For almost two decades, enterprise security has revolved around identity. If you can prove who you are through password management, then you’re in. Which is why Identity and Access Management (IAM), Multi-Factor Authentication (MFA), Privileged Access Management (PAM), and more recently, Zero Trust have evolved. Businesses use ID to manage access and every improvement in authentication has made that process better. But security is not the only thing to have evolved.
In many cases, authentication isn’t even an issue for attackers. Adversary-in-the-middle attacks mean they can bypass logins altogether. Tokens can be extracted from compromised devices. And where login details are needed, they can be stolen or bought, so access doesn’t look like intrusion. And identity ceases to be a barrier.
Identity isn’t enough
The thing about a successful login is that it only tells you that someone has provided the appropriate details to access your system. But when there are so many ways to navigate that step, it’s really not enough. What you really need to know is whether a login makes sense. Could a person who normally works in Luton log in from Singapore at 3am, when they were in the office just a few hours earlier?
Identity goes no way towards answering that question. All it does is establish who someone claims to be, not whether the claim is viable. And that’s a really important distinction. Especially with hybrid working, cloud services and globally distributed teams becoming more common. The traditional network perimeter has largely disappeared, making contextual signals, like geofencing, much more useful.
Geofencing is more than a geographical boundary
Geofencing is often thought of as a simple way to block access from certain locations. But it holds so much more potential than that. And some new identity platforms are already taking advantage of it. Microsoft Entra and Okta, for example, use location as part of their Conditional Access policies. Using cues such as device health, previous activity and session information to decide how a login should be handled. And they’re opening the potential for more than access or denial.
A login might be allowed immediately, trigger an additional authentication challenge, or be blocked, depending on the overall level of risk. People travel and work remotely, so not every unfamiliar location poses a threat. And blocking locations arbitrarily can limit the potential for productivity. The true value of geofencing is that it provides another piece of evidence that can support informed decision-making. And that matters, because different logins carry different degrees of risk.
Context supports understanding
When used alone, geofencing is rarely effective. But when integrated with a wider security strategy, it carries real value.
When connected to Security Information and Event Management (SIEM) platforms, location information can be combined with other signals – impossible-travel events, unusual login times, privilege escalation attempts, unmanaged devices and behavioural anomalies – to deliver missing context. Creating a complete picture of what’s happening. And enabling businesses to more fully assess whether a login request is likely to be valid or fraudulent.
Location isn’t always what it seems
Like any security control, geofencing has limitations. VPNs can hide a user’s location. Cloud infrastructure can make legitimate activity appear to originate from an unexpected country. And IP-based geolocation isn’t always precise, particularly on mobile networks. Businesses also have to account for executives who travel, contractors working across borders and field employees who move between offices, sites and home.
Authentication tokens add in another complication. Some apps can continue operating during an authenticated session without repeatedly reassessing the user’s location, so a location check at login doesn’t necessarily tell the whole story of what happens afterwards.
So, geofencing isn’t infallible and it’s not 100% effective. But neither is any other form of digital security. And that reinforces a principle that every business needs to understand: no single signal should be trusted in isolation.
Better questions are needed
For most businesses, adding location-based controls doesn’t require a new security architecture. Conditional Access policies are already supported by a number of platforms. They have the capability to use location as part of an access decision. They can even apply these policies selectively, identifying privileged accounts, sensitive applications and higher-risk regions; anywhere they think it necessary. It’s just that businesses either don’t know those options are there, or that they’ve listened to the dismissal of geofencing for too long.
Attackers will keep on finding ways to breach companies. And the businesses that rely on identity authentication alone will keep falling prey. But the option is there to make things harder. And that starts with the question, ‘Who are you?’, but continues with asking ‘Where are you?’, ‘Does that location make sense?’ and ‘Why are you logging in?’
By William Thackray, Operations Director, of AGT Computer Services.
- Cybersecurity