A small parks-and-recreation registration app is being given a highly custom, complex single sign-on stack that few staff understand. What secure-engineering response is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Fancy homemade SSO on a tiny parks app is a gift to attackers and a headache for support. Threat-model it, keep it simple, and lean on boring proven identity patterns. Complexity is not a feature here.
Full Explanation
Secure design principles include keeping systems simple and small and using threat modeling to expose unnecessary attack surface. A bespoke SSO implementation for a low-complexity parks application often introduces misconfiguration and maintenance risk without proportional benefit. Preferring established, well-understood identity integrations aligns with CISSP secure engineering guidance.