Secured access control to cloud-based applications

1. A method for securing an access to a cloud-based application, comprising:

receiving, by an authentication proxy device, an authentication token, wherein the authentication token includes an identity of a user of a client device requesting an access to the cloud-based application, wherein the client device is at least an un-managed device, and wherein the authentication proxy device is connected between the un-managed client device and a cloud computing platform hosting the cloud-based application to be secured, wherein the un-managed client device is not secured by an organization;

receiving, from an agent executed in the un-managed client device, a client certificate;

retrieving, from a compliance server, a device posture of the un-managed client device, wherein the device posture is retrieved respective of the received client certificate;

identifying an access policy, from among a plurality of access polices configured with the authentication proxy device, for the un-managed client device to access the cloud-based application, wherein the access policy is identified based at least on the retrieved device posture; and

determining whether to grant an access to the cloud-based application based in part on the compliance of the un-managed client device with the identified access policy.

2. The method of claim 1 , further comprising:

checking if the agent is installed in the un-managed client device; and

causing at least one of: installation of the agent in the un-managed client device and execution of the agent in the un-managed client device, when the un-managed client device does not include the agent.

3. The method of claim 1 , wherein the device posture characterizes at least security capabilities that the un-managed client device is configured with.

4. The method of claim 3 , wherein the device posture includes at least a set of compliance parameters and a unique certificate associated with the un-managed client device.

5. The method of claim 4 , wherein each compliance parameter includes a compliance status of at least one of: at least one security capability of the un-managed client device.

6. The method of claim 4 , wherein the device posture is compiled using information provided by at least one of: a central authentication system, an end-point Data Loss Prevention (DLP) service, a network access control (NAC) service, and a mobile device management (MDM) service.

7. The method of claim 1 , wherein the access policy includes a plurality of attributes, a plurality of conditions, and a policy action.

8. The method of claim 7 , wherein determining whether to grant an access to the cloud-based application further comprises:

determining which of the plurality of conditions and of the plurality of attributes set in the access policy are met; and

allowing an access to the cloud-based application based on the determined met conditions and attributes.

9. The method of claim 8 , wherein the policy action includes any one of:

allow full access, block access, and allow limited access.

10. The method of claim 8 , wherein the determination of which of the plurality of conditions and attributes are met is performed using information retrieved from at least one of: a central authentication system, a compliance server, an external reputation service, and a lightweight directory access protocol (LDAP) service.

11. The method of claim 1 , further comprising: securing an access to the cloud-based application by a managed client device, wherein the managed client device and the un-managed client device are of the same user.

12. The method of claim 1 , wherein the authentication token is received from a central authentication system, wherein the central authentication system is any of: a federated identity management (FIdM) system, and a single-sign-on (SSO) server.

13. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1 .

14. An authentication proxy device for securing an access to a cloud-based application, wherein the authentication proxy device is connected between a client device and a cloud computing platform hosting the cloud-based application, comprising:

a processing system; and

a memory, the memory containing instructions that, when executed by the processing system, configure the proxy device to:

receive an authentication token, wherein the authentication token includes an identity of a user of a client device requesting an access to the cloud-based application, wherein the client device is at least an un-managed device, wherein the un-managed client device is not secured by an organization;

receive, from an agent executed in the un-managed client device, a client certificate;

retrieve, from a compliance server, a device posture of the un-managed client device, wherein the device posture is retrieved respective of the received client certificate;

identify an access policy, from among a plurality of access polices configured with the authentication proxy device, for the un-managed client device to access the cloud-based application, wherein the access policy is identified based at least on the retrieved posture; and

determine whether to grant an access to the cloud-based application based in part on the compliance of the un-managed client device with the identified access policy.

15. The proxy device of claim 14 , wherein the proxy device is further configured to:

check if the agent is installed in the un-managed client device; and

cause at least one of installation of the agent in the un-managed client device and execution of the agent in the un-managed client device, when the un-managed client device does not include the agent.

16. The proxy device of claim 14 , wherein the device posture characterizes at least security capabilities that the un-managed client device is configured with.

17. The proxy device of claim 16 , wherein the device posture includes at least a set of compliance parameters and a unique certificate associated with the un-managed client device.

18. The proxy device of claim 17 , wherein each compliance parameter includes a compliance status of at least one of: at least one security capability of the un-managed client device.

19. The proxy device of claim 17 , wherein the device posture is compiled using information provided by at least one of: a central authentication system, an end-point Data Loss Prevention (DLP) service, a network access control (NAC) service, and a mobile device management (MDM) service.

20. The proxy device of claim 14 , wherein the access policy includes a plurality of attributes, a plurality of conditions, and a policy action.

21. The proxy device of claim 20 , wherein the proxy device is further configured to:

determine which of the plurality of conditions and of the plurality of attributes set in the access policy are met; and

allow an access to the cloud-based application based on the determined met conditions and attributes.

22. The proxy device of claim 21 , wherein the determination of which of the plurality of conditions and attributes are met is performed using information retrieved from at least one of: a central authentication system, a compliance server, an external reputation service, and a lightweight directory access protocol (LDAP) service.

23. The proxy device of claim 20 , wherein the policy action includes any one of: allow full access, block access, and allow limited access.

24. The proxy device of claim 14 , further comprising:

securing an access to the cloud-based application by a managed client device, wherein the managed client device and the un-managed client device are of the same user.

25. The proxy device of claim 14 , wherein the authentication token is received from a central authentication system, wherein the central authentication system is any of: a federated identity management (FIdM) system, and a single-sign-on (SSO) server.

26. A cloud computing platform, comprising:

at least one server configured to host at least one cloud-based application;

a compliance server;

an authentication proxy device connected between the client device and the at least one server hosting the cloud-based application to be secured, wherein the authentication proxy device includes a processing system and a memory; the memory containing instructions that, when executed by the processing system, configure the authentication proxy device to:

receive an authentication token, wherein the authentication token includes an identity of a user of a client device requesting an access to the cloud-based application, wherein the client device is at least an un-managed device, wherein the un-managed client device is not secured by an organization;

receive, from an agent executed in the un-managed client device, a client certificate;

retrieve, from the compliance server, a device posture of the un-managed client device, wherein the device posture is retrieved respective of the received client certificate;

identify an access policy, from among a plurality of access polices configured with the authentication proxy device, for the un-managed client device to access the cloud-based application, wherein the access policy is identified based at least on the retrieved posture; and

determine whether to grant an access to the cloud-based application based in part on the compliance of the un-managed client device with the identified access policy.