What Is Zero Trust Network Access?

Zero Trust Network Access is a concise framework that enables and maintains secure access to internal applications and resources.

Perimeter 81

07.07.2024

6 min read

The concept has become increasingly prevalent since President Biden issued an executive order that mandated its use.

The History of Trust in Network Security

Executive Order 14028 marked a major shift in the tide of cybersecurity, mandating that government agencies should begin migration toward zero trust principles. Since then, however, there’s been widespread confusion over what trust is – and what role Zero Trust Network Access (ZTNA) needs to play.

Once, the amount of devices – and subsequent network sizes – in use within organizations meant that trust was pretty easy to give. Whoever was physically sitting at one of the office’s computers – which itself accessed data via the server stacks hosted a few rooms over – was probably safe. Confirming that the employee was who they claimed to be was simply achieved with a single authentication process at startup.

But as corporate networks have evolved, the concept of trust has developed far beyond where one sits. Today, employee productivity hinges on swathes of individual, cloud-based applications – with microservice access requirements that are transient and ever-changing. 

On the human end of things, employees can be based from anywhere in the country – or even further afield. Nowadays, granting access to something assumes that the user, service, or device is:

1. Who – or what – they claim to be.
2. Allowed access to the resource being requested.
3. Behaving in a correct and expected manner.

The key word is assume: rarely do all of these factors get genuinely assessed before access is granted. 

This is because it’s typically been easier and cheaper to just assume trust from a single source – such as a VPN login. 

What Is Zero Trust Network Access?

Zero Trust Network Access reconsiders the way in which a user’s validity is assessed – where, instead of one single point of identity verification, it’s a continuous and adaptive process. 

Every time a resource is requested, ZTNA demands three types of proof:

1. Who is this user, service, or application, and should it have access to this resource?
2. Is the device or infrastructure this request originates from known and expected?
3. Is this device in the expected state and free from compromise?

These questions show how ZTNA runs much deeper than authentication and authorization. System integrity, system hardening, configuration management, vulnerability management, and network monitoring are all components that play equal roles in assessing whether a device or service can be trusted.

Supercharge Your Business Security

Request Demo

Start Now

Key Features of ZTNA

Here are the key features of ZTNA.

IdP Integration

Your current Identity Provider should be the foundation for ZTNA: by integrating with providers such as Azure Directory, OKTA, and OneLogin, your security teams are able to grant or deny access with minimal infrastructural overhaul.

Least Privilege Access

Users are granted the minimum level of access necessary to perform their tasks; this is defined by the security team on a group-by-group basis, becoming more granular as your ZTNA maturity improves. 

Dynamic Access Control

Access is granted or denied based on contextual factors that interconnect – from user roles, to device health, and account behavior. 

This allows for adaptive responses to changing conditions and potential threats.

Rapid Re-Authentication

ZTNA solutions securely cache authentication tokens and user credentials. This allows for rapid re-authentication without latency issues; this speed is also achieved by architecture that queries the changes that have occurred since the last session, rather than re-checking every aspect of every credential.  

Application-Level Segmentation

ZTNA reassesses how services are offered to a user. Once connected, IP addresses, services, and devices remain unlisted to the rest of the network. By relying solely on this one-to-one connection between a user and a service, the scope for lateral movement is greatly diminished. 

ZTNA vs VPN: A Rapid-Fire Comparison

When a user logs in via VPN, they are given access to the entirety of that relevant network. ZTNA solutions, on the other hand, identify the validity of an authorized user, and then provide access directly to the application or workload being asked for, rather than the entire network.

From a hardware standpoint, ZTNA tools are very different from VPNs, as the latter often require on-premises service that users then need to connect to – getting them past the perimeter firewall. ZTNA, on the other hand, is often configured on a cloud basis, and integrated with an organization’s pre-existing Identify and Access Management (IAM) systems. 

It then takes into account the user, behavior, and application itself before granting individual access.

Supercharge Your Business Security

Request Demo

Start Now

Best Practices for Implementing Zero Trust Network Access

Best practices of ZTNA implementation occurs across three main phases. 

Phase 1 – Setup

This phase regularly begins with a replacement of an enterprise’s existing VPN solution. If there are no current remote access protocols in place, the setup phase can take longer. This is because, at the beginning of implementation, ZTNAs can benefit from similar access levels as a remote access VPN. 

Without this architecture to work off of, it will require the full process of identifying and assigning access levels to all the different groups within an organization. 

Once an end-user is newly enrolled, the ZTNA client detects when they are no longer connected to the internal corporate network. As soon as they are on public or home WiFi, all internal application data is redirected through the ZTNA solution. 

Phase 2 – Micro segmentation

Once the user groups are in place, it’s time to start defining access policies. User identity attributes allow an enterprise to provide specified access to segmented parts of applications. 

This is managed via an internal dashboard that grants previously-defined subgroups – such as contractors – access to the specified internal servers. This acts essentially as a whitelist, while further monitoring every component of their ongoing access.

Phase 3 – Full ZTNA

Once user identity groups and their remote accesses have been identified and stress-tested, it’s vital to ensure that all connectivity is, by default, handled through the ZTNA. From there, the ZTNA tooling is able to automatically enforce each user’s own access and traffic rules. 

Finally, integrate with pre-existing security tooling such as SIEM to bring all ZTNA data into the security analysis pipeline. 

Drive Multidimensional Security with Perimeter81

Zero trust requires organizations to keep every facet of a user, device, and service in mind when granting access to a network. 

This is the foundation upon which Perimeter81 builds: integrating tightly with your current IAM provider, Perimeter81’s agentless configuration makes onboarding new partners and employees rapid: at the same time, if your teams need to connect to third-party services, clientless grants further flexibility – without costing protection. 

To learn more about our security solutions, get in touch with us today.

FAQs