CRISC · Question #254
An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment…
The correct answer is A. Initiate a retest of the full control. When a new application is integrated into a centralized SSO system, the best course of action is to retest the full SSO control to ensure the new application is properly integrated, and that its addition has not introduced any regressions or vulnerabilities affecting other…
Question
An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?
Options
- AInitiate a retest of the full control
- BRetest the control using the new application as the only sample.
- CReview the corresponding change control documentation
- DRe-evaluate the control during (he next assessment
How the community answered
(21 responses)- A76% (16)
- B5% (1)
- C5% (1)
- D14% (3)
Why each option
When a new application is integrated into a centralized SSO system, the best course of action is to retest the full SSO control to ensure the new application is properly integrated, and that its addition has not introduced any regressions or vulnerabilities affecting other applications or the SSO mechanism itself. This comprehensive retesting ensures continued security and functionality across the entire ecosystem.
Adding a new application to a centralized SSO control environment can introduce unforeseen issues, misconfigurations, or regressions in the existing SSO functionality or its interaction with other applications. Initiating a retest of the full control ensures that the new integration works correctly, does not break existing connections, and maintains the overall security posture of the SSO system across all connected services.
Retesting only with the new application as the sample might confirm its individual integration but would fail to identify potential regressions or impacts on previously working applications within the SSO ecosystem.
Reviewing change control documentation is an administrative step but does not technically validate the secure and correct functioning of the SSO control with the new application in a live or test environment.
Waiting until the next scheduled assessment for re-evaluation leaves a potential security gap or functionality issue unaddressed for an extended period, which is not the best course of action for a critical control like SSO.
Concept tested: Security control testing, change management impact
Source: https://learn.microsoft.com/en-us/compliance/regulatory/risk-management-framework#step-3-assess-risk
Topics
Community Discussion
No community discussion yet for this question.