Using Zero Trust and Conditional Access Policies to Reshape Cybersecurity

Using Zero Trust and Conditional Access Policies to Reshape Cybersecurity

Eliminate trust based on location, such as within a company network, and always verify users at every access request.

Having a password that contained a random assortment of characters used to be considered the high-point of IT security.

And this system was optimal when all we needed was to be on the corporate network and were physically on-site. If traveling or working from home, a laptop and VPN would suffice.

But the ways that employees and corporations function have changed dramatically in the last ten years. We're much more mobile than we used to be, and no longer working with applications that only reside on the local server, but instead are sitting on the cloud. From a security perspective, the 'perimeter' is fast expanding, and we must update our approach to network security and access.

And users are inadvertently a risk to security:

  • 4 percent of users will click on anything
  • 28 percent of attacks involved an insider
  • Casual events caused 17 percent of breaches

Modern users are more mobile than before: Are VPNs still viable?

With the increased practice of cloud-based apps and mobile devices, users are not only more mobile but using personal devices for work at an increased rate.

  • Employees working from home and cafes
  • Contractors working offsite
  • Increased usage of mobile devices

The traditional method of using a VPN has too many disadvantages and security flaws to be viable. They give too much access and expose assets to the internet. Security experts instead recommend using zero trust VPN combined with conditional access.

What is zero trust and conditional access?

Zero trust is a cloud-based solution used to grant secure remote access to users while isolating resources such as apps and data from attacks and threats. It can be broken down into three main components:

  • Never trust—always verify
  • Successful access granted only after end-device authentication
  • Each access request is unique

Conditional access dynamically determines each access request in real-time instead of storing user credentials which may be outdated and granting access if the credentials are correct. This approach is no longer practical. What if the user inadvertently downloads a malicious app? What if their location has changed? There are too many variables for an identity-only approach.

Implied assumption of safety

The assumption of security comes from the adage that if the end-user is known and has the correct credentials, then they are not a threat. Conditional access takes into account multiple endpoint factors and provides real-time risk assessment. For instance:

  • Network - Is it a secured connection or unsecured, such as free coffee shop WiFi?
  • Operating system - The user may be missing a critical OS security update or no compliant OS
  • Location - Logging in from a suspicious location outside normal behavior
  • Device - Non-compliant devices from specific manufacturers may be blacklisted

These are just some of the holistic methods of conditional access. Dynamically checking each access request to preserve security by 'never trusting' and 'always verify.’

Do you need conditional access?

Attacks are at a record high, and we shouldn't assume that just because users are on a corporate network, they're secure. This was true 20 to 25 years ago, when only emails would leave the secured network and working offsite was a rarity, much less being able to connect to the network from outside the perimeter.

Today's attacks are much more sophisticated, and even two-factor authentication can be breached due to security flaws from the user. Fake emails, phishing scams are ever-present, and even customers at large banks fall prey to these attacks.

Integrating a zero-trust policy helps companies defend themselves from attacks by removing the assumption that the user can be trusted, to one of explicit verification.

Main takeaways

Networks that don't adapt their security approach will always remain vulnerable to attacks and breaches of data. Technology has evolved to a level of connectivity that mixes both work and pleasure across devices. Facebook, LinkedIn, OneDrive and other platforms can be accessed from nearly anywhere and on any device, expanding the security perimeter.

The only way to maintain security is to assume a zero trust policy combined with conditional access. Eliminate trust based on location, such as within a company network, and always verify users at every access request. Conditional access will further strengthen security by limiting access to high-value assets depending on the user profile at the time.

Featured

  • It's Show Time

    I am one of those people that likes to see things get bigger and better. As advertised, ISC West is going to be bigger (more exhibitors) and better (more attendees). It’s show time in Las Vegas. Read Now

    • Industry Events
    • ISC West
  • Cyber Overconfidence Is Leaving Your Organization Vulnerable

    The increased sophistication of cyber threats pumped by the relentless use of AI and machine learning brings forth record-breaking statistics. Cyberattacks grew 44% YoY in 2024, with a weekly average of 1,673 cyberattacks per organization. While organizations up their security game to help thwart these attacks, a critical question remains: Can employees identify a threat when they come across one? A Confidence Gap survey reveals that 86% of employees feel confident in their ability to identify phishing attempts. But things are not as rosy as they appear; the more significant part of the report finds this confidence misplaced. Read Now

  • Mission 500 Debuts Refreshed Identity Ahead of Security 5K/2K at ISC West

    Mission 500, the security industry’s nonprofit charity dedicated to supporting children in need across the US, Canada, and Puerto Rico, has unveiled a refreshed brand identity ahead of ISC West. The charity’s new look includes a modernized logo with refined messaging to reinforce Mission 500’s nearly decade-long commitment to serving the needs of children and families in crisis. Read Now

    • Industry Events
  • Meeting Modern Demands

    Door hardware and access control continue to be at the forefront of innovation within the security industry, continuously evolving to meet the dynamic needs of commercial spaces. Read Now

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.