Verify the user and the device
Jan 5th, 2022 by Jesper Kråkhede
For years we have verified the user. Username, password and, if we were lucky, a second factor. What we didn´t verify was the thing the user was sitting at.
Today we can verify both at the same time, and that changes a lot.
When a user logs on, the identity platform can check not only who it is but also which device the request comes from. Is it a device we know? Is it managed by us? Is it encrypted, patched and running protection? Has the EDR seen anything suspicious on it lately? Conditional Access can then decide: full access, limited access through the browser, or no access at all.
What does it do for security? Quite a lot. A stolen password is no longer enough, because the attacker also needs one of our healthy devices. A phishing site that steals both the password and the second factor still fails if access requires a compliant device. And if a laptop gets infected, its risk level goes up and access to sensitive data can be cut automatically, without anyone having to act.
It also changes the way we think. The question is no longer ‘is the user inside our network?’ but ‘is this user, on this device, right now, trustworthy enough for this data?’
That is Zero Trust in one sentence.
Two keys open more safely than one.