{"id":5309,"date":"2022-10-04T22:13:44","date_gmt":"2022-10-05T05:13:44","guid":{"rendered":"https:\/\/www.strata.io\/?p=5309"},"modified":"2024-04-09T11:30:19","modified_gmt":"2024-04-09T18:30:19","slug":"how-adaptive-authorization-helps-achieve-zero-trust","status":"publish","type":"post","link":"https:\/\/www.strata.io\/blog\/app-identity-modernization\/how-adaptive-authorization-helps-achieve-zero-trust\/","title":{"rendered":"What is adaptive authentication & how does it enable zero trust?"},"content":{"rendered":"
[vc_row][vc_column][vc_single_image image=”5355″ img_size=”full”][vc_column_text][\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text]The number zero is everywhere these days. You\u2019ve got zero-code, zero-day, Coke Zero, and of course \u2014 everyone\u2019s favorite \u2014 zero trust. What\u2019s the deal? These \u201czero\u201d terms all convey a baseline that is considered the ideal state. In the case of <\/span>zero trust<\/span><\/a>, zero means \u201ctrust no one and verify everything.\u201d\u00a0<\/span><\/p>\n In theory, zero trust makes a lot of sense, but how realistic is it to achieve? It requires all apps and identities to adhere to modern authentication tools. How can an organization possibly verify everything when they have thousands of distributed apps and users, all of which require verifying?\u00a0<\/span><\/p>\n Apps that are decades old and living on-premises don\u2019t understand modern authorization systems. We need a way to authenticate that bridges the gap between old and new. That\u2019s where adaptive authentication comes in.\u00a0<\/span><\/p>\n Let\u2019s dive a bit deeper to understand the concept of \u201czero,\u201d what it means to cybersecurity, and how<\/span> adaptive authentication<\/span> through Identity Orchestration can help you achieve zero trust<\/a>.\u00a0<\/span><\/p>\n The concept of zero is relatively new to human thinking because you can\u2019t experience nothing (double negative intended). Rather, to understand zero requires that we recognize the lack of something. It\u2019s an abstract construct that exists only in our minds. Early humans couldn\u2019t grasp this, but as our brains got smarter over time, we began to comprehend complex thinking.\u00a0<\/span><\/p>\n So how do you measure something that doesn’t exist? For Zero Trust, the success metric is when you have an iron-clad security environment that even the hackiest hacker can’t break into and destroy. That’s not likely to happen while passwords are being used to authenticate users. But passwords aren’t going to disappear anytime soon. So we adapt.<\/span><\/p>\n Adaptive authentication (also known as risk-based authentication) is a method of access to data that matches user credentials to the risk of the authorizations requested. The point of adaptive authentication is to fortify security while not making the process of logging in and authenticating more difficult than it has to be for the users.\u00a0<\/span><\/p>\n This Dark Reading article<\/a> by Strata Identity’s CEO, Eric Olden explains that the friction caused by trying to implement zero trust practices ironically causes greater risk. With adaptive authentication, the identity management system can tell the location of the user, along with which network and device they are login on from, as well as if that device is misconfigured. Policy checks from the established content can be made to verify the user.<\/p>\n Adaptive authentication is similar to how our brains adapted to understanding new complex thinking. It takes a situation and puts context behind it to simplify processes while still understanding that change is gradual. Adaptive authentication is a context-based approach that can help organizations achieve a zero trust security architecture when implemented.\u00a0<\/span><\/p>\n When someone within an organization tries to access a resource, adaptive authentication doesn\u2019t require them to re-authenticate themselves when there is no need. This reduces the irritation end-users often experience with multi-factor authentication when they have to use an authenticator app or prove in some other way that they are who they say they are.\u00a0\u00a0<\/span><\/p>\n Yet, adaptive authentication can have implementation challenges. Any company that\u2019s been around for a while will have loads of older applications that can only authenticate with usernames and passwords. You could rewrite\/recode each app to understand new technology\u2026 if you had unlimited time and money\u2026<\/span><\/p>\nThe meaning of \u201czero\u201d<\/span><\/h2>\n
What is adaptive authentication?<\/span><\/h2>\n
Getting to zero trust with hybrid & multi-cloud<\/span><\/h2>\n
Identity Orchestration is the key to making authentication work<\/span><\/h2>\n