[Security Architecture] Users are willing passwords on paper because of the number of passwords needed in an environment. Which of the following solutions is the best way to manage this situation and decrease risks?

The core issue is password fatigue, where users must manage too many credentials, leading them to engage in insecure practices like writing passwords down. A Single Sign-On (SSO) solution directly addresses this root cause. By implementing SSO, users authenticate once to a central service and are then granted access to multiple integrated applications without re-entering credentials. This drastically reduces the number of passwords a user needs to remember, eliminating the primary motivation for writing them down. SSO also enhances security by providing a single, centrally managed, and auditable point of authentication that can be more robustly protected.

A. Increasing password complexity to require at least 16 characters: This would worsen the problem by making passwords even harder to remember, increasing the likelihood that users will write them down.
C. Requiring users to use an open-source password manager: While a password manager helps, SSO is a superior enterprise solution as it offers centralized control, policy enforcement, and auditing, rather than relying on individual user adoption and management.
D. Implementing an MFA solution to avoid reliance only on passwords: MFA mitigates the risk of a compromised password but does not solve the underlying issue of password fatigue that is causing the insecure behavior. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-63C

Digital Identity Guidelines: Federation and Assertions.

Reference: Section 5.1.1

"Benefits to the RP".

Content: This document explicitly states a key benefit of federation (the technology behind SSO) is the "Reduced need for the subscriber to remember a different username and password for each RP [Relying Party/application]." This directly supports SSO as the solution to the problem of managing too many passwords.

2. Carnegie Mellon University

CyLab

A Large-Scale Study of Password-Policy-Related Frustration and Issues.

Reference: Section 6

"Discussion".

Content: This academic study highlights that a high number of accounts and restrictive password policies lead to user frustration and coping mechanisms like writing passwords down. It suggests that solutions like SSO can alleviate this burden. (DOI: https://doi.org/10.1145/3460120.3484559)

3. University of California

Berkeley

Information Security Office

Single Sign-On (SSO).

Reference: "What are the benefits of SSO?" section.

Content: This university resource explains that a primary benefit of SSO is that it "eliminates the need for users to remember multiple sets of usernames and passwords

" which improves user experience and security by reducing password proliferation.