Shadow SSO

What Is Shadow SSO?

Shadow SSO definition and explanation.

Shadow SSO describes a phenomenon whereby single sign-on methods are used to access applications and services without oversight by either IT or compliance teams. This largely happens when employees, to log into work-related services, use personal identity providers, including their private Google or Microsoft accounts. While SSO reduces password management issues, it can create significant visibility gaps because these accounts may remain unmonitored by the organization's IT department.

Relation to Shadow IT

Shadow SSO is a very important subset of Shadow IT. It carries along similar risks of unauthorized use of applications and services within an organization but adds an additional layer of complexity because of the possible invisibility of access. Employees linking corporate activities to personal identity providers further make it impossible for IT teams to track and secure those accounts, leaving them with open gaps in compliance and security.

Unique Shadow SSO Risks

• Visibility Gaps: The use of personal SSO accounts to access work-related services means that IT teams lose visibility into applications that are being accessed and by whom.
• Unmonitored Identity Providers: Most Shadow SSO is done through the use of unmonitored identity providers in unauthorized applications, which creates security and compliance concerns.
• Compliance Violations: Most Shadow SSO services do not meet compliance obligations for data protection and security, with resultant regulatory risk to the organization.

Managing Shadow SSO

This requires an extension of Shadow IT monitoring capabilities to include SSO activities. Tools such as Scirge will identify where corporate credentials or unmanaged identity providers are used to access third-party applications. IT teams can ensure all SSO activities become aligned with corporate policy, reducing the attack surface and improving compliance.