How to Enforce Zero Trust Policies Using Endpoint Application Context

How to Enforce Zero Trust Policies Using Endpoint Application Context

One of the core tenets of the Zscaler Zero Trust Architecture is least-privilege access: securely connecting users, workloads, and devices only to the applications they are authorized to use, and not to the broader network.

To enforce least privilege, security controls must accurately identify what application a user or device is attempting to reach. For this, Zscaler supports multiple application-identification mechanisms for both web and non-web traffic.

In this blog we’ll cover how SOC and IT teams can answer two key questions about any application or process running on an endpoint: “Which endpoint application generates certain traffic, and what is the associated risk context?” Answering these questions requires end-to-end visibility across endpoint activity, sanctioned and unsanctioned applications, and network sessions.

How Zscaler Identifies Endpoint Applications Across Web and Non-Web Traffic

Because over 95% of global web traffic is encrypted¹, TLS/SSL inspection is essential to completely identify the application and detect threats inside encrypted flows. These types of applications are URL categorizations and Cloud Apps.

For non-web traffic, TLS/SSL inspection is typically not applicable. In these cases, Zscaler Zero Trust Firewall (ZTFW)—which secures traffic across all ports and protocols—can identify applications using approaches such as:

• FQDN / wildcard FQDN (wFQDN) matching
• Network Services (protocol + port combinations)
• Network Applications (DPI-based identification)
• Application Services (groups of destinations + ports/protocols)

¹ Google Transparency Report

Comparing Application Identification Methods: Deep Packet Inspection (DPI), TLS/SSL Decryption, Network Services and More

Each application identification method has distinct advantages and prerequisites. TLS/SSL decryption provides complete visibility into traffic contents, but primarily applies to encrypted web 

DPI-based identification works well for non-web traffic whether encrypted or not, though it may require multiple packets to accurately determine the application. Destination-based L3/L4 matching, such as Network Services and Application Services, enable first-packet classification but its effectiveness can be reduced when applications are delivered through CDN networks.

Despite these strengths, all of these approaches share a common behavior: they identify traffic at the network/protocol level but do not identify the application on the endpoint that generated the traffic. 

For example, DPI may classify traffic as SSH, but it cannot indicate which specific client side application initiated the SSH session. Similarly, TLS/SSL decryption can reveal full web or FTP content, but it does not necessarily identify the browser (e.g. Chrome vs. Tor browser), version, or specific application responsible for generating that traffic.

Why Endpoint Visibility Is Critical for Stopping Living off the Land (LOTL) Attacks

Today’s attackers, whether AI-driven or human, rarely follow a single playbook. Instead, they increasingly rely on Living off the Land (LOTL) techniques—blending traditional malware with legitimate tools like WMI, and RDP. Because this activity often resembles normal operations, it can slip past detection methods based solely on signatures or destinations.

As a result, it’s no longer sufficient to ask, “What application traffic is this?” You also need to know, “Which endpoint application generated this traffic, and what is the associated risk context?”

Answering these questions requires end-to-end visibility across endpoint activity, sanctioned and unsanctioned applications, and network sessions.

How Zscaler Delivers Ground-Truth App Visibility with Endpoint Application Inventory

To address gaps in reliable application identification and to help customers respond to LOTL techniques, Zscaler recently released Endpoint Application Inventory (powered by Zscaler Client Connector). Endpoint Application Inventory provides application-level visibility and risk assessment across endpoints and the cloud, enabling customers to understand:

• What applications are installed
• Where they are installed
• Who is using them
• Whether the application has unresolved vulnerabilities and risk signals

Using Endpoint Applications and Risk Signals as ZIA Security Policy Criteria

We’re now extending this capability to beyond monitoring and classification, customers can now use Endpoint Applications and related risk signals directly in:

• Advanced Zero Trust Firewall policies
• DNS Control policies
• TLS/SSL inspection policies
• Advanced Threat Protection
• IPS Control (future) 

This enables policies to match not only on network attributes (e.g., like network app, IP, FQDN, port, protocol), but also on the originating endpoint application name, tags and risk level. For example, you can detect when risky or compromised applications initiate traffic and enforce policy based on the application’s risk level. 

Note: Some functionality may not be available immediately at launch and will be enabled in phases. Availability and feature scope may also vary depending on your license. 
 

Key Use Cases for Endpoint Application as Policy Criteria 

ZIA Policy Examples: Block or Allow Traffic by Endpoint Application and Risk Level

Zero Trust Firewall example: 

To block all traffic originating from Brave browser, you can apply a policy such as: 

If Endpoint Applications == brave.exe (Brave Browser), then Block. 

DNS Control example (application-specific allowance):

If DNS Protocol == DNS over HTTPS and Endpoint Applications == Chrome, then Allow.

This demo video provides more examples of using Endpoint Context application data used as policy criteria in ZIA.

Conclusion: Elevate Security Accuracy with Endpoint Application Intelligence

By including endpoints applications and risk as criteria in ZIA security policies —  across Firewall, DNS Control, TLS/SSL Inspection and ATP policies — organizations can improve enforcement accuracy and strengthen early detection and prevention for modern threats, including Living off the Land (LOTL) techniques.

Below is a quick summary of the available application identification techniques. Depending on the policy type you can combine multiple conditions within a single policy to increase accuracy for both targeting and control.