Skip to main content

Authenticate using standard protocols

Requirement#

The organization must implement the Single Sign On (SSO) process using standard protocols (e.g., SAML).

References#

  • CAPEC-115: Authentication Bypass: An attacker gains access to application, service or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.

  • OWASP Top 10 A2:2017-Broken Authentication: Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys or session tokens, or to exploit other implementation flaws to assume other users' identities temporarily or permanently.

  • PCI DSS v3.2.1 - Requirement 6.5.10: Address common coding vulnerabilities in software-development processes such as broken authentication and session management.