The device is part of the identity
Nov 19th, 2019 by Jesper Kråkhede
In my Zero Trust posts earlier this year I wrote about verifying everything. One thing I didn´t go into is the device. A username and a password tell you who claims to logon. The device tells you a lot about whether you should believe it.
Think about it. A correct password from a managed, patched and encrypted laptop is one thing. The same password from a computer that has never been seen before is something completely different. The identity is the same, the risk is not.
Technically this isn´t hard anymore. Enroll your devices in a device management tool like Intune and define what a healthy device is: encrypted disk, up to date patches, antimalware running and no jailbreak on the phones. Then let your Conditional Access policies require a compliant device for access to the sensitive stuff. Unmanaged devices can still get access to the less sensitive services, perhaps only through the browser and without the possibility to download.
The beauty is that the user doesn´t notice much. Most of the checks happen in the background. The attacker however will notice, because a stolen password suddenly isn´t enough.
Trust the device, then trust the user a little more.