Resource access management based on confidence level in device posture
View Patent ↗Systems and methods are described herein for assessing the device posture of user devices requesting access to a managed resource and for determining a confidence level in the device's posture. In an example, a user device can request a managed resource. A server can receive the request and retrieve an associated access policy. The access policy can include policy attributes to use for assessing the user device's device posture. The server can calculate a device attribute score for each policy attribute. The server can also calculate a confidence score for each device attribute score that measures the confidence level in the device attribute score. Using the two scores, the server can calculate a device posture score. Access to the resource can be granted or denied based on whether the device posture score exceeds a threshold score designated in the access policy.
1. A method for determining confidence in device posture, comprising:
receiving a resource access request for a managed resource;
retrieving an access policy associated with the managed resource;
retrieving device data corresponding to a first policy attribute identified in the access policy;
determining, based on the device data, a first device attribute score corresponding to the first policy attribute,
determining a first confidence score corresponding to the first policy attribute;
determining, using the first device attribute score and the first confidence score, a first device posture score;
comparing the first device posture score to a first threshold from the access policy; and
in an instance where the first device posture score exceeds the first threshold, granting access to the managed resource.
2. The method of claim 1 , further comprising:
in an instance where the first confidence score does not exceed the first threshold, identifying, based on the access policy, a second policy attribute;
determining a second device posture score associated with the second policy attribute;
comparing the second device posture score to a second threshold from the access policy; and
in an instance where the first confidence score exceeds the second threshold, granting access to the managed resource.
3. The method of claim 1 , further comprising:
in an instance where the first confidence score does not exceed the first threshold, providing, to a user device that provided the request for the managed resource, remediation instructions for accessing the managed resource;
receiving data indicating that the remediation instructions were completed successfully; and
granting access to the managed resource.
4. The method of claim 1 , further comprising:
in an instance where the first confidence score does not exceed the first threshold, determining that the first device posture score exceeds a second threshold from the access policy; and
based on the first device posture score exceeding the second threshold and not exceeding the first threshold, granting limited access to the managed resource.
5. The method of claim 1 , wherein calculating the first confidence score corresponding to the first policy attribute comprises:
determining, using historical data associated with the first policy attribute, an anticipated frequency of change to the first policy attribute;
determining, using the device data, a measured frequency of change of the policy attribute; and
comparing the anticipated frequency of change to the first policy attribute and the measured frequency of change to the first policy attribute.
6. The method of claim 1 , wherein the first confidence score is based on an age of the device data.
7. The method of claim 1 , further comprising:
calculating, based on the device data, a second device attribute score corresponding to a second policy attribute identified in the access policy; and
calculating a second confidence score corresponding to the second policy attribute, wherein the first device posture score is calculated also using the second device attribute score and the second confidence score.
8. A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor, causes the processor to perform stages for determining confidence in device posture, the stages comprising:
receiving a resource access request for a managed resource;
retrieving an access policy associated with the managed resource;
retrieving device data corresponding to a first policy attribute identified in the access policy;
determining, based on the device data, a first device attribute score corresponding to the first policy attribute,
determining a first confidence score corresponding to the first policy attribute;
determining, using the first device attribute score and the first confidence score, a first device posture score;
comparing the first device posture score to a first threshold from the access policy; and
in an instance where the first device posture score exceeds the first threshold, granting access to the managed resource.
9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
in an instance where the first confidence score does not exceed the first threshold, identifying, based on the access policy, a second policy attribute;
determining a second device posture score associated with the second policy attribute;
comparing the second device posture score to a second threshold from the access policy; and
in an instance where the first confidence score exceeds the second threshold, granting access to the managed resource.
10. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
in an instance where the first confidence score does not exceed the first threshold, providing, to a user device that provided the request for the managed resource, remediation instructions for accessing the managed resource;
receiving data indicating that the remediation instructions were completed successfully; and
granting access to the managed resource.
11. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
in an instance where the first confidence score does not exceed the first threshold, determining that the first device posture score exceeds a second threshold from the access policy; and
based on the first device posture score exceeding the second threshold and not exceeding the first threshold, granting limited access to the managed resource.
12. The non-transitory, computer-readable medium of claim 8 , wherein calculating the first confidence score corresponding to the first policy attribute comprises:
determining, using historical data associated with the first policy attribute, an anticipated frequency of change to the first policy attribute;
determining, using the device data, a measured frequency of change of the policy attribute; and
comparing the anticipated frequency of change to the first policy attribute and the measured frequency of change to the first policy attribute.
13. The non-transitory, computer-readable medium of claim 8 , wherein the first confidence score is based on an age of the device data.
14. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
calculating, based on the device data, a second device attribute score corresponding to a second policy attribute identified in the access policy; and
calculating a second confidence score corresponding to the second policy attribute, wherein the first device posture score is calculated also using the second device attribute score and the second confidence score.
15. A system for determining confidence in device posture, comprising:
a memory storage including a non-transitory, computer-readable medium comprising instructions; and
a hardware-based processor that executes the instructions to carry out stages comprising:
receiving a resource access request for a managed resource;
retrieving an access policy associated with the managed resource;
retrieving device data corresponding to a first policy attribute identified in the access policy;
determining, based on the device data, a first device attribute score corresponding to the first policy attribute,
determining a first confidence score corresponding to the first policy attribute;
determining, using the first device attribute score and the first confidence score, a first device posture score;
comparing the first device posture score to a first threshold from the access policy; and
in an instance where the first device posture score exceeds the first threshold, granting access to the managed resource.
16. The system of claim 15 , the stages further comprising:
in an instance where the first confidence score does not exceed the first threshold, identifying, based on the access policy, a second policy attribute;
determining a second device posture score associated with the second policy attribute;
comparing the second device posture score to a second threshold from the access policy; and
in an instance where the first confidence score exceeds the second threshold, granting access to the managed resource.
17. The system of claim 15 , the stages further comprising:
in an instance where the first confidence score does not exceed the first threshold, providing, to a user device that provided the request for the managed resource, remediation instructions for accessing the managed resource;
receiving data indicating that the remediation instructions were completed successfully; and
granting access to the managed resource.
18. The system of claim 15 , the stages further comprising:
in an instance where the first confidence score does not exceed the first threshold, determining that the first device posture score exceeds a second threshold from the access policy; and
based on the first device posture score exceeding the second threshold and not exceeding the first threshold, granting limited access to the managed resource.
19. The system of claim 15 , wherein calculating the first confidence score corresponding to the first policy attribute comprises:
determining, using historical data associated with the first policy attribute, an anticipated frequency of change to the first policy attribute;
determining, using the device data, a measured frequency of change of the policy attribute; and
comparing the anticipated frequency of change to the first policy attribute and the measured frequency of change to the first policy attribute.
20. The system of claim 15 , wherein the first confidence score is based on an age of the device data.