Universal ZTNA: Zero Trust Network Access Anywhere comes of age​

Universal ZTNA: Zero Trust Network Access Anywhere comes of age

Sign up below to receive our weekly Newsletter:

Enterprise security and IT teams have faced challenges in providing secure access to the resources needed to get work done. First, there was a rapid shift to working from home with outdated virtual private networks unable to cope with the influx of connections. Then cybercriminals stepped up their ransomware and phishing attacks to target growing security gaps and people, the main target of attacks. Now the question is how to adequately secure access for hybrid workforces connecting from anywhere to hybrid workloads scattered everywhere.

However, the silver lining of recent years is that many organizations that had to weather the cybersecurity storms have turned to the proven security, operational and business benefits of Zero Trust Network Access. In fact, organizations are rapidly deploying universal ZTNA across their entire enterprise network, as this revolutionary secure access solution comes of age.

What is universal ZTNA?

ZTNA is not limited to secure remote access use cases; it has evolved to support users and devices on campus and on premises, including IoT. What is universal ZTNA or, as we like to call it, Zero Trust Network Access anywhere?

Universal ZTNA, a term coined by Gartner, is the most effective secure access method there is. Unlike the “allow by default” mode of VPNs, network access control (NAC) solutions and firewalls, universal ZTNA is based on Zero Trust principles, which take a “deny by default” approach to digital resources. However, not all ZTNA solutions are created equal. The most effective ZTNA solutions are not limited to remote access, which many security vendors initially considered the only factor to take into account and which they are now desperately trying to pivot their architecture and features around to also solve the universal ZTNA problem. Many of these same vendors have also built architectures that only support cloud access, making it even harder to solve the problem of users and devices on campus.

On the other hand, comprehensive universal ZTNA solutions protect access to your entire ecosystem of users, use cases, workloads and your complete enterprise network, not just the parts that are in the cloud. They will easily adapt to your digital transformation and cloud initiatives, as well as to unforeseen external forces of change. When users and employees return to the office after a pandemic, they expect the same level of ease of use as when they were working remotely, and security teams want to apply the same level of access policy in the office.

Why universal ZTNA and why now?

With on-site and remote employees, plus a mix of legacy, on-premises and multi-cloud workloads and IoT devices, organizations face many security hurdles.

• Traditional cybersecurity systems were designed for trust-based, perimeter-centric environments, making them ill-suited to protect an expanded and constantly evolving attack surface created by work-from-anywhere policies and dispersed IT environments.
• Legacy workloads on midrange and mainframe equipment are hard to secure with modern security measures and costly to refactor, but they still need to be accessible.
• Unmanaged or compromised devices that act as unwitting attack vectors and lack strict controls (for example, BYOD, IoT and OT devices).
• Notoriously complex cloud environments push many IT teams to adopt permissive policies by default.

Let’s not forget that security and IT teams are often overstretched and need modern secure access solutions that simplify administration, reduce complexity and enable business agility. Remote, in-office or third-party users must be able to connect easily to highly diverse on-premises, legacy and cloud environments without delays or interruptions. Giving all users a unified, seamless experience, regardless of where they work or where resources are located, improves productivity and reduces the volume of support tickets.

To be clear, universal ZTNA is not new. The term is new and allows the industry to move beyond the notion of ZTNA as a solution intended solely for remote access. As organizations develop their Zero Trust programs, usually starting with remote users as a logical and vulnerable starting point, universal ZTNA, Zero Trust Network Access anywhere, is a key term to reinforce the importance of extending Zero Trust principles to on-premises and branch networks.

Top reasons to adopt ZTNA

The Zero Trust Network Access (ZTNA) market is booming because organizations are tired of cobbling together traditional security solutions that are insecure, generate help desk tickets and are not based on Zero Trust security and least-privilege access principles. What are the main reasons you should consider applying Zero Trust network access anywhere and everywhere across your entire hybrid infrastructure?

• (Universal) ZTNA is identity-centric: ZTNA (everywhere) allows us to know as much information as possible about a user and/or device before allowing them to connect to the network, such as:
• The user’s context
• The device they are using
• The device’s security posture
• The user’s location

• It is adaptable and extensible: Universal ZTNA manages access and adapts based on the user’s context, device and security conditions. It integrates with enterprise and security systems and provides an individual microperimeter for each user, granting specific access and visibility only to the network resources the user needs to do their job.
• Enforces Zero Trust principles: A central idea of Zero Trust security is that access is never granted on the basis of implicit or assumed trust. It requires trust to be earned through proactive device inspection, identity validation and continuously reassessed contextual analysis using a context- and risk-based approach.

What to look for in a universal ZTNA solution?

Although ZTNA anywhere is the goal, not all Zero Trust network access solutions are designed to handle the sophistication required to cover both remote and campus networks. In fact, in a recent report, Gartner identified several issues that could apply to a limited ZTNA solution, such as:

• Lack of protocol support
• Securing headless devices, such as IoT
• Lack of support for bidirectional security rules

More specifically, the simplified benefits of advanced universal ZTNA solutions should include:

• Simultaneous secure access for all users, devices and workloads, wherever they reside
• Cloaking resources until a user is authenticated
• Keeping policies in sync with dynamic infrastructure
• Micro-segmentation to provide 1:1 secure access for users, devices, networks and resources
• Customization through a comprehensive feature set, including APIs, aligned with central IT requirements and processes
• A single framework and consistent configuration to unify access and minimize administrative tasks
• The ability to secure network access, including on-premises networks, IoT/OT, WANs and campus networks.

Questions to ask when selecting a ZTNA vendor:

Here are some questions to add to your request for proposal (RFP) process to select a universal ZTNA solution vendor, to make sure the vendor is up to the task of Zero Trust network access anywhere:

1. Does your ZTNA solution work for users in the office?
2. Does your ZTNA offering protect legacy infrastructure as well as modern cloud-native microservices?
3. Does your ZTNA solution require connections to go through the vendor’s cloud, or do you have a choice of deployment models for your specific situation?
4. How scalable is your ZTNA solution? Will it be able to meet my needs in six months or a year?
5. What API integrations are available to ensure smooth integration with our current technology and security stack?
6. We have an identity and access management (IAM) platform. Can your universal ZTNA solution work with it?
7. Does your ZTNA solution continuously monitor and dynamically adjust connections when risks change?
8. What is the process for verifying user identity and granted permissions in your ZTNA solution?
9. How does your ZTNA offering manage and enforce unified policies for users or IoT devices connecting to on-premises and cloud resources?
10. How do policy changes work? Does your universal ZTNA solution reduce complexity by eliminating redundant or outdated policies?
11. How does your product protect against lateral movement in the network?
12. Does your solution offer a unified, seamless experience for a user who works remotely today and in the office tomorrow?
13. What does network monitoring look like? What kind of visibility will it give my administrators?

Source: Appgate

HTBS helps you secure your organization with the Zero Trust approach, which will allow you to protect and secure every element of your infrastructure while gaining global visibility of your attack surface.

Click here to learn more about our solutions