Understanding ZTNA Relationship to Zero Trust and SASE

Zero Trust Network Access (ZTNA) and Zero Trust (ZT) are security models that are related, but often get wrongly conflated. In this article, I explore the definitions of ZTNA and ZT, showing how they overlap and enable each other—while also underscoring important differences between the two. ZTNA is about securing IT environments at the network level, making it a core element of broader ZT and Secure Access Service Edge (SASE) security models. As such, it’s a practical component, becoming more essential in securing today’s distributed environments.

What is ZTNA?

ZTNA is a solution for securing remote access to an organization’s networks, data and applications based on the principle of Zero Trust. Using ZT principles, a ZTNA solution takes a “deny all by default” approach to any network access request. No person or device is trusted when access is requested. Only after the ZTNA solution has authenticated the user based on a range of criteria will the user/device be granted limited access privileges.

ZTNA: How it works

The connection occurs through a secure, encrypted tunnel. This approach provides additional security by blocking the user from seeing IP addresses of applications and services that he or she is not entitled to see. In this way, ZTNA is similar to the Software-Defined Perimeter (SDP), which hides data, apps and services from everyone but those with proper privileges. The ZTNA solution then continues to re-verify the user throughout the session.

ZTNA versus VPN: Why companies are moving away from VPN

ZTNA performs a comparable role to the virtual private network (VPN), but with some notable difference. Most VPNs use a “trust by default” policy, the opposite of ZTNA’s not trusting anyone or anything. Also, VPNs tend to grant flat access—once permission is given, the user can access everything on the network. The problem with this approach is that it enables a malicious user to move laterally across the network and potentially attack all of an organization’s digital assets. For this reason, many corporations are moving away from VPN in favor of ZTNA.

ZTNA advantages

ZTNA offers several advantages. It’s more granular and context-aware than a VPN, with tighter control over access. It reduces the chance of lateral movement. ZTNA is also better than a VPN for managing access to digital assets that exist outside of an organization’s core network. This is becoming a common scenario today, which also explains the rising popularity of ZTNA.

ZTNA vs. ZT: Differences and how the two get mixed up

ZTNA is an implementation of ZT, a broad, foundational cybersecurity model that can be applied to a wide variety of real-life scenarios. ZT is a concept and security model—not a defined solution. The fundamental law of ZT is to always deny access by default. If a user wants to access a database, he or she is not to be trusted without verification of identity. If a user wants to store a file, the request is similarly denied by default. Grants of access and usage privileges are handed out in the smallest possible increments. And, the privileges are to be repeatedly rechecked as the usage session proceeds. ZT can work at any level of granularity.

ZTNA and ZT get mixed up for several reasons. First, they are connected ideas. You cannot have ZTNA without ZT. However, it’s possible to have ZT without ZTNA. Also, ZTNA is a practical solution that is now on the market in various forms. It’s easy to think, “I’m doing ZT if I buy a ZTNA solution.” However, you’d only be partly correct. You can implement ZTNA and still be granting unfettered flat access to all sorts of digital assets for users who have cleared the ZTNA access rules or policies.

Get the Zero Trust security acronym detangler

ZTNA as a key component of SASE

ZTNA is one of five core elements of SASE, according to Gartner’s early definition of the model. The question is why? Indeed, it is possible to create a secure access policy without ZTNA. However, it would not be as secure as it needs to be.