Organizations must ensure that data transmitted to and from their remote workers is protected and threats cannot find a way in. Zero trust network access (ZTNA) is a solution that does just that. It also provides granular and secure remote access to applications. To achieve this, ZTNA solutions must be configured with strict user verification and contextual assessment to prevent insider threats.
Table of Contents
Authentication
What is ZTNA? Zero trust network access (ZTNA) is a new approach to secure remote access to the applications that power businesses. It replaces the traditional remote access VPN with a more secure alternative that uses security at the application level rather than on the network level, effectively hiding all infrastructure from the internet and only allowing users to connect to those applications they are authorized for. This significantly reduces the attack surface, cost of data breaches, and lateral movement should an attack succeed. Zero Trust security takes a different approach to securing the enterprise. It starts with the assumption that attackers are inside and outside the network, so no user or device should be automatically trusted. Instead, users and devices must be re-verified whenever they connect to internal applications. This verification is done using a combination of identity and context-based access control to ensure adherence to policies, security best practices, and threat mitigation. It is also designed to enforce the principle of least privilege so that only those credentials or applications that a specific user needs should be allowed onto the network. In this way, the network is broken up into single-resource fortresses where users are granted granular permissions based on their need to do work. This reduces the surface area of the network that can be attacked, which is particularly important given the increase in remote and work-from-home activities that have made many organizations vulnerable to phishing, malware, credential theft, and more. Zero Trust is supported by a range of products and services, from cloud to on-premises. Some implement it with an agent-based model requiring software installation on all endpoints, while others offer service-based ZTNA, a more cost-effective and faster-to-deploy option.
Microsegmentation
Micro-segmentation creates secure logical zones within an organization’s network, which minimizes the attack surface. Each zone is grouped based on business needs like data or applications. This approach allows security teams to control what a user can access. For example, a micro-segmented network would allow a low-level employee only to have access to the data and applications they need for their job duties. This helps prevent privilege escalation. Another benefit of micro-segmentation is that it improves breach containment. This is because attackers can only exploit a small portion of the system if they can only communicate with that part of the network. This also makes it easier to identify breaches in your data center and revert any unauthorized changes. Finally, micro-segmentation can help ensure regulatory compliance. It enables regulatory officers to create policies that isolate systems subject to regulations from the rest of the infrastructure. This can help reduce the risk of unauthorized activities when employees accidentally connect to systems not compliant with regulations. It also simplifies audits because it limits communication between regulated and non-regulated systems. This means the auditor must only review a few policies rather than the entire network. This helps speed up the audit process and lower costs.
Privilege escalation
The principle of least privilege is a crucial component of Zero Trust and applies to users and devices. This principle requires that an attacker only have access to those resources they need for a specific task. This limits the potential damage that could occur should an attack succeed. It also helps prevent lateral movement within the network. Horizontal privilege escalation is another common threat that can be prevented with Zero Trust, and it happens when attackers gain the same level of privileges as an authorized user. This may happen by exploiting password reuse, leveraging an HR-vetted directory identity, or using a privilege escalation attack. This is why it is essential to have controls in place to ensure that privileged accounts are assigned according to the principle of least privilege and that those accounts are reviewed and revoked regularly. Zero Trust can help mitigate horizontal privilege escalation by continuously verifying all access, all the time, for every user, device, and application. This includes enforcing the principles of least privilege and multi-factor authentication and enforcing policies that limit the “blast radius” if an attacker breaches your network. This can be done by limiting connection privileges, requiring minimum authentication factors, and adding encryption to critical applications.
Access control
Zero Trust network access requires strict verification of user identity and device security before allowing access to internal applications. This approach differs from VPNs and secure remote access technologies that assume users are safe by default. Instead, zero-trust networks assume attackers are present on both sides of the firewall and require pre-admission checking. The most important feature of a Zero Trust security model is multi-factor authentication (MFA), a set of best practices requiring more than one piece of evidence to verify a user’s identity. This may include something a user knows, like a password or PIN; something they have, such as an access card or token; and something the user is, such as a fingerprint, iris scan, or voice recognition. Another critical feature of Zero Trust is least privilege access. This means that each user is granted access to only the resources required for their job rather than more. This helps limit the impact of a data breach because attackers can’t move laterally across the network and gain unauthorized access to more assets. Finally, Zero Trust solutions use micro-segmentation to create perimeters around individual assets and applications. This helps limit threat movement within a network and protects against data breaches caused by lateral attacks that make it past the first verification point, such as a firewall or a user login.
