Zero Trust Network Access (ZTNA) Solutions from LevelBlue

At its most basic, ZTNA is an IT security solution that provides secure remote access to an organization’s applications, data, and services based on clearly defined access control policies. When ZTNA is in use, access to specific applications or resources is granted only after the user has been authenticated to the ZTNA service. Once authenticated, ZTNA then grants the user access to the specific application using an encrypted tunnel, which provides an extra layer of security protection by shielding applications and services. The ZTNA model was coined by Gartner in 2010 as “a product or service that creates an identity- and context-based, logical access boundary around an application or set of applications.”

At the basic level, ZTNA differs from virtual private networks (VPNs) in that they grant access only to specific services or applications, while VPNs were designed to grant complete access to a local area network, offering a private, encrypted tunnel for remote employees to connect. A shortcoming to this approach is that once a user is granted access, they can reach anything on the network, leading to security gaps and policy enforcement problems. ZTNAs also overcome VPN shortcomings, including keeping pace  with growing usage, which can outstrip a VPN’s ability to grow smoothly, and the challenges that VPNs present regarding installation and configuration of remote users.

The attack surface for cybercriminals has expanded, as enterprises transform to accommodate a hybrid workforce, migrate to a cloud-based data center model, and automate their SOCs. Those developments began to place additional strain on the ability of technologies, like VPNs, to guarantee security. ZTNA was developed as a way to simplify risk management by removing the concept of implicit trust. By limiting access, the ZTNA solution helps ensure that all network traffic — regardless of where it moves — is treated the same. As a result, organizations can now make security a single use case, no matter the situation, user, user location, or access method.

The core idea underlying ZTNA’s approach to security is that once users are authorized, access is only granted on a one-to-one basis. Once authorized, the user is granted access to a specific app, rather than to the entire network. Segmentation prevents overly permissive access, along with the risk of lateral movement of malware, should any be introduced. By isolating the user/app access the risk to the network is significantly reduced.

The primary benefit is to heighten network security. By limiting access through single-use permission, ZTNA effectively answers the challenge of mounting successful cybersecurity in the face of multi-cloud environments for data storage, the growth of ‘bring-your-own-app’, and the move toward remote work. ZTNA offers a way to connect users, applications, and data, even when they do not reside on the organization’s network — a scenario increasingly common in today's multi-cloud environments where micro-services-based applications can reside on multiple clouds as well as on-premises. The ZTNA model helps eliminate the granting of excessive trust to employees, contractors, and other users who only need very limited access. The model expresses the concept that nothing is to be trusted until proven trustworthy, and more importantly that trust must be re-authenticated whenever anything about the connection (location, context, IP address, etc.) changes.

It’s best to think of ZTNA as a door that bars access to the room where all your tools are stored. Security is enhanced by granting permission on a one-time basis to specific users who need to access apps or data. One of the benefits of ZTNA is that it doesn’t require a significant re-design of your existing network. ZTNA can effectively help consolidate network and security tools, and has been shown to work seamlessly with such common network elements as endpoint protection platform (EPP), endpoint detection and response (EDR), extended detection and response (XDR), unified endpoint management (UEM), and software-defined wide area network (SD-WAN).