Zero trust architecture (ZTA) is a design and implementation strategy of IT systems. The principle is that users and devices should not be trusted by default, even if they are connected to a privileged network such as a corporate LAN and even if they were previously verified. The principle is also known as perimeterless security or formerly de-perimeterization. ZTA is implemented by establishing identity verification, validating device compliance prior to granting access, and ensuring least privilege access to only explicitly-authorized resources. Most modern corporate networks consist of many interconnected zones, cloud services and infrastructure, connections to remote and mobile environments, and connections to non-conventional IT, such as IoT devices. The traditional approach by trusting users and devices within a notional "corporate perimeter" or via a VPN connection is commonly not
Core Value Proposition
Zero Trust Network Access (ZTNA) enforces strict identity verification for every user and device trying to access applications on a private network, regardless of whether they are sitting inside the office or working remotely. Unlike traditional security models that operate on a trust, but verify approach (granting wide access once a user enters the network, usually via a VPN), ZTNA operates on a never trust, always verify principle.
- Seamless remote access: ZTNA eliminates the friction and slow connection speeds of traditional VPNs while drastically reducing cyber risk.
- Maximum data security: ZTNA isolates potential attackers to one app, preventing lateral movement of threats.
Target Audience Pain Points
ZTNA addresses several key pain points for modern organizations:
- Remote workforce friction: Provides secure, seamless access for remote workers.
- Slow VPN performance: Offers context-aware, invisible, continuous authentication for a better user experience.
- Compliance risks: Ensures least-privilege access and micro-segmentation to meet regulatory requirements.
- Ransomware spreading: Isolates threats to prevent lateral movement across corporate networks.
ZTNA vs. Traditional VPN
| Attribute | Traditional VPN | Zero Trust Network Access (ZTNA) |
| Access Level | Network-wide access once authenticated | App-specific access; hides the rest of the network |
| Security Risk | High risk of lateral movement if breached | Low risk; potential attackers are isolated to one app |
| User Experience (UX) | Frequent log-ins, slow connection speeds | Context-aware, invisible, continuous authentication |
| Cloud Suitability | Built for legacy, on-premises infrastructure | Native to modern cloud and hybrid environments |
Key Concepts
- Micro-segmentation: The practice of dividing networks into tiny, isolated zones to prevent lateral movement of threats.
- Least-Privilege Access: Granting users only the minimum access permissions necessary to perform their specific job functions.
- Software-Defined Perimeter (SDP): The underlying technology infrastructure that enables ZTNA by cloaking network assets from unauthorized users.
