Why SMBs Don't Deploy SSO
Small and medium-sized businesses (SMBs) hesitate to deploy Single Sign-On (SSO) due to perceived lack of operational benefits compared to costs. Encouragement for free essential security features and simplifying SSO adoption processes is highlighted.
Read original article
The article discusses the reasons why small and medium-sized businesses (SMBs) often do not deploy Single Sign-On (SSO) solutions. It highlights that while SSO can enhance security posture, some SMBs perceive it as not delivering significant operational improvements for the cost involved. The piece emphasizes the importance of making essential security features, like SSO, readily available without additional fees to promote better security practices. It also points out barriers to SSO adoption, such as the perceived complexity of implementation, lack of technical expertise, and challenges with support materials. The report suggests that SMBs often opt for manual password management due to lower initial costs, despite the hidden administrative expenses associated with this approach. To increase SSO adoption among SMBs, manufacturers are encouraged to address these challenges by simplifying product design, improving user experience, and providing clearer technical guidelines. The ultimate goal is to enhance security and safety for SMBs by promoting the adoption of SSO solutions.
Related
Simple ways to find exposed sensitive information
Various methods to find exposed sensitive information are discussed, including search engine dorking, Github searches, and PublicWWW for hardcoded API keys. Risks of misconfigured AWS S3 buckets are highlighted, stressing data confidentiality.
SSH as a Sudo Replacement
Using SSH instead of sudo, the article addresses limitations of setuid binaries for privilege escalation. It details configuring s6-sudod to allow authorized users root access securely, emphasizing OpenSSH's security features.
BeyondCorp (2014)
Google's BeyondCorp approach rethinks enterprise security by moving away from traditional perimeter security to enhance protection in the changing tech environment. Visit the link for more details on this innovative strategy.
12 comments- Positioning: it’s seen as an enterprise product so attracts enterprise pricing
- Support: it’s genuinely a high touch feature which lots of customers fuck up all the time in the same way and always needs support and engineering help.
Documentation for those issues? We have it, it doesn’t stop the support requests coming in. I was looking at a request this morning where the error message is coming from Azure itself and clearly says “this is not configured correctly.” The request hasn’t even reached our systems yet!
Until SSO is as plug n play for users as Google Sign-in, SSO will continue to attract a high price point. And I’ll continue to push back on attempts internally to democratise it.
He’s an excellent guy with a great attitude and a genuine love for what he does. He’s infectious and when I get to see him, I usually laugh so hard I damned near hyperventilate.
His SSO issue was so severe that all that good humour and attitude was totally absent. It took a couple of days, but we got him going.
I’m a big fan of democratizing tech, especially security tech. But SSO is quite complicated at the best of times. When it goes wrong, it’s like troubleshooting a plate of spaghetti where half the noodles try to bite you.
In the case of SMB, when it goes wrong their businesses mostly grind to a halt. They often don’t have dedicated IT staff - the model of a son’s friend who comes in to help because he didn’t move away is quite common in SMB.
It’s a good idea, but in practice until we can get it to be completely turnkey, I don’t believe that many SSO providers could even afford to provide support for SMBs.
Until Apple and Microsoft find a way to a LetsEncrypt-type comprehensive mission, it's out of the question.
And, since Azure 'Entra' is a Microsoft profit center, no easy to use tool will be in their interest.
https://arstechnica.com/information-technology/2023/11/no-ok...
I glanced through the report and it comes to the normal conclusion that SSO is hard and expensive to get right. Do SMBs focus on providing value to their customers in the problem space that they are experts at or do they spend months just getting sign-in working?
Yeah I get the concern about the "SSO tax" but unfortunately SSO isn't free. Someone is paying for it somewhere, be that implementation, outsourcing to a service, and/or maintenance and customer support for the live of the product.
That said there are a lot more services and libraries out today that try to make this easier such as https://www.passportjs.org/ (which WorkOS sponsors).
Bullshit article. The reason SMBs don't deploy SSO is because SaaS and other tooling puts SSO integration behind very high tier paywalls.
I'm talking pricing schemes where sure, you can sign up for a 20 person team on a service because that's the only expected user base in house, but the moment you ask for SSO they demand you license your entire employee headcount.
Among many ridiculous schemes I've dealt with.
Related
Simple ways to find exposed sensitive information
Various methods to find exposed sensitive information are discussed, including search engine dorking, Github searches, and PublicWWW for hardcoded API keys. Risks of misconfigured AWS S3 buckets are highlighted, stressing data confidentiality.
SSH as a Sudo Replacement
Using SSH instead of sudo, the article addresses limitations of setuid binaries for privilege escalation. It details configuring s6-sudod to allow authorized users root access securely, emphasizing OpenSSH's security features.
BeyondCorp (2014)
Google's BeyondCorp approach rethinks enterprise security by moving away from traditional perimeter security to enhance protection in the changing tech environment. Visit the link for more details on this innovative strategy.