risk a CISO should highlight.
Why D is correct: The defining risk of SSO is exactly this concentration of authentication into one credential and one session, which is why strong MFA, short session lifetimes, and risk-based step-up are mandatory compensating controls for any SSO rollout.