News for hackers. Stuff that matters.

A comment on When Employees Use Software That IT Hasn’t Approved. Parent comment

Re:When Employees Use Software That IT Hasn’t Approved by burfog on Wednesday June 12, 2019 @08:26AM (#20163808)
I have to use SaaS solutions for work, and the security situation terrifies me. I have to put my corporate password, with access to all sorts of important stuff, into a sketchy 3rd-party web site. This looks mighty bad.
[ Parent | on HN ]
Re:When Employees Use Software That IT Hasn’t Approved by syshum on Wednesday June 12, 2019 @04:56PM (#20169239)
Properly implemented no you would never do that, you would use a trusted SAML auth server to Authentication with your Domain Creds,

Something like Azure AD, ADFS, or 3rd party (that you assume to trust) like OneLogin. In all cases you would never enter your password into the SaaS service you are redirected to a secure portal controlled by the Auth Service, a token is then issued back to the SaaS service

Further it would be recommended not to use an elevated account and certainly not something like a Domain Admin account for those services

[ Parent | on HN ]