Implementing conditional access procedures is a crucial part of a zero-trust strategy. But its fair to ask yourself, isn’t access always conditional? Isn’t access to systems and data always granted on the condition that, at a minimum, users enter a username and password? True enough. But the term “conditional access” refers to a specific approach to managing network security. Let’s talk about what it means and why it’s important.

Driven by the shift to mobile and cloud, conditional access is a process that enables IT security teams to validate or verify devices and users using a set of automated policies to protect networks and data. Policies may pertain to a specific use context or any number of factors, such as the user profile, the nature of the device, time of day, geographical location and what data the user is attempting to access. For that reason, the term “informed access” is catching on to describe the next level of authorization in which a system is informed that a given user is real, compliant and trusted.

The outcome of each access attempt can be dynamically determined, and individual sessions can even be monitored and controlled in real time, based on the risk assessment and access policies in effect. Conditional or informed access provides a scalable way to address various scenarios in which a user or a device may be suspect. For example, let’s say a user accesses the network from a particular city. Then, an hour later, the same user — or what appears to be the same user — attempts to access the network from a city in a different part of the world. An effective access policy could require the second attempt to be blocked.

For a more typical example, a legitimate user may attempt to access the network using a device with an out-of-date operating system. An access solution would be able to detect the out-of-date system and access would be withheld. The user would be notified that the situation must be remedied before access is granted, and the solution could offer instructions to bring the device into compliance. Such a self-service process has the added benefit of reducing calls to the help desk and eliminating the need for IT intervention.

How to Configure Conditional Access Policies

Access policies can apply a combination of rules based on defined conditions. Predefined access policies can be created by a software provider, or an IT team can create its own policies based on the organization’s specific needs.

An access policy for mobile devices might require devices to be enrolled (managed) in the company’s mobility management tool. A mobile device could be:

  1. Managed and in full compliance with the organization’s IT policies;
  2. Managed, but with an out-of-date operating system or out of compliance for some other reason; or
  3. Not managed in the company’s mobility management tool.

Each of these three device conditions would be treated differently depending on the status of the device and the sensitivity of the system or data the user is attempting to access.

There are many possible access policies and configurations, but the following examples paint a simple picture of how these policies can be applied. The particular policy chosen would be based on the network or data the user wants to access:

  • Less sensitive data — Users with managed devices — compliant or noncompliant — are allowed access. But users with unmanaged devices must complete additional two-factor authentication (2FA) to gain access.
  • Moderately sensitive data — Users with managed, compliant devices are allowed access. Users with devices that are managed but noncompliant must complete 2FA. Users with unmanaged devices are blocked.
  • Very sensitive data — Users with managed, compliant devices are allowed access with additional 2FA. Users with managed, noncompliant devices and users with unmanaged devices are both blocked.

Convenience for the World of Cloud and Mobile

In today’s business environment, mobility and convenience are essential, both for customers and employees. Even when they’re outside the corporate perimeter, employees accessing work-related systems and information expect the same level of speed and convenience they enjoy when conducting transactions on their favorite online shopping sites.

Conditional, informed access solutions provide a systematic way to provide that quick, convenient and secure access with a minimum of IT involvement and maximum speed and simplicity for the user.

More from Data Protection

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today