4.3.3. Multifactor Authentication and Single Sign-On
💡 First Principle: Single-factor authentication (just a password) fails when the password is compromised. MFA requires attackers to compromise multiple independent factors—a fundamentally harder problem. SSO reduces the number of passwords while maintaining security through centralized authentication.
MFA Factor Categories
| Category | Examples | Resistance To |
|---|---|---|
| Something you know | Password, PIN, security question | Phishing, keylogging (can be stolen remotely) |
| Something you have | Hardware token, smart card, authenticator app, SMS code | Requires physical possession |
| Something you are | Fingerprint, retina scan, facial recognition | Biometric-level assurance |
Effective MFA requires factors from at least two different categories. Two passwords = two "something you know" factors = still single-factor authentication from a security standpoint.
Common MFA Implementations
- Hardware token (TOTP): Small device that generates time-based one-time passwords (Google Authenticator uses the same algorithm). Extremely secure—code expires in 30 seconds.
- Smart card + PIN: The card is "something you have"; the PIN is "something you know." Common for government and high-security environments.
- Authenticator app: Software TOTP on a smartphone. More convenient than hardware tokens; slightly less secure if the phone is compromised.
- SMS OTP: One-time password sent by text message. Weakest MFA option—vulnerable to SIM swapping attacks, but still significantly better than password-only.
Single Sign-On (SSO)
SSO allows users to authenticate once and access multiple systems without re-entering credentials. Benefits:
- Fewer passwords = better password hygiene (users are more willing to use strong passwords when they only need one)
- Centralized authentication = single place to revoke access when an employee leaves
- Improved user experience = less friction
SSO relies on protocols like Kerberos (the mechanism behind Active Directory SSO), LDAP (the directory it queries), or SAML/OAuth for web and cloud services.
⚠️ Exam Trap: RADIUS is not an SSO protocol. It is a centralised AAA protocol (authentication, authorisation, accounting) for network access — VPN, 802.1X, wireless. Both RADIUS and SSO give you centralised authentication, which is why they get conflated, but RADIUS authenticates you onto the network and re-authenticates per service; SSO authenticates you once and then vouches for you to other applications. If a question says "network access" or "802.1X", think RADIUS; if it says "log in once, reach many apps", think Kerberos/SAML.
The Revocation Advantage of SSO
When an employee leaves, disabling their SSO account immediately revokes access to all connected systems. Without SSO, admins must manually disable accounts in each system—missing one creates a continued access path.
⚠️ Exam Trap: SSO reduces the number of passwords but increases the impact of a single compromise. If an SSO credential is stolen, the attacker gains access to everything that credential is authorized for. This is why SSO must always be combined with MFA—SSO + MFA provides both convenience and security.
Reflection Question: An organization uses SSO with RADIUS for all server access. An employee's account is compromised. What is the security advantage of SSO in this scenario, and what additional control would have made the breach harder to achieve?
