Using Zero Trust and Conditional Access Policies to Reshape Cybersecurity

Using Zero Trust and Conditional Access Policies to Reshape Cybersecurity

Eliminate trust based on location, such as within a company network, and always verify users at every access request.

Having a password that contained a random assortment of characters used to be considered the high-point of IT security.

And this system was optimal when all we needed was to be on the corporate network and were physically on-site. If traveling or working from home, a laptop and VPN would suffice.

But the ways that employees and corporations function have changed dramatically in the last ten years. We're much more mobile than we used to be, and no longer working with applications that only reside on the local server, but instead are sitting on the cloud. From a security perspective, the 'perimeter' is fast expanding, and we must update our approach to network security and access.

And users are inadvertently a risk to security:

  • 4 percent of users will click on anything
  • 28 percent of attacks involved an insider
  • Casual events caused 17 percent of breaches

Modern users are more mobile than before: Are VPNs still viable?

With the increased practice of cloud-based apps and mobile devices, users are not only more mobile but using personal devices for work at an increased rate.

  • Employees working from home and cafes
  • Contractors working offsite
  • Increased usage of mobile devices

The traditional method of using a VPN has too many disadvantages and security flaws to be viable. They give too much access and expose assets to the internet. Security experts instead recommend using zero trust VPN combined with conditional access.

What is zero trust and conditional access?

Zero trust is a cloud-based solution used to grant secure remote access to users while isolating resources such as apps and data from attacks and threats. It can be broken down into three main components:

  • Never trust—always verify
  • Successful access granted only after end-device authentication
  • Each access request is unique

Conditional access dynamically determines each access request in real-time instead of storing user credentials which may be outdated and granting access if the credentials are correct. This approach is no longer practical. What if the user inadvertently downloads a malicious app? What if their location has changed? There are too many variables for an identity-only approach.

Implied assumption of safety

The assumption of security comes from the adage that if the end-user is known and has the correct credentials, then they are not a threat. Conditional access takes into account multiple endpoint factors and provides real-time risk assessment. For instance:

  • Network - Is it a secured connection or unsecured, such as free coffee shop WiFi?
  • Operating system - The user may be missing a critical OS security update or no compliant OS
  • Location - Logging in from a suspicious location outside normal behavior
  • Device - Non-compliant devices from specific manufacturers may be blacklisted

These are just some of the holistic methods of conditional access. Dynamically checking each access request to preserve security by 'never trusting' and 'always verify.’

Do you need conditional access?

Attacks are at a record high, and we shouldn't assume that just because users are on a corporate network, they're secure. This was true 20 to 25 years ago, when only emails would leave the secured network and working offsite was a rarity, much less being able to connect to the network from outside the perimeter.

Today's attacks are much more sophisticated, and even two-factor authentication can be breached due to security flaws from the user. Fake emails, phishing scams are ever-present, and even customers at large banks fall prey to these attacks.

Integrating a zero-trust policy helps companies defend themselves from attacks by removing the assumption that the user can be trusted, to one of explicit verification.

Main takeaways

Networks that don't adapt their security approach will always remain vulnerable to attacks and breaches of data. Technology has evolved to a level of connectivity that mixes both work and pleasure across devices. Facebook, LinkedIn, OneDrive and other platforms can be accessed from nearly anywhere and on any device, expanding the security perimeter.

The only way to maintain security is to assume a zero trust policy combined with conditional access. Eliminate trust based on location, such as within a company network, and always verify users at every access request. Conditional access will further strengthen security by limiting access to high-value assets depending on the user profile at the time.

Featured

  • Security Today Announces The Govies Government Security Award Winners for 2025

    Security Today is pleased to announce the 2025 winners in The Govies Government Security Awards. The awards honor outstanding government security products in a variety of categories. Read Now

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.