Zscaler Cloud Security Logo
Resources > Security Terms Glossary > What is ZTNA

What Is Zero Trust Network Access (ZTNA)?

What is ZTNA?

Zero trust network access (ZTNA), also known as the software-defined perimeter (SDP), is a set of technologies and functionalities that enable secure access to internal applications for remote users. It operates on an adaptive trust model, where trust is never implicit, and access is granted on a need-to-know, least-privileged basis defined by granular policies. ZTNA gives remote users seamless, secure connectivity to private applications without ever placing them on the network or exposing apps to the internet.

Zero trust security is a big buzzword these days. While many organizations have shifted their priorities to adopt zero trust, zero trust network access (ZTNA) is the strategy behind achieving an effective zero trust model.

The path to zero trust as an ideology is vague, so ZTNA provides a clear, defined framework for organizations to follow. It's also a component of the secure access service edge (SASE) security model, which, in addition to ZTNA, comprises next-gen firewall (NGFW), SD-WAN, and other services in a cloud native platform.

How does ZTNA work?

While the need to secure a remote workforce has become critical, network-centric solutions such as virtual private networks (VPNs) and firewalls create an attack surface that can be exploited. ZTNA takes a fundamentally different approach to providing secure remote access to internal applications based on these four core principles.

 

  1. ZTNA completely isolates the act of providing application access from network access. This isolation reduces risks to the network, such as infection by compromised devices, and only grants access to specific applications for authorized users who have been authenticated.
  2. ZTNA makes outbound-only connections ensuring both network and application infrastructure are made invisible to unauthorized users. IPs are never exposed to the internet, creating a “darknet” that makes the network impossible to find.
  3. ZTNA’s native app segmentation ensures that once users are authorized, application access is granted on a one-to-one basis. Authorized users have access only to specific applications rather than full access to the network. Segmentation prevents overly permissive access as well as the risk of lateral movement of malware and other threats.
  4. ZTNA takes a user-to-application approach rather than a traditional network security approach. The network becomes deemphasized, and the internet becomes the new corporate network, leveraging end-to-end encrypted TLS micro-tunnels instead of MPLS.

 

ZTNA
ZTNA improves flexibility, agility and scalability, enabling digital ecosystems to work without exposing services directly to the internet, reducing risks of distributed denial of service attacks.
Gartner, Market Guide on Zero Trust Network Access, April 2019

From an architectural perspective, ZTNA works fundamentally differently from network-centric solutions. ZTNA is most often 100% software-defined, eliminating the overhead of managing appliances. ZTNA also helps organizations simplify inbound stacks as they no longer require their VPN and VPN concentrators, DDoS protection, global load balancing, and firewall appliances.

There are two key ZTNA architecture models. This article highlights the service-initiated ZTNA architecture below. Read Gartner’s ZTNA Market Guide for more details.

 

Top ZTNA use cases

ZTNA has many cloud security use cases. Most organizations choose to start with one of these four.

 

VPN alternative

VPNs are inconvenient and slow for users, offer poor security, and are difficult to manage, so organizations want to reduce or eliminate their reliance on them. Gartner predicts: “By 2023, 60% of enterprises will phase out most of their remote access VPNs in favor of ZTNA.”

 

Secure multicloud access

Securing hybrid and multicloud access is the most popular place for organizations to start their ZTNA journey. With more companies adopting cloud applications and services, 37% of them are turning to ZTNA for security and access control for their multicloud strategies.

 

Reduced third-party risk

Most third-party users receive overprivileged access, and they largely access applications using unmanaged devices, both of which introduce risks. ZTNA significantly reduces third-party risk by ensuring external users never gain access to the network and that only authorized users can access allowed applications.

 

Accelerated M&A integration

With typical M&As, integration can span multiple years as organizations converge networks and deal with overlapping IPs. ZTNA reduces and simplifies the time and management needed to ensure a successful M&A and provides immediate value to the business.

Considerations for ZTNA

In Gartner’s recent Market Guide on Zero Trust Network Access, Steve Riley, Neil MacDonald, and Lawrence Orans outline several things organizations should consider when choosing a ZTNA solution:

  1. Does the vendor require an endpoint agent to be installed? What OSs are supported? What mobile devices? How well does the agent behave in the presence of other agents? Note: ZTNA technologies that do not support clientless use often can't support unmanaged device use cases (e.g., third-party access, BYOD).
  2. Does the offering support only web applications, or can legacy (data center) applications gain the same security advantages?
  3. Some ZTNA products are delivered partly or wholly as cloud-based services. Does this meet the organization’s security and residency requirements? Note: Gartner recommends that enterprises favor vendors that offer ZTNA as a service, as services are easier to deploy, more available, and provide better security against DDoS attacks.
  4. To what extent is partial or full cloaking, or allowing or prohibiting inbound connections, a part of the isolated application’s security requirements?
  5. What authentication standards does the trust broker support? Is integration with an on-premises directory or cloud-based identity services available? Does the trust broker integrate with the organization’s existing identity provider?
  6. How geographically diverse are the vendor’s entry and exit points (referred to as edge locations and/or points of presence) worldwide?
  7. After the user and user device pass authentication, does the trust broker remain resident in the data path?
  8. Does the offering integrate with unified endpoint management (UEM) providers, or can the local agent determine device health and security posture as factors in the access decision? What UEM vendors has the ZTNA vendor partnered with?

These are all important considerations for your enterprise as you look for the ZTNA vendor that complements your present and forward-looking goals and vision. To learn more about ZTNA, check out our leading ZTNA service, Zscaler Private Access. You can even take ZPA for a free 7-day test-drive.

Cybersecurity Insiders 2019 Zero Trust Adoption Report

Read the full report
Trust Icon

The Network Architect’s Guide to Adopting ZTNA

Read the guide
Trust Icon

Why IT leaders should consider a zero trust network access (ZTNA) strategy

Read our white paper
Why IT leaders should consider a zero trust network access (ZTNA) strategy

Zscaler Security Service Edge (SSE) Infographic

Take a look
Why IT leaders should consider a zero trust network access (ZTNA) strategy

Additional resources