What is Zero Trust Network Access (ZTNA)?

In organizations with remote employees, productivity depends on secure, reliable access to applications, services, and data over the Internet from any device, at any location or time. Yet the internet can expose IP addresses and create security risks due to implicit trust and a wealth of vulnerabilities. This is where zero-trust network access (ZTNA) comes in.

What is Zero Trust Network Access (ZTNA)?

Zero Trust Network Access (ZTNA) is an IT security solution that provides secure remote access to an organization’s applications, data, and services based on clearly defined access control policies. ZTNA differs from virtual private networks (VPNs) in that they grant access only to specific services or applications, whereas VPNs grant access to an entire network. As an increasing number of users access resources from home or elsewhere, ZTNA solutions can help eliminate gaps in other secure remote access technologies and methods.

How does ZTNA work?

Zero Trust Security is a big buzzword these days. While many organizations have shifted their priorities to adopt zero trust, zero trust network access (ZTNA) is the strategy behind achieving an effective zero trust model.

The path to zero trust as an ideology is vague, so ZTNA provides a clear, defined framework for organizations to follow. It’s also a component of the secure access service edge (SASE) security model, which, in addition to ZTNA, comprises next-gen firewall (NGFW), SD-WAN, and other services in a cloud-native platform.

While the need to secure a remote workforce has become critical, network-centric solutions such as virtual private networks (VPNs) and firewalls create an attack surface that can be exploited. ZTNA takes a fundamentally different approach to providing secure remote access to internal applications based on four core principles:

• ZTNA completely isolates the act of providing application access from network access. This isolation reduces risks to the network, such as infection by compromised devices, and only grants access to specific applications for authorized users who have been authenticated.
• ZTNA makes outbound-only connections ensuring both network and application infrastructure are made invisible to unauthorized users. IPs are never exposed to the internet, creating a “darknet” that makes the network impossible to find.
• ZTNA’s native app segmentation ensures that once users are authorized, application access is granted on a one-to-one basis. Authorized users have access only to specific applications rather than full access to the network. Segmentation prevents overly permissive access as well as the risk of lateral movement of malware and other threats.
• ZTNA takes a user-to-application approach rather than a traditional network security approach. The network becomes deemphasized, and the internet becomes the new corporate network, leveraging end-to-end encrypted TLS micro-tunnels instead of MPLS.

Benefits of Zero Trust Network Access

• Secure Remote Access – Due to COVID-19 majority of the workforce has shifted to work from home, many organizations are using virtual private networks (VPNs) however it has several limitations such as scalability and lack of integrated security. One of the major issues with VPNs is that authenticated users are granted complete access to the networks. Zero Trust networks implemented as part of Software-defined WAN (SD-WAN) or secure access service edge (SASE) solutions, give the ability to integrate Zero Trust network access into remote access solutions, reducing remote workers’ access to the network and restricting them only to what they require to perform as per their job role.
• Secure Cloud Access – Most organizations are adopting or moving to cloud computing, reduction in attack surface to limit access to cloud resources is the ultimate goal for organizations. Each user and application are assigned a role within the Zero trust network access solution with appropriate permissions over cloud resources.
• Minimize Risk of Account Compromise – Attackers try to steal or guess user credentials and use them to gain access to organization systems. Implementation of Zero trust network access helps to minimize the level of access and limit the attacker’s ability to move laterally in the organization’s network
• Support for Compliance Initiatives – Zero trust network access protects users and due to the cloak of invisibility the demonstration of compliance is simpler with all privacy standards.
• Reduction in Data Breach risk – Zero trust network access principle assumes every device, or workload is hostile. Each request is inspected and so is the authentication of users and devices. Trust is re-evaluated in the event when the moment of context is changed such as user location.
• Ease of Integration – Organizations not using cloud computing may have different private networks, servers, and other computing devices. Going through a lot of procedures to integrate security modules could be a tedious task which is different in Zero trust network access as integration and implementation are easy and flexible (Based on access control policies)

How to implement Zero Trust Network Access

ZTNA functionality can be implemented within an organization’s ecosystem in several different ways:

• Gateway Integration: ZTNA functionality can be implemented as part of a network gateway. Any traffic attempting to cross the network boundary defined by the gateway solution will be filtered based on the defined access control policies.
• Secure SD-WAN: SD-WAN implements optimized networking across the corporate WAN, and Secure SD-WAN integrates a security stack into each SD-WAN appliance. ZTNA functionality can be incorporated into this security stack to provide centralized access management.
• Secure Access Service Edge: SASE takes the functionality of Secure SD-WAN and hosts it as a virtual appliance in the cloud. This enables an organization to maximize both network efficiency and security, including ZTNA functionality.

ZTNA Use Cases

ZTNA fits many use cases. Here are some of the most common:

• VPN Alternative – Connect mobile and remote users more securely than legacy VPN. ZTNA is more scalable, provides one security policy everywhere, works across hybrid IT, and offers more fine-grained access. Gartner projected that by 2023, 60% of enterprises would switch from VPN to ZTNA.
• Reduce third-party risk – Give contractors, vendors, and other third parties access to specific internal applications — and no more. Hide-Sensitive Applications – Render applications are “invisible” to unauthorized users and devices. ZTNA can significantly reduce the risk posed by insider threats.
• Secure M&A integration – ZTNA reduces and simplifies the time and management needed to ensure a successful merger or acquisition and provides immediate value to the business.

Conclusion

ZTNA is becoming more common in the enterprise. The rising level of security threats, coupled with the work-from-home trend, make it a natural evolution in network access. The increasing prevalence of SASE also makes ZTNA a technology that many companies are now considering. Deploying ZTNA can be a step-by-step process that works in tandem with tidying up outdated access control policies. Organizations that are not currently evaluating ZTNA should undoubtedly put it on their radars.