Implementing conditional access procedures is a crucial part of a zero-trust strategy. But its fair to ask yourself, isn’t access always conditional? Isn’t access to systems and data always granted on the condition that, at a minimum, users enter a username and password? True enough. But the term “conditional access” refers to a specific approach to managing network security. Let’s talk about what it means and why it’s important.

Driven by the shift to mobile and cloud, conditional access is a process that enables IT security teams to validate or verify devices and users using a set of automated policies to protect networks and data. Policies may pertain to a specific use context or any number of factors, such as the user profile, the nature of the device, time of day, geographical location and what data the user is attempting to access. For that reason, the term “informed access” is catching on to describe the next level of authorization in which a system is informed that a given user is real, compliant and trusted.

The outcome of each access attempt can be dynamically determined, and individual sessions can even be monitored and controlled in real time, based on the risk assessment and access policies in effect. Conditional or informed access provides a scalable way to address various scenarios in which a user or a device may be suspect. For example, let’s say a user accesses the network from a particular city. Then, an hour later, the same user — or what appears to be the same user — attempts to access the network from a city in a different part of the world. An effective access policy could require the second attempt to be blocked.

For a more typical example, a legitimate user may attempt to access the network using a device with an out-of-date operating system. An access solution would be able to detect the out-of-date system and access would be withheld. The user would be notified that the situation must be remedied before access is granted, and the solution could offer instructions to bring the device into compliance. Such a self-service process has the added benefit of reducing calls to the help desk and eliminating the need for IT intervention.

How to Configure Conditional Access Policies

Access policies can apply a combination of rules based on defined conditions. Predefined access policies can be created by a software provider, or an IT team can create its own policies based on the organization’s specific needs.

An access policy for mobile devices might require devices to be enrolled (managed) in the company’s mobility management tool. A mobile device could be:

1. Managed and in full compliance with the organization’s IT policies;
2. Managed, but with an out-of-date operating system or out of compliance for some other reason; or
3. Not managed in the company’s mobility management tool.

Each of these three device conditions would be treated differently depending on the status of the device and the sensitivity of the system or data the user is attempting to access.

There are many possible access policies and configurations, but the following examples paint a simple picture of how these policies can be applied. The particular policy chosen would be based on the network or data the user wants to access:

• Less sensitive data — Users with managed devices — compliant or noncompliant — are allowed access. But users with unmanaged devices must complete additional two-factor authentication (2FA) to gain access.
• Moderately sensitive data — Users with managed, compliant devices are allowed access. Users with devices that are managed but noncompliant must complete 2FA. Users with unmanaged devices are blocked.
• Very sensitive data — Users with managed, compliant devices are allowed access with additional 2FA. Users with managed, noncompliant devices and users with unmanaged devices are both blocked.

Convenience for the World of Cloud and Mobile

In today’s business environment, mobility and convenience are essential, both for customers and employees. Even when they’re outside the corporate perimeter, employees accessing work-related systems and information expect the same level of speed and convenience they enjoy when conducting transactions on their favorite online shopping sites.

Conditional, informed access solutions provide a systematic way to provide that quick, convenient and secure access with a minimum of IT involvement and maximum speed and simplicity for the user.