Single sign-on reduces headaches, costs at PTO

One industry analyst hails it as the "Holy Grail of many organizations."It's single sign-on.The idea is simple. SSO systems let users access scores of applications through a single user identification and password. Once signed on, a user just points and clicks across a customized desktop to access authorized applications.SSO is just the ticket for large organizations, said Robert Lancaster, a senior analyst with the Yankee Group of Boston.SSO systems are "particularly applicable to enterprise-scale or distributed organizations that have large numbers of applications and end users," Lancaster noted in a recent report.For IT officials at the Patent and Trademark Office, which has deployed SSO software from Computer Associates International Inc., the benefits are palpable.It's a great convenience for PTO's busiest users, mostly patent examiners and attorneys who have to access as many as 30 applications in the course of their daily work, said Larry Cogut, director of PTO's System Architecture and Engineering Office.It means no more Post-It notes hidden under keyboards or in desk drawers'reducing security risks. And it mitigates password headaches and lessens costs for the help desk."We don't have the myriad calls to the help desk for problems with people forgetting their sign-on for individual applications or forgetting how to do it," Cogut said.As a result, the agency's specialists are more productive, he added.It's easy to see how multiple sign-ons can create help desk havoc.If each user in a large organization has a password problem just once a year, "it quickly becomes clear how help desk costs can mount up," Lancaster said.For large enterprises needing multiple access levels, access management "becomes a huge undertaking, requiring teams of administrators and the commitment of hundreds of man-hours per year to reset user passwords alone," he said.About 6,000 PTO workers now use CA's eTrust Single Sign-On software, which runs on the agency's network under Microsoft Windows NT. The agency began a pilot of the application about four years ago and has been phasing it in ever since. PTO currently is using an early version of the software but IT officials are preparing to upgrade to the latest release, Version 6.5."We are testing the latest version in our lab," said Dave Page, a PTO computer specialist on the system architecture and engineering staff. "We haven't deployed it yet."Another advantage is that SSO gives systems managers centralized control over security administration.With CA's eTrust, for example, systems administrators can manage users' IDs, application dialogs and access paths from a single point.Centralizing access also makes life easier for software developers at the agency."Our systems developers were used to having to coordinate heavily to make sure that the sign-on was established properly for every one of their new releases," Cogut said.Now developers simply hand off the code to the system architecture and engineering team, which then develops the scripting needed to deploy single sign-on on the new version."We're a single shop now for all of the new versioning of software that has SSO," Cogut said. "We think we get a much smoother and integrated development that way," he said.There is one gray cloud hanging over SSO: It offers the potential of one-stop snooping by hackers.A compromised password gives a hacker access to any and all applications to which the password holder is authorized.But Simon Perry, vice president for security strategies at CA, dismisses what he called "the whole argument about one point of vulnerability for hackers.""You've got to trade that point off with the real world," he said. "In the hypothetical environment, where you've got six passwords and six sets of credentials, the hackers have to get all six to access all of the systems. But in the real world, if I give someone six passwords and six sets of credentials, they would weaken them anyway. They would write them down or synchronize them.""Passwords in the lab are fine," Perry added. "It's when you give them to people that it's a problem."But there's a flip side that enhances security when using an SSO, he said. "If you suspected that a hacker got control of it, you only have one credential that you need to disable and the hacker is completely kept out," Perry said.One way for organizations to ease concerns about SSO vulnerability is to impose stronger authentication methods, such as a public-key infrastructure, on the front end.But most organizations are looking at implementing stronger authentication systems "regardless of whether SSO is there or not," he said.At PTO, whose system cost about $2 million, officials are satisfied that systems security is stronger than before they deployed single sign-ons because users only have to keep track of one password. But Page noted one potential risk involving users: "We're depending on the user not to leave his workstation open when he walks away from his desk or has a session open because somebody else could come in, sit down and start calling up applications without having to enter a password."In the end, SSO systems have to be seen simply as a component in a security infrastructure, Lancaster said."A misconception by enterprises is that these applications are designed as security mechanisms," he said."In reality, SSO focuses on driving corporate efficiency and increasing employee productivity, while it may represent a single component of a much larger security infrastructure."