Implementing conditional access procedures is a crucial part of a zero-trust strategy. But its fair to ask yourself, isn’t access always conditional? Isn’t access to systems and data always granted on the condition that, at a minimum, users enter a username and password? True enough. But the term “conditional access” refers to a specific approach to managing network security. Let’s talk about what it means and why it’s important.

Driven by the shift to mobile and cloud, conditional access is a process that enables IT security teams to validate or verify devices and users using a set of automated policies to protect networks and data. Policies may pertain to a specific use context or any number of factors, such as the user profile, the nature of the device, time of day, geographical location and what data the user is attempting to access. For that reason, the term “informed access” is catching on to describe the next level of authorization in which a system is informed that a given user is real, compliant and trusted.

The outcome of each access attempt can be dynamically determined, and individual sessions can even be monitored and controlled in real time, based on the risk assessment and access policies in effect. Conditional or informed access provides a scalable way to address various scenarios in which a user or a device may be suspect. For example, let’s say a user accesses the network from a particular city. Then, an hour later, the same user — or what appears to be the same user — attempts to access the network from a city in a different part of the world. An effective access policy could require the second attempt to be blocked.

For a more typical example, a legitimate user may attempt to access the network using a device with an out-of-date operating system. An access solution would be able to detect the out-of-date system and access would be withheld. The user would be notified that the situation must be remedied before access is granted, and the solution could offer instructions to bring the device into compliance. Such a self-service process has the added benefit of reducing calls to the help desk and eliminating the need for IT intervention.

How to Configure Conditional Access Policies

Access policies can apply a combination of rules based on defined conditions. Predefined access policies can be created by a software provider, or an IT team can create its own policies based on the organization’s specific needs.

An access policy for mobile devices might require devices to be enrolled (managed) in the company’s mobility management tool. A mobile device could be:

  1. Managed and in full compliance with the organization’s IT policies;
  2. Managed, but with an out-of-date operating system or out of compliance for some other reason; or
  3. Not managed in the company’s mobility management tool.

Each of these three device conditions would be treated differently depending on the status of the device and the sensitivity of the system or data the user is attempting to access.

There are many possible access policies and configurations, but the following examples paint a simple picture of how these policies can be applied. The particular policy chosen would be based on the network or data the user wants to access:

  • Less sensitive data — Users with managed devices — compliant or noncompliant — are allowed access. But users with unmanaged devices must complete additional two-factor authentication (2FA) to gain access.
  • Moderately sensitive data — Users with managed, compliant devices are allowed access. Users with devices that are managed but noncompliant must complete 2FA. Users with unmanaged devices are blocked.
  • Very sensitive data — Users with managed, compliant devices are allowed access with additional 2FA. Users with managed, noncompliant devices and users with unmanaged devices are both blocked.

Convenience for the World of Cloud and Mobile

In today’s business environment, mobility and convenience are essential, both for customers and employees. Even when they’re outside the corporate perimeter, employees accessing work-related systems and information expect the same level of speed and convenience they enjoy when conducting transactions on their favorite online shopping sites.

Conditional, informed access solutions provide a systematic way to provide that quick, convenient and secure access with a minimum of IT involvement and maximum speed and simplicity for the user.

More from Data Protection

How governance, risk and compliance (GRC) addresses growing data liability concerns

4 min read - In an era where businesses increasingly rely on artificial intelligence (AI) and advanced data capabilities, the effectiveness of IT services is more critical than ever. Yet despite the advancements in technology, business leaders are increasingly dissatisfied with their IT departments.According to a study by IBM's Institute for Business Value, confidence in the effectiveness of basic IT services among top executives has significantly declined. While AI promises transformational capabilities, particularly generative artificial intelligence (gen AI), the road to realizing these benefits…

Access control is going mobile — Is this the way forward?

2 min read - Last year, the highest volume of cyberattacks (30%) started in the same way: a cyber criminal using valid credentials to gain access. Even more concerning, the X-Force Threat Intelligence Index 2024 found that this method of attack increased by 71% from 2022. Researchers also discovered a 266% increase in infostealers to obtain credentials to use in an attack. Family members of privileged users are also sometimes victims.“These shifts suggest that threat actors have revalued credentials as a reliable and preferred…

Ransomware on the rise: Healthcare industry attack trends 2024

4 min read - According to the IBM Cost of a Data Breach Report 2024, the global average cost of a data breach reached $4.88 million this year, a 10% increase over 2023.For the healthcare industry, the report offers both good and bad news. The good news is that average data breach costs fell by 10.6% this year. The bad news is that for the 14th year in a row, healthcare tops the list with the most expensive breach recoveries, coming in at $9.77…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today