Why your cloud app should be SAML-enabled - April 2016

Why your cloud app should be SAML-enabled
April 2016, Cyber Security

By David Meyer, VP of product at OneLogin.

For many companies, SSO (Single Sign-On) and MFA (Multifactor Authentication) have gone from being ‘nice extras’ to ‘must-haves’. If you haven’t already lost business because your application doesn’t support these features, chances are good that you soon will.

David Meyer, VP of product at OneLogin.

In many regulated industries such as healthcare and legal, identity management and SSO are mandated and other industries, such as high tech, that place a high value on efficiency and business integrity, simply won’t use a product that doesn’t support SAML (Security Assertion Markup Language).

Doug Meier, the director of security and compliance at Pandora says, “Identity management SSO is so crucial to Pandora that if a prospective cloud app vendor doesn’t have a SAML-connector for its SSO system – which happens about 30 percent of the time – the company will walk away.”

Other companies may not require SAML, but without a doubt, they sure would love to have the features SAML provides. One of the top feature requests for HipChat, with 2768 votes is SAML. Commenters are begging for SSO because the ease would increase app usage by employees, while others reveal they have given up the app after three years of unmet requests and have turned to a competitor.

Implementing SSO and MFA is time consuming

Getting it wrong can be disastrous: just like with any other crucial technology decision, choosing a solution that turns out to be difficult to maintain or doesn’t hold up over time can be a major setback in time and money.

Therefore, your focus should be on finding a solution that is hassle-free and long lasting. Managing federation with a slew of different providers or rolling your own MFA adds a significant amount of technical debt.

For early to mid-stage startups, simply rolling out SAML enables organisations using an identity management system such as OneLogin, to layer MFA before authentication happens via SAML, effectively increasing the security of your application, with no work on your part. Add a line like this to your FAQs: “We support multi-factor authentication through our cloud IAM partners,” and call it a day.

SAML is hassle-free and long lasting

SAML is easy because it doesn’t take a lot of time and money to implement. SAML is an XML-based, open-standard data format for exchanging authentication and authorisation data between parties, in particular, between an identity provider and a cloud application. It’s true that SAML used to be a huge and complex investment to enable. However, now you can enable SAML in as little as two hours. Learn how to enable SAML at www.onelogin.com/resources/saml-toolkits.

And SAML is safe because it is an industry standard that has been around since 2002 and is used by thousands of applications and all the leading IAM vendors. It isn’t going to disappear any time soon or be replaced by some new flavour-of-the-day that comes along.

Add value (that you can charge for)

By enabling SAML, you’re increasing the value of your app through all the benefits SAML provides: SSO, better usability, speed, and phishing prevention. You can enable SAML on your higher cost plans, such as an enterprise plan, and be reimbursed for the value you added.

Improve your application’s security profile

By using SAML to authenticate an identity instead of passing a username and password, it can decrease your vulnerability to several attacks:

• Completely eliminates the phishing attack vector. The user doesn’t even have a password that they could enter and they won’t ever see a login screen.

• Users often reuse passwords between sites. If another site is compromised and the passwords leaked, they won’t be able to be used on your application.

• Password resets can be used to compromise an application if a user’s email account has been hacked. With SSO there is no password to reset (and no users sending frustrated e-mails that they can’t login).

If your application is easy to use and automatically provisioned for employees, the likelihood that they will use it increases significantly. For many applications, the hassle of trying to remember the password or ask a co-worker to ‘add you to the account’ slows adoption.

Being an industry-standard not only makes SAML safe, but also improves your credibility – because when you follow the industry standard, you prove to potential customers that you know what you’re doing.

OneLogin offers free open-source SAML toolkits ( www.samltool.com) in five different web development platforms: .Net, Java, PHP, Python, and Ruby.

Further reading:

Email is the weak link
July 2017, This Week's Editor's Pick, Cyber Security, Security Services & Risk Management
Email remains any firm’s most important business tool and 43-trillion emails are sent annually The problem with email is that it was not designed to be secure.
Biggest threat to industrial systems
July 2017, This Week's Editor's Pick, Cyber Security, Security Services & Risk Management, Industrial (Industry)
The biggest threat to industrial control systems since Stuxnet is Industroyer, a sophisticated and extremely dangerous malware designed to disrupt critical industrial processes.
Cybersecurity for access control
July 2017, This Week's Editor's Pick, Access Control & Identity Management, Cyber Security, Asset Management, EAS, RFID
Farpointe provides cybersecurity vulnerability checklist for contactless cards and readers.
Can you survive a cyber attack?
July 2017, ContinuitySA, Cyber Security, Security Services & Risk Management
The Cyber Resilience Framework provides a comprehensive, flexible structure to ensure organisations can survive cyber attacks.
Don’t ignore the mobile threat
July 2017, Cyber Security
50% of all mobile and tablet devices are not protected against cybercrime and malicious threats, that equates to about 40 million entry points into corporations and company networks.
Data governance and the security industry
June 2017, Technews Publishing, Cyber Security, IT infrastructure, Security Services & Risk Management
So how does all the talk about data governance and data protection impact the security industry? Or does it?
Physical security is from Mars, IT is from Venus
June 2017, Axis Communications SA, Cyber Security
The days of separating physical and digital security are over. Today we need a collaborative approach to succeed in preventing and/or dealing with cyber attacks.
Card fraud stats 2016
June 2017, This Week's Editor's Pick, Cyber Security, News, Security Services & Risk Management
Credit card fraud increased by 13% from R331.4m in 2015 to R374.4m in 2016, with debit card fraud increasing by 3.1% for the same period.
Hikvision and Cisco collaborate on cybersecurity
June 2017, Hikvision South Africa, This Week's Editor's Pick, CCTV, Surveillance & Remote Monitoring, Cyber Security, News
Cisco is sharing its professional cybersecurity management experience and technologies with Hikvision, facilitating Hikvision’s globalisation process.
Cyber-attacks to the left, ransomware to the right
June 2017, This Week's Editor's Pick, Cyber Security, News
We all need to be agile and responsive to the new unknowns; here are some tips for preventing future nasties like WannaCry and Petya.
Trusted Platform Module explained
May 2017, Bosch Security Systems, This Week's Editor's Pick, CCTV, Surveillance & Remote Monitoring, Cyber Security
Bosch IP cameras, encoders and selected storage systems have an onboard security chip – actually a system-on-a-chip called the Trusted Platform Module – that provides functionality similar to crypto smartcards.
Procore Trading
Securex 2017 preview, Cyber Security
Procore Trading’s Intimus 9000 Degausser uses most modern APT technology to erase information from hard drives. The Intimus 9000 produces an erasing field many times stronger than those produced by the ...