Implementing conditional access procedures is a crucial part of a zero-trust strategy. But its fair to ask yourself, isn’t access always conditional? Isn’t access to systems and data always granted on the condition that, at a minimum, users enter a username and password? True enough. But the term “conditional access” refers to a specific approach to managing network security. Let’s talk about what it means and why it’s important.

Driven by the shift to mobile and cloud, conditional access is a process that enables IT security teams to validate or verify devices and users using a set of automated policies to protect networks and data. Policies may pertain to a specific use context or any number of factors, such as the user profile, the nature of the device, time of day, geographical location and what data the user is attempting to access. For that reason, the term “informed access” is catching on to describe the next level of authorization in which a system is informed that a given user is real, compliant and trusted.

The outcome of each access attempt can be dynamically determined, and individual sessions can even be monitored and controlled in real time, based on the risk assessment and access policies in effect. Conditional or informed access provides a scalable way to address various scenarios in which a user or a device may be suspect. For example, let’s say a user accesses the network from a particular city. Then, an hour later, the same user — or what appears to be the same user — attempts to access the network from a city in a different part of the world. An effective access policy could require the second attempt to be blocked.

For a more typical example, a legitimate user may attempt to access the network using a device with an out-of-date operating system. An access solution would be able to detect the out-of-date system and access would be withheld. The user would be notified that the situation must be remedied before access is granted, and the solution could offer instructions to bring the device into compliance. Such a self-service process has the added benefit of reducing calls to the help desk and eliminating the need for IT intervention.

How to Configure Conditional Access Policies

Access policies can apply a combination of rules based on defined conditions. Predefined access policies can be created by a software provider, or an IT team can create its own policies based on the organization’s specific needs.

An access policy for mobile devices might require devices to be enrolled (managed) in the company’s mobility management tool. A mobile device could be:

  1. Managed and in full compliance with the organization’s IT policies;
  2. Managed, but with an out-of-date operating system or out of compliance for some other reason; or
  3. Not managed in the company’s mobility management tool.

Each of these three device conditions would be treated differently depending on the status of the device and the sensitivity of the system or data the user is attempting to access.

There are many possible access policies and configurations, but the following examples paint a simple picture of how these policies can be applied. The particular policy chosen would be based on the network or data the user wants to access:

  • Less sensitive data — Users with managed devices — compliant or noncompliant — are allowed access. But users with unmanaged devices must complete additional two-factor authentication (2FA) to gain access.
  • Moderately sensitive data — Users with managed, compliant devices are allowed access. Users with devices that are managed but noncompliant must complete 2FA. Users with unmanaged devices are blocked.
  • Very sensitive data — Users with managed, compliant devices are allowed access with additional 2FA. Users with managed, noncompliant devices and users with unmanaged devices are both blocked.

Convenience for the World of Cloud and Mobile

In today’s business environment, mobility and convenience are essential, both for customers and employees. Even when they’re outside the corporate perimeter, employees accessing work-related systems and information expect the same level of speed and convenience they enjoy when conducting transactions on their favorite online shopping sites.

Conditional, informed access solutions provide a systematic way to provide that quick, convenient and secure access with a minimum of IT involvement and maximum speed and simplicity for the user.

More from Data Protection

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…

Millions Lost in Minutes — Mitigating Public-Facing Attacks

In recent years, many high-profile companies have suffered destructive cybersecurity breaches. These public-facing assaults cost organizations millions of dollars in minutes, from stock prices to media partnerships. Fast Company, Rockstar, Uber, Apple and more have all been victims of these costly and embarrassing attacks. The total average cost of a data breach has increased by 2.6% since 2021 and is now $4.35 million. Organizations that don't deploy zero trust security models also incur an average of $1 million more in…