Enterprise Networking Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Zero trust network access (ZTNA) is an approach to enterprise IT security that provides secure remote access to a company’s data, applications, networks, and services based on defined access control policies.
ZTNA establishes multiple layers of protection by assuming that any connection will be malicious, and therefore placing various security mechanisms between the user and the organization’s resources. As a result, authentication occurs at each layer and not just once at a centralized point.
Table of Contents
How does zero trust network access work?
The fundamental concept of ZTNA is to segregate critical assets on a network by not trusting the endpoint devices. In other words, when accessing a resource, an end-user device must authenticate before being allowed access to the resource or part of the network.
A zero trust network assumes that any device can potentially be compromised, so it restricts access to resources based on user location, authentication level, and risk assessment of the endpoint accessing the resource. For example, with ZTNA, access to a specific service is granted when successful authentication.
ZTNA operates on the principle of “zero trust, always verify.” A zero trust approach requires all users, devices, systems, networks, and resources to be treated as untrusted outsiders. It asserts that IT should move away from the monolithic model where all devices have unrestricted access to all applications, and the “always verify” part means that there’s no such thing as an implicitly trusted insider or external system. Every identity is presumed to be risky until proven otherwise by authentication from an acceptable source at the appropriate level.
In contrast to virtual private networks (VPNs), zero trust technologies have a “deny by default” policy and only allow access to the services for which the user has been granted access. That way, if one area becomes compromised, attackers are not automatically given full access to other areas of the organization.
When implementing ZTNA, organizations should take a layered security approach with multiple controls between the outside world and their sensitive data or infrastructure. The different layers act as obstacles, making it difficult for attackers to reach their target.
What are the differences between VPN and ZTNA?
The main difference between VPNs and ZTNA are their access levels, their endpoint posture assessments, and the visibility they grant into user activity.
Network-level access vs. application-level access
VPNs grant access to the entire network and all apps and services housed on it, while ZTNA grants access only to specific apps or services, meaning that before the user can access the apps or services on their network, they must complete an authentication process. This could include any combination of user identity, user or service location, time of the day, type of service, and security posture of the device.
Endpoint posture assessment
Whether granting device access to enterprise network applications through a VPN or ZTNA, it’s important to assess its endpoint posture. An endpoint’s posture refers to how compliant an endpoint is with corporate policy security requirements. These include:
- Antivirus software
- Anti-spyware software
- Password complexity requirements
- Software update frequency settings
While VPNs don’t consider the risks posed by end-user devices and apps after they’ve granted access, ZTNA does. ZTNA continuously monitors all endpoints after connecting to the enterprise network by validating their security posture.
Visibility into user activity
ZTNA provides a granular level of visibility into user activities across apps and services, making unusual behavior and malicious intent easier to detect. When an employee takes actions outside of approved apps or services, there’s a better chance that IT will know about it because ZTNA operates at the level of individual applications or services.
Since VPNs don’t offer application-level control, they lack such visibility into users’ actions once they are inside the private network.
5 benefits of implementing ZTNA
ZTNA offers enormous benefits to organizations, including enhanced compliance, improved security posture and agility, and application microsegmentation.
Enhanced compliance
Since it requires users to authenticate each time they want to access data in any given application, ZTNA allows an organization to more easily adhere to regulatory requirements, such as PCI DSS, GDPR, HIPAA/HITECH, and NIST SP 800-53A. It ensures employees don’t purposely or inadvertently skirt compliance or sacrifice data protection.
Securing access to legacy applications
By enabling encrypted connections and providing the same degree of security benefits as web apps, ZTNA can be used to enhance the security of legacy applications running in private data centers or on-premises servers.
Application microsegmentation
With ZTNA, companies can create a software-defined perimeter (SDP) that utilizes identity and access management (IAM) technologies to segment their application environments. This technique allows companies to divide their network into multiple microsegments to prevent lateral threat movement and reduce the attack surface by compartmentalizing business-critical assets.
Agile security posture
The agile security posture provided by ZTNA enables companies to quickly change their defense tactics rapidly based on an evolving cyberthreat landscape.
Makes applications invisible
ZTNA creates a virtual darknet that prohibits app availability on the public internet. In addition, ZTNA monitors the data access patterns of all applications, which helps minimize risk and secure enterprises against distributed denial-of-service (DDoS) attacks, data leakage, and other cyberattacks.
What are the main challenges of ZTNA?
While ZTNA offers many benefits, it also has some drawbacks and challenges that are worth noting in order to get ahead of them. They include complex implementation, adoption and training, decreased productivity, and impacts on performance.
- Implementation complexity: Implementing a ZTNA solution can be complex, especially for organizations with existing legacy systems and complex network architectures.
- Adoption and training: Transitioning to a ZTNA model may require significant changes in an organization’s security practices and user behavior. Training employees on the new access methods and addressing resistance to change can be challenging.
- Decreased productivity: Similarly, the additional authentication requirements require employees to spend more time logging in and requesting access to critical business applications, and even occasionally getting locked out of them due to false positives.
- Continuous updates and maintenance: ZTNA requires constant monitoring, updates, and maintenance to stay effective against evolving security threats. Organizations must proactively manage and upgrade their ZTNA infrastructure to ensure its efficacy.
- Performance impact: ZTNA typically involves routing traffic through intermediaries, which can introduce additional latency. This performance impact may be acceptable for certain applications or users, but it can be challenging for latency-sensitive or bandwidth-intensive applications.
Top zero trust network access use cases
ZTNA can be used effectively for everything from authentication and access control to visibility and analysis, and even data loss prevention (DLP) and enforcement.
Authentication and access
Rather than a single credential or point of access, users in a zero-trust network have to authenticate themselves at every login session to gain access to specific data resources on a given system. So, for example, they might be able only to see certain files stored on one server rather than having all files visible.
User account management
ZTNA changes how user accounts are managed by creating different control and access policies for different types of users, such as contractors, suppliers, vendors, customers, and partners, with varying levels of access to sensitive information within an organization’s network.
Visibility and analysis
A zero-trust approach enables tracking of both authorized and unauthorized activity across the enterprise’s various assets (systems and databases). This enables organizations to detect anomalous behavior to protect against threats before any damage occurs.
Integrating ZTNA into a secure access service edge (SASE) solution helps organizations to get the most out of their investment in this technology. When implemented correctly, SASE solutions will provide granular visibility and automate actions based on preconfigured rules around risks and vulnerabilities. As a result, security teams can now manage risk proactively through automation rather than reactively through manual intervention.
Real-time data loss prevention (DLP) inspection and enforcement
ZTNA offers organizations real-time DLP inspection capabilities. Continuous monitoring enables detection and mitigation of internal threats without needing constant scanning that could overwhelm IT infrastructure.
Organizations can identify who is accessing what content, when it was accessed, and where the access originated with greater detail, empowering them to make better decisions about what should be shared internally and externally.
Remote access from any device, including unmanaged BYOD devices
Mobile employees, remote office workers, and visiting guests may be required to access company networks remotely through the internet or a VPN. Zero trust networking can support this requirement by implementing multifactor authentication (MFA) for remote connections and encrypting traffic to protect intellectual property.
With the help of strong authentication, enterprises can maintain strict compliance requirements and data privacy laws while preventing malicious attacks and blocking malware on their networks.
ZTNA 1.0 vs. ZTNA 2.0
Cybersecurity juggernauts Palo Alto Networks introduced ZTNA 2.0 in early 2022 as a way to improve on weaknesses in ZTNA 1.0’s least privilege application.
When access is granted in traditional ZTNA 1.0, the model is blind to whatever the user or application does within the overall enterprise system.
ZTNA 2.0 adopts a much stricter “never trust, always verify” principle. It eliminates the concept of trust entirely, limiting lateral movement and minimizing the attack surface area by continuously verifying trust based on changes in device posture, user behavior, and app behavior.
Analysts are somewhat divided on whether ZTNA 2.0 is a marketing buzzword or a truly revolutionary development of the technology. Although ZTNA 2.0 undeniably addresses flaws in the original application of ZTNA principles, it’s worth noting that most other zero trust organizations have implemented many of the same improvements as ZTNA 2.0 under other names.
Should your organization use ZTNA?
Implementing a ZTNA approach in your organization depends on your current security needs and posture. You should consider ZTNA if:
- You have a remote workforce.
- You have compliance needs.
- Your organization faces high cybersecurity threats.
- Your network is complex and extends beyond local area networks (LANs) to include partner networks, cloud environments, and remote staff.
To maintain a progressive attitude towards security, if your organization views cybersecurity as a top priority, you may want to use ZTNA to protect organizational assets from threats.
How to implement ZTNA
In order to build a zero trust network, enterprises should follow the ZTNA principle to identify, classify, and authenticate users accessing their networks.
ZTNA can be deployed as a standalone solution or ZTNA as a service. The former requires organizations to build their ZTNA infrastructure and work independently in configuring an identity management system and deploying network access control (NAC) devices.
The latter, on the other hand, offers a quick way to deploy ZTNA via third-party vendors. With this approach, organizations must purchase a software license from these providers and install it on their servers to enable centralized management of all endpoints in the organization’s network.
Featured Zero Trust Software
Bottom line: Protecting your data with ZTNA
The decision to implement ZTNA as part of your organization’s security strategy depends on your specific needs and circumstances. However, doing so will ultimately strengthen your infrastructure and manage user and application access to your network.
Even if you have other security systems in place, you can’t be over-protected, as each type of security measure offers unique capabilities. Adding ZTNA to your security strategy will not only control access to sensitive data, but it will also reduce the attack surface and simplify your IT operation.
If you’re considering implementing zero trust in your organization, start with our guide to the best ZTNA solutions available today.
