Box upgrades Device Trust to improve zero-trust access

Get a free Techzine subscription!

Box updates its Device Trust service to help customers enforce zero-trust policies. Device Trust 2.0 is available to all Box Enterprise users at no additional cost.

Box Device Trust 2.0 assesses the security status of the device the employee is using. Access requests are reviewed based on details about the users, their tasks, and the security status of the device being used. This allows employees to work securely from any location without the need for a VPN.

Access requirements are determined by Box users themselves but can include things as domain membership, device certificates or controls for disk encryption, antivirus software, operating system versions, and device passwords. With the zero-trust security model, any access request is considered unreliable.

Device Trust verifies the device in use and requires a user to have a signed client certificate. Device Trust also has flexible ownership checks that allow devices to meet one or all security requirements in hybrid information technology environments.

No device is safe

In the announcement, Box talks about flexible, enterprise-grade device security. “If an employee loses his phone, and it has no disk encryption or password, your sensitive business content can easily fall into the wrong hands. With Device Trust, you don’t assume personal devices are safe,” says Box. So security is checked before accessing Box.

Audit Mode

The renewed service also allows companies to track and test endpoints used to access Box for security through a new audit mode.

“The new ‘audit-only mode’ allows administrators to test and evaluate Device Trust before permanently enabling the new feature. In this mode, employees will still be able to access Box if their device fails the checks, but administrators will be able to evaluate the test results. In early June, detailed reports will be available in the admin console, and results will be tracked in the Box Events Stream and accessible through the API,” Box said.

Earlier this month, Box announced new features to make its service more productive when working from home.