What Is Adaptive Access Control?

Adaptive access control tailors access requirements to the level of risk associated with an access request. For example, a user logging in from an unknown device or unusual location may need to perform additional authentication steps. Also, if context changes after initial login, access decisions may be reevaluated, forcing additional authentication at particular checkpoints, when performing sensitive actions, or after a session refresh.

Adaptive access control can use a variety of signals to assess risk, including device posture, user behavior, identity risk, resource sensitivity, and location context. If an access request is assessed as risky, the system may require step-up verification, reduce the user’s access and permissions, or completely block or terminate the session.

How Adaptive Access Control Is Different from Traditional Access Control

Traditional access control often involved a single access decision at the beginning of the user’s session. Once access is approved, there is no ongoing monitoring, and users are only constrained by the access and privileges assigned to their account.

This approach to identity and access management (IAM) introduces significant risk if an attacker can trick the initial authentication or take over an approved session. Adaptive access control performs continuous, context-aware monitoring, allowing access decisions to be made throughout a user’s session rather than right at the beginning.

What Changes When Access Becomes Risk-Based?

Traditional access management often depended solely on roles and groups. Role-based access control (RBAC) assigns privileges to a particular role and users to that role as well. If an authenticated user makes a request, it’s evaluated based on the privileges assigned to that role.

With risk-based access decisions, additional signals and context are included within the access decision. Higher-risk access requests, such as those originating from an unknown device, may require additional verification than the same request from a known device and normal location.

How Does Adaptive Control Relate to RBAC and ABAC?

RBAC and attribute-based access control (ABAC) define the baseline policy model for access management. They specify whether or not a user should have access if the system is confident regarding the user’s identity.

Adaptive access control builds on this by considering the risk of misidentification. The more unusual and risky the request, the greater the burden of proof to achieve that confidence in the user’s identity.

Risk Signals Used in Adaptive Access Control Decisions

Adaptive access control can use a variety of different signals to assess the risk associated with an access request. Some of the most common types of signals include:

• Device Posture
• User Behavior
• Location Context
• Identity Risk
• Resource Sensitivity

These signals can help to determine whether a request is particularly risky and whether a user is likely to be who they claim to be. However, signal quality and coverage matter significantly since low-quality or incomplete data can result in an inaccurate risk score.

What Device Signals Indicate Higher or Lower Trust?

Device signals include information about the device itself that can indicate whether it poses a risk to the business and whether it’s likely to be a legitimate device. Common considerations include:

• Managed vs. unmanaged devices
• Presence of enterprise security agents
• Patch status
• Indicators of rooted or jailbroken devices
• Certificate state

If available, this information offers insight into the security level of the device making the access request. If this information can’t be collected, then additional authentication actions may be needed, or the system may limit the set of actions that the user is permitted to take with that device. For example, authenticated users on an unknown device may be granted read-only access to certain types of data.

What Behavioral Signals Suggest Compromise or Misuse?

Behavioral signals focus on indications that a user account or device has been compromised by an attacker. Common signals include:

• Impossible travel
• Abnormal access timing
• Unusual resource access patterns
• Repeated failed verifications

These types of signals are commonly used to determine whether step-up authentication or session containment is required. For example, access requests outside of normal business hours may require additional authentication steps.

What Location and Network Context Signals Matter Most?

Adaptive authentication systems can also use location and network context for their access decisions. These can include:

• Unfamiliar geolocation
• Risky autonomous system (ASN)
• Risky hosting/provider footprint
• Use of anonymizers
• Unexpected network types

Location information is often imperfect but may provide hints that an account has been compromised by an attacker. For this reason, this data should be combined with other signals to make risk decisions. For example, access requests from unusual locations could be an attempted attack or a traveling employee working remotely.

What Identity Risk Signals Matter? 

Identity risk signals help to identify accounts that are more likely to be compromised by an attacker. Examples include:

• Passwords included in past breaches
• Indicators of MFA fatigue
• Use of risky authentication methods
• Anomalous use of authentication tokens
• Access requests from known-bad IP addresses
• Repeated failed authentication requests

These signals help to identify accounts that are highly risky. These signals focus on account and credential security rather than device posture.

How Does Resource Sensitivity Change Enforcement?

A risk assessment may also be impacted by the sensitivity of the requested assets. Examples of high-risk assets include:

• Payroll data
• Admin consoles
• Customer PII
• Financial actions
• Bulk data exports

Requests for these actions may require additional authentication simply due to the additional risk that they pose to the business. This includes applying stricter controls even for the same user and device as lower-risk requests.

How Adaptive Access Control Works

Adaptive access control continuously manages access to an organization’s resources. It collects signals, calculates a risk score, takes any necessary enforcement actions, and repeats this process throughout the user’s session.

How Are Signals Collected and Normalized?

Signals are collected from a variety of different sources. Some originate from the user’s device, while others track information about their identity or come from third-party sources.

Adaptive access control systems normalize this data by converting the multi-source information into consistent inputs to the policy engine. In the event that data is missing, these gaps are handled explicitly rather than being assumed safe.

How Are Risk Decisions Made?

Risk decisions can be made in a few different ways. Some may involve risk thresholds or levels, while others may have requirements for specific scenarios. For example, access to highly sensitive resources may always trigger step-up authentication even if the overall risk score is relatively low.

These risks can also be evaluated on a per-user, device, session, or resource basis. This may include generating a policy matrix or threshold to define the various situations and required enforcement actions.

Where Can Enforcement Happen?

Enforcement actions can happen upon login or at various points throughout the user’s session. For example, the system may require step-up authentication mid-session or limit the actions that a user could take throughout their entire session.

There’s also the potential that access requests would be blocked entirely or that a session is terminated prematurely. However, this is most common for high-risk scores or for risky requests to highly sensitive resources.

Common Adaptive Enforcement Actions

Adaptive enforcement actions can run the gamut from strengthening authentication to completely denying an access request. Policies should define the appropriate enforcement action for various scenarios.

When Should Policies Trigger Step-Up Verification?

Step-up verification requires additional authentication steps, such as performing MFA. It’s designed to limit friction in the user experience by only requiring these additional steps when risk scores warrant it. 

For example, access requests from a new device or for a sensitive action may require additional verification. This provides a low-impact way to manage risk without causing additional harm to the user experience.

When Should Policies Restrict Actions Instead of Blocking Access?

Restricting the actions that a user can take within a session offers a middle ground between full access and session termination. For example, offering read-only access, blocking downloads, or limiting admin operations are ways to manage the potential impacts of a compromised account.

These restrictions are generally applied for highly sensitive resources or when risky signals have been observed for a session. They manage the organization’s risk exposure while causing less disruption to the business than a full block.

When Is Session Containment the Right Choice?

Session containment is a tool to limit the potential threat posed by a risky session. This can include implementing short session lifetimes, forcing reauthentication, or terminating sessions when needed.

Often, session containment is used in situations where risk scores rise in the middle of a session. These controls reduce the potential impacts of an attack and simplify incident response.

Where Adaptive Access Control Delivers the Most Value

Adaptive access control is designed to help implement the principle of least privilege and reduce the risk of misuse or account takeover attacks. When implemented properly, it balances security and the user experience, reducing load on IT helpdesks and security teams.

How Does It Reduce Account Takeover Impact?

Adaptive access control continuously monitors user sessions and can take enforcement actions in the middle of a user session. If a user’s account is compromised, it increases the likelihood of detection and restricts the attacker’s ability to take malicious actions and move laterally through the network.

How Does It Improve Access for Contractors and Third Parties?

Contractor and third-party access carries risks since it allows access to corporate resources from unknown and unmanaged devices. Adaptive access control helps to verify identity and assess risk for the third-party user and device. Additionally, organizations can limit access and privileges and implement time-bounded access to manage risk for these sessions.

Common Pitfalls and How to Avoid Them

Adaptive access control needs high-quality data and careful configuration to be successful. Otherwise, it runs the risk of false positive or false negative detections that harm the user experience or corporate security.

What Causes False Positives and User Friction?

False positive detections can cause unnecessary user friction since users will be required to perform additional verification and may not be able to access the requested functionality. Common causes of these issues include:

• Noisy signals
• Inconsistent baselines
• Overly strict thresholds

For example, a traveling or remote employee’s risk score may trigger additional enforcement actions. If this is the case, it may harm productivity, undermine adoption of the solution, or cause users to seek out workarounds that introduce additional risks to the business.

What Creates Blind Spots?

Adaptive access control may have some signal blindspots, such as incomplete visibility into a device, missing telemetry, or undefined policies for particular apps. Additionally, policies may become outdated as environments and systems change.

If data is missing, these unknowns should be considered as a sign of potential risks, rather than being ignored. Otherwise, signal gaps and blind spots could be deliberately exploited to conceal warning signs and defeat corporate policies.

How Should Policies Be Rolled Out and Tuned?

Policies should be rolled out gradually, allowing them to be monitored, tested, and tuned before moving on to the next stage. All information about this process should be documented as well to support future troubleshooting.

After the system is deployed, periodic reviews should be performed to identify potential issues and outdated policies. Additionally, organizations should define policies and procedures for managing exceptions to ensure that they are time-limited and necessary and don’t undermine security.

FAQs about Adaptive Access Control

Is Adaptive Access Control the Same as Conditional Access?

Adaptive access control and conditional access both use context to help make access decisions during login. However, adaptive access control also operates throughout an active session, reevaluating as needed based on changes to risk scores.

Does Adaptive Access Control Always Require MFA?

MFA is one potential enforcement action for adaptive access control, but it isn’t the only option. Other potential actions include restricting actions during a session, reducing session duration, or entirely blocking high-risk access attempts.

What Signals Matter Most When Device Posture Is Unknown?

Unknown device posture should be treated as higher-risk since it could mask highly risky signals. To compensate for these issues, adaptive authentication may require step-up authentication, reduce permissions, or gate access to sensitive information. Often, device trust is foundational for access management since a compromised device could place the organization at risk even in the hands of a legitimate, trusted user.

How Should Policies Handle Travel Without Constant Lockouts?

Policies can handle travel in a variety of different ways, with the potential to escalate enforcement and challenges as needed. For example, a policy may require step-up authentication or limit access for traveling devices. Risk can also be managed by combining location with other signals and strictly governing the use of temporary policy exceptions.

How Should Organizations Implement Adaptive Access Control Policies?

Adaptive access control policies should be implemented via a staged, controlled process. Key steps include:

• Identifying sensitive resources to protect
• Selecting signals to collect and analyze
• Defining risk states based on collected signals
• Mapping enforcement actions to risk states
• Performing pre-deployment testing
• Rolling out gradually
• Testing and tuning policies in production

Throughout this process, governance is critical for security. Organizations should log all actions, perform regular reviews, ensure explainability of all policies, and restrict and govern any exceptions.

Once deployed, adaptive access control should have predictable enforcement actions with a low false positive rate. Additionally, an effective system should have measurable improvements in terms of threat containment, user experience, and login-related IT helpdesk requests.