Conditional Access policies SHOULD be implemented across all cloud-based digital identity platforms used in the business environment.
Even though a strong password combined with MFA may seem sufficiently secure, its days are numbered. As with all security developments, adversaries are finding ways to compromise MFA solutions and attack digital identities from new avenues. Conditional Access is a security technology for IAM platforms that provides additional assurance that attempted actions originate from the proper users.
As per Microsoft, Conditional Access is an intelligent policy engine that helps organizations better control how users access corporate resources. Organizations create policies governing certain standards that user accounts must meet during the authentication process. These policies measure certain attributes of the entity attempting to log on to see if they satisfy security requirements. These policies are very granular and are designed to catch more insidious attacks that may present seemingly valid credentials to the platform.
Common Conditional Access policies include:
- Require MFA for all users. This ensures that under no pretext can a user be authenticated without validation of at least one extra authentication factor.
- Block legacy authentication sources. Clients running on old technology that cannot meet security requirements will not be permitted access to resources.
- Block sign-ins based on geolocation. This is an extremely handy setting that can mitigate impossible travel. Organizations have a good idea of what locations their users should be working from. These expected locations are configured in Conditional Access, and logon attempts coming from locations outside the scope are blocked. If your business and all of your employees are located in Presque Isle, Maine, there is little to no reason for a login attempt coming from Guatemala.
- Require device compliance. Mobile device management platforms such as Intune can work with Conditional Access to set a baseline standard for device hygiene. This is similar to local Network Access Control (NAC). Not only is the user account studied, but the device they are working from is as well. If the device is not sufficiently secure or is outside expected bounds for configuration, the logon attempt is blocked. If you use a Windows-dominant environment, there shouldn’t be any logon attempts to company accounts from Mac devices.
In addition to these standardized policies, Conditional Access can allow administrators to permit or deny logons based on calculated Risk Scores. Using Machine Learning (ML) and Risk-Based Access Control, logon attempts can be assessed based on the level of risk they pose to the environment.
For example, Microsoft’s Identity Protection works with its Conditional Access to calculate two categories of risk:
- Sign-In Risk: risk is calculated for a logon attempt in a vacuum. The logon attempt is analyzed for impossible travel or suspicious geolocation, malicious or suspicious source IP addresses, and/or unfamiliar devices.
- User Risk: A risk profile is compiled for the user attempting to log on. The algorithm studies historical data to see if the user’s credentials have been leaked as part of a breach, if multiple suspicious logons have occurred to the account recently, or if the account has been performing suspicious or noncompliant actions on company resources. Authentication practices can be made flexible using User Risk scores. For example, the IAM platform can be configured to require regular MFA throughout the session if the risk score is unusually high.
Conditional Access can do wonders for protecting organizations with a heavy online/cloud presence. All organizations utilizing a centralized IAM platform should implement it, as identity-based cyberattacks are quickly becoming among the most common in today’s threat landscape.