Does your organization implement controls to protect identity assertions used in single sign-on (SSO) systems?

Identity assertions contain authentication data and user attributes that are passed between systems during SSO processes. If these assertions are not properly protected, attackers could intercept, modify, or forge them to gain unauthorized access to multiple systems with a single compromise.

Protection measures typically include encryption of assertions, digital signatures, proper token validation, secure transmission channels, and short token lifetimes.

Evidence could include documentation of SSO implementation with security controls, configuration screenshots showing encryption and signature settings for SAML/OAuth/OIDC tokens, network diagrams showing secure transmission paths for identity assertions, or audit logs demonstrating validation of identity assertions.