What is ZTNA?
ZTNA is a secure remote access solution that implements zero trust security principles with application-specific permissions. Remote workers requesting access to corporate assets will be granted access to specific resources on a case-by-case basis taking into account role-based access controls and contextual authentication data, such as IP address, location, user group or role, and time restrictions.
What is a VPN?
VPNs provide remote users with an experience similar to a direct connection to the corporate network. The VPN client software and VPN endpoint on the enterprise network establish an encrypted channel that all data is sent over before being routed to its destination. This protects against eavesdropping and enables all business traffic to be inspected by perimeter-based security solutions regardless of its source.
Limitations of the VPN
VPNs are the traditional choice for secure remote access because they work well with legacy perimeter-based security models. However, they have several limitations that make them ill-suited to the security needs of the modern enterprise, including:
- Perimeter-Focused Security: VPN helps reinforce the traditional perimeter-based security model because an authenticated user is granted full access to the corporate network. This allows an attacker to move laterally through the corporate network after gaining access via compromised VPN credentials or exploitation of a VPN vulnerability.
- Network-Level Access Controls: VPNs implement access controls at the network level without visibility into or control over the application layer. This provides overly-permissive access to users, granting read, write, and execute access to resources within different applications.
- No Cloud Support: VPNs are typically designed to provide secure remote access to the corporate network. Often, they have limited support for cloud-based resources located outside of the traditional perimeter.
- Poor Support for BYOD Devices: Allowing BYOD devices to access the corporate VPN provides access to corporate resources from unmanaged, non-corporate endpoints. This may allow malware or other cyber threats direct access to the corporate network.
VPNs and The Rise of the Zero Trust Approach
VPNs are designed for the traditional perimeter-focused security strategy. However, this strategy has major issues that, combined with the limitations of VPNs, have inspired Forrester to create the zero trust security model.
Unlike the perimeter-based strategy, zero trust does not grant implicit trust to any device, user, and application within the traditional network perimeter. Instead, access to corporate resources is granted based on the principle of least privilege, where entities are assigned only the minimum set of permissions needed to perform their role.
Why ZTNA Solutions are Better than Corporate VPNs
With a zero trust security strategy, VPNs are no longer a viable secure remote access solution. ZTNA offers an alternative with several benefits when compared to VPNs, including:
- Logical Access Perimeter: ZTNA implements the “perimeter” as software rather than the physical network boundary. This enables ZTNA to be used for micro segmentation and to protect assets outside of the traditional perimeter.
- Per-Request Authorization: ZTNA individually authorizes each access request. This ensures that users are not granted access to resources that are not required for their role.
- External Device and User Support: ZTNA is clientless, eliminating the need to install software on user devices. This makes it easier for external partners and BYOD devices to connect to corporate resources.
- Darkened IT Infrastructure: ZTNA only shows users the resources that they need access to. This makes it more difficult for an attacker to move laterally through the network or for corporate assets to be targeted by DDoS attacks.
- App-Level Access Management: ZTNA has visibility into the application layer, allowing organizations to manage policies at the application, query, and command levels.
- Granular Visibility into User Activities: By independently authenticating each user request, ZTNA can build a SIEM-friendly audit log of users’ interactions with corporate applications and IT assets.
Moving to ZTNA with Harmony Connect
In addition to its security limitations, VPNs also have issues with scalability and performance. For companies looking to upgrade their secure remote access solutions and implement a zero trust architecture, ZTNA is a good alternative to the legacy corporate VPN.
ZTNA can best be deployed as part of a Secure Access Service Edge (SASE) solution, which combines a full network security stack with network optimization capabilities such as Software-Defined WAN (SD-WAN). By deploying SASE, organizations can move away from perimeter-based security models to a zero trust architecture built for the distributed enterprise.
Check Point’s Harmony SASE enables organizations to deploy network and security functionality that meets their needs. To learn more about how Harmony SASE works and see it in action, request a demo.
