As organizations increasingly adopt Zero Trust architectures, they face a significant challenge: ensuring that access decisions remain accurate as real-world conditions evolve. A recent analysis by CrowdStrike highlights the complexities of continuous authorization within Zero Trust frameworks, emphasizing the need for a robust solution to manage access dynamically in response to changing circumstances.
Zero Trust fundamentally shifts the security paradigm from a “walled garden” approach, where internal users are assumed to be trusted, to a model that requires independent evaluation of every access request. This transition has been accelerated by factors such as the rise of remote work, mobile access, and cloud transformation, which have rendered traditional security measures inadequate.
The Continuous Authorization Challenge
In a Zero Trust environment, the validity of access tokens or session cookies must be continuously assessed. However, several critical questions arise: How can organizations revoke access instantly in response to urgent events, such as employee terminations? What happens when the conditions that justified the issuance of an access token change while it remains valid? How can organizations ensure that the scope of access remains appropriate as user roles evolve?
To address these issues, organizations typically consider two strategies: using short-lived tokens or re-validating tokens at each access request. However, both approaches have significant drawbacks. Short-lived tokens can degrade user experience due to frequent re-authentication, while re-validating tokens at every access can impose an unsustainable burden on identity providers (IdPs), especially in high-traffic environments.
Evaluating Access in Real Time
Effective continuous authorization requires evaluating multiple factors at the time of access, including the validity of the user account, the security status of the accessing device, compliance with device management policies, and any changes in the user’s role or status. This necessitates real-time access to disparate data sources, which are often spread across various systems, including identity directories, extended detection and response (XDR) systems, and human resources platforms.
The challenge lies in the need for rapid evaluation without overwhelming the IdP or degrading user experience. This brings us to the concept of the continuous authorization conundrum: Zero Trust demands that access be evaluated in milliseconds, but the necessary data is often distributed across loosely connected systems.
Implementing a Solution
To overcome these challenges, organizations can adopt a new architectural approach that leverages asynchronous data delivery. This involves externalizing the evaluation of access requests to a policy enforcement point, rather than embedding it within application code. By doing so, organizations can ensure that access decisions are based on the most current data available without incurring excessive overhead.
The implementation of this architecture relies on the principles of reliably delivering changes in data required for access decisions and evaluating requests based on locally available information. However, the complexity arises from the need to synchronize data across multiple providers, each with its own systems and protocols.
The Role of Open Standards
Open standards play a crucial role in facilitating this synchronization. The OpenID Foundation has developed the Shared Signals Framework (SSF), which provides a reliable mechanism for transmitting Security Event Tokens (SETs). These tokens, which are signed JSON Web Tokens (JWTs), enable systems to communicate changes in access conditions asynchronously, allowing for near real-time decision-making.
Additionally, the Continuous Access Evaluation Profile (CAEP) defines specific events that can trigger changes in access permissions, such as session revocation or changes in device compliance. By adopting these standards, organizations can ensure that the necessary data is available to trusted parties, enabling effective continuous authorization.
Industry Adoption and Future Directions
The adoption of SSF and CAEP is gaining momentum across the industry, with major technology providers like Apple, Google, IBM, and Okta integrating these standards into their products. Recent demonstrations, such as the collaboration between CrowdStrike and Zscaler, showcase how these frameworks can facilitate Zero Trust access based on real-time data from security incidents.
As organizations continue to navigate the complexities of Zero Trust, it is essential for security and identity vendors, as well as cloud service providers, to support SSF and CAEP. This will not only enhance security but also improve user experience by enabling seamless access management in response to changing conditions.
In conclusion, addressing the continuous authorization conundrum is critical for the successful implementation of Zero Trust architectures. By leveraging open standards and asynchronous data delivery, organizations can create a more secure and efficient access management framework that adapts to the dynamic nature of modern work environments.
For further insights on this topic, you can read more about the Shared Signals Framework and its implications for Zero Trust access management in CrowdStrike’s detailed analysis here.
