Using Zero Trust and Conditional Access Policies to Reshape Cybersecurity

Using Zero Trust and Conditional Access Policies to Reshape Cybersecurity

Eliminate trust based on location, such as within a company network, and always verify users at every access request.

Having a password that contained a random assortment of characters used to be considered the high-point of IT security.

And this system was optimal when all we needed was to be on the corporate network and were physically on-site. If traveling or working from home, a laptop and VPN would suffice.

But the ways that employees and corporations function have changed dramatically in the last ten years. We're much more mobile than we used to be, and no longer working with applications that only reside on the local server, but instead are sitting on the cloud. From a security perspective, the 'perimeter' is fast expanding, and we must update our approach to network security and access.

And users are inadvertently a risk to security:

  • 4 percent of users will click on anything
  • 28 percent of attacks involved an insider
  • Casual events caused 17 percent of breaches

Modern users are more mobile than before: Are VPNs still viable?

With the increased practice of cloud-based apps and mobile devices, users are not only more mobile but using personal devices for work at an increased rate.

  • Employees working from home and cafes
  • Contractors working offsite
  • Increased usage of mobile devices

The traditional method of using a VPN has too many disadvantages and security flaws to be viable. They give too much access and expose assets to the internet. Security experts instead recommend using zero trust VPN combined with conditional access.

What is zero trust and conditional access?

Zero trust is a cloud-based solution used to grant secure remote access to users while isolating resources such as apps and data from attacks and threats. It can be broken down into three main components:

  • Never trust—always verify
  • Successful access granted only after end-device authentication
  • Each access request is unique

Conditional access dynamically determines each access request in real-time instead of storing user credentials which may be outdated and granting access if the credentials are correct. This approach is no longer practical. What if the user inadvertently downloads a malicious app? What if their location has changed? There are too many variables for an identity-only approach.

Implied assumption of safety

The assumption of security comes from the adage that if the end-user is known and has the correct credentials, then they are not a threat. Conditional access takes into account multiple endpoint factors and provides real-time risk assessment. For instance:

  • Network - Is it a secured connection or unsecured, such as free coffee shop WiFi?
  • Operating system - The user may be missing a critical OS security update or no compliant OS
  • Location - Logging in from a suspicious location outside normal behavior
  • Device - Non-compliant devices from specific manufacturers may be blacklisted

These are just some of the holistic methods of conditional access. Dynamically checking each access request to preserve security by 'never trusting' and 'always verify.’

Do you need conditional access?

Attacks are at a record high, and we shouldn't assume that just because users are on a corporate network, they're secure. This was true 20 to 25 years ago, when only emails would leave the secured network and working offsite was a rarity, much less being able to connect to the network from outside the perimeter.

Today's attacks are much more sophisticated, and even two-factor authentication can be breached due to security flaws from the user. Fake emails, phishing scams are ever-present, and even customers at large banks fall prey to these attacks.

Integrating a zero-trust policy helps companies defend themselves from attacks by removing the assumption that the user can be trusted, to one of explicit verification.

Main takeaways

Networks that don't adapt their security approach will always remain vulnerable to attacks and breaches of data. Technology has evolved to a level of connectivity that mixes both work and pleasure across devices. Facebook, LinkedIn, OneDrive and other platforms can be accessed from nearly anywhere and on any device, expanding the security perimeter.

The only way to maintain security is to assume a zero trust policy combined with conditional access. Eliminate trust based on location, such as within a company network, and always verify users at every access request. Conditional access will further strengthen security by limiting access to high-value assets depending on the user profile at the time.


  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • ResponderLink


    Shooter Detection Systems (SDS), an company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3