Building a smarter lock for startups
As most homeowners will know, an authentic-looking identity card may be enough to allow a supplier through the front door, but few would consider it justification for allowing that same person into every room in your house. That restriction of access is something that most of use would take for granted, but digital security operates according to different principles.
Enterprise security has, historically, focused on making that digital front door impenetrable, by means of ever more complex password policies, multi-factor authentication protocols and stricter controls around privileged accounts. But, the emergence of Zero Trust thinking has led many organisations to question whether successful authentication at the door should really confer quite as much confidence as it once did.
The resounding answer, of course, is no and that caution is well-founded. After all, stealing a password, credential stuffing or password spraying aren’t the only ways to break into an account. Adversary-in-the-middle (AiTM) attacks (or man-in-the-middle attacks, as was) allow a legitimate authentication – MFA and all – to proceed while a third-party captures the resulting authenticated session cookie. That captured cookie can then be replayed to fool the login into identifying an authentic user, until it is either revoked or until it expires.
AiTM phishing, forged SAML tokens, and similar tactics, mean that a correct username and password combination is no longer sufficient to allows us to be confident of a user’s identity. That’s why the current generation of zero trust conditional access platforms are pulling in data from across a much broader set of parameters to establish the fundamental logic of the action and determine whether an access attempt might be malicious.
It is perfectly possible for a finance director based in Manchester, England, to attempt to login from Geylang, Singapore at 3am. They’ve probably travelled for a conference and, having arrived in their hotel, are checking the morning schedule before attempting a few hours of sleep. They might even be using a corporate VPN endpoint from somewhere else entirely. But wouldn’t you rather be sure?
An advanced access control system allows us to establish a degree of certainty around a login by examining, for example, whether the attempt is being made from a registered company machine or comparing its timing and location with those of previous authorised sessions. Today’s identity platforms are designed to consider exactly variables like these. Microsoft’s Entra Conditional Access is able to consider the geographical location that a login appears to come from, including whether it derives from one of an organisation’s known or trusted networks, while Okta’s Workforce Identity can also utilise device posture and network behaviour between logins. It can look at the Autonomous System Number, or ASN, behind a connection, and recognise any discrepancy in the route to internet taken by separate login attempts which, ostensibly, derive from the same country and, very much like an average driving speed check, compare the timings of consecutive logins from different locations and decide whether the journey from one to the next would have required breaking the laws of physics (or at least a reasonable travel estimate). After all, how much more seriously might we consider a login attempt from Singapore if it arrived only 30 minutes after a previously successful login in the UK?
Walking the line
By integrating multiple data types in this way, location only becomes a red flag if everything around it looks equally suspicious and, as a result, geofencing becomes a genuinely useful and adaptive prospect, not least by avoiding the difficulties that might accompany the blanket imposition of location-based Conditional Access. After all, basic geographical blocking might work for small businesses faced with suspicious access attempts from countries in which they don’t have offices, agents or suppliers, but it simply isn’t practical for multinational businesses looking to discriminate bad actors from among a widely-distributed workforce operating across the corporate cloud.
A suspicious login attempt can be blocked outright, but doing so can risk locking out legitimate users and disrupting normal business. In order to avoid this, Conditional Access offers a stage-gated approach to access, in which a login attempt made from outside of a trusted network might be set up to trigger a MFA check. Providing a second tier check like this can help to reduce the number of denials in error, while keeping protections in place, with the obvious advantage for network security teams who are not required to manage every unusual login as a critical threat and who can therefore direct their energy, and capacity, to more serious risks.
The next generation of access decision.
Network security policy, at all levels, must be tolerant of, at least some, ambiguity, at the risk of cloud platform and online work being policed to a grinding halt. For this reason, most are not designed to prove identity beyond doubt, but rather to flag quickly those instances where incongruities are sufficient to indicate that a real problem exists.
In the past, bad actors could take advantage of the confusion of VPN, mobile networks and cloud infrastructure to disguise themselves against geofencing protocols. Now, gaining access is becoming much more difficult, and the verification process is gradually extending into the lifetime of the session itself, as good practice increasingly dictates rechecking tokens are refreshed, or when other policy conditions are triggered. Stolen login details may still provide access, but it is becoming increasingly difficult for bad actors to move through systems unnoticed.
For more startup news, check out the other articles on the website, and subscribe to the magazine for free. Listen to The Cereal Entrepreneur podcast for more interviews with entrepreneurs and big-hitters in the startup ecosystem.
