Posey's Tips & Tricks
When AI Goes Wrong: The Hidden Risks of Conditional Access Controls, Part 3
Overly aggressive AI-driven conditional access controls could not only lock employees out of needed resources but also trigger HR systems to misinterpret risk scores as poor performance, potentially jeopardizing careers.
In the previous post in this series, I explained that an overly aggressive AI engine could potentially cause conditional access to begin unfairly punishing a user who hasn't really done anything wrong. This can happen as a result of weighted historical memory that does not decay old risks and allowing historical data to overly influence future predictions. Such problems are well documented and are difficult to correct because vendors rarely disclose how trust scores are calculated and because some AI systems are allowed to tune themselves without human oversight. The only real fix for a user who is trapped in a negative feedback loop is to reset the user's trust score, though a mechanism for doing so might not even exist (depending on which conditional access software is being used).
The thing that I find even more concerning than an overly aggressive conditional access system however, is the potential for the system's distrust of a user to ruin the user's career. No, I'm not kidding. There are a couple of different ways that I could envision this playing out.
The simplest way that I could imagine an overly aggressive conditional access mechanism placing a user's job in jeopardy is by frequently denying a user access to the resources that the user needs in order to do their job. So many companies base performance reviews on quantifiable performance metrics if a user is often locked out of the resources that they need in order to do their jobs, that user may be seen as underperforming. Yes, a fair boss would acknowledge that this lack of performance is not the employee's fault. Even so, there are way too many companies that rigidly adhere to policy, regardless of any extenuating circumstances.
But let's put resource lockouts aside. Are there other ways in which a conditional access system's AI could inflict so much harm that it causes an innocent employee to lose their job? Well. I haven't heard of this happening in the real world, at least not yet, but I do believe that it is plausible.
Let's suppose for a moment that an employee occasionally travels for their job. While away on one of these trips, the employee's laptop fails, forcing them to access the organization's resources using a personal device that is connected to the hotel's Wi-Fi. This causes the conditional access mechanism to flag the employee as high risk. The employee's trust score is also downgraded as a result.
Upon returning to the office, the employee is issued a new laptop that is properly enrolled into the system. Even though the employee is now working from a trusted device that is connected to a trusted network, the negative feedback loop that I discussed in the previous article causes the employee's logins to be more heavily scrutinized. The employee will likely receive frequent and annoying MFA challenges as a result. This would likely drive the employee to avoid any unnecessary logins or online activities. Furthermore, some SaaS suites, such as Microsoft 365 leverage user risk data across the entire suite of products.
If the organization's HR system is tied to a zero-trust system then the employee's low trust score and less frequent collaboration might be interpreted as a lack of engagement on the part of the employee. This could result in the employee being passed over for sensitive projects because the employee is now considered to be high risk. Similarly, the perceived lack of engagement could lead to poor performance reviews, and ultimately dismissal from the organization.
If this seems far fetched, then keep in mind that there are tools such as Microsoft Viva (and Viva Glint) that seek to measure and track employee engagement. Such tools vary in scope, but may provide actionable insights designed to help the organization identify and correct issues with its employees.
So is all of this to say that a couple of risky logins will cause Microsoft Viva or some other tool to recommend terminating an employee? No, of course not. It doesn't work that way (at least not yet). However, whenever conditional access systems and HR systems begin to share risk data, which seems inevitable at this point, it will only be a matter of time before HR decisions begin to be made based on the level of perceived risk associated with an employee.
About the Author
Brien Posey is a 22-time Microsoft MVP with decades of IT experience. As a freelance writer, Posey has written thousands of articles and contributed to several dozen books on a wide variety of IT topics. Prior to going freelance, Posey was a CIO for a national chain of hospitals and health care facilities. He has also served as a network administrator for some of the country's largest insurance companies and for the Department of Defense at Fort Knox. In addition to his continued work in IT, Posey has spent the last several years actively training as a commercial scientist-astronaut candidate in preparation to fly on a mission to study polar mesospheric clouds from space. You can follow his spaceflight training on his Web site.