Protect the Gate – Not Only Once: Continuous Access Evaluation in Practice

In increasingly dynamic enterprise systems, accessing resources such as data and APIs from a static context is no longer a given. It is also common for users to access multiple services simultaneously within a session over an extended period. For example, the security posture of the accessing device may change during a session. Is the device still authorized to access specific resources in such a case? Continuous Access Evaluation addresses these and other problems related to changing context within a session. The basic principle of this technology is as follows: After each event that affects the context of access authorization, all participants in a session are informed. They then can decide on the continued authorization of access within a session for a user, an application, or a device. In this paper, we discuss the current state of this concept, ongoing standardization efforts and initial usage in large enterprise systems. Our findings indicate that the concept is well-defined and understood, resulting in rising academic interest in the topic. We assess ongoing progress in current standardization efforts, and also see notable adoption by major stakeholders.