In 2020, organizations experienced a massive shift to remote and hybrid work environments, which dramatically increased their attack surfaces and risk. Here in India, our Check Point Threat Intelligence Report states that an organization in India is being attacked on average 1783 times per week in the last 6 months, compared to 1645 attacks per organization in APAC, with 89% of the malicious files in India delivered via email in the last 30 days.
Many companies accelerated cloud initiatives to provide access to data and resources. BYOD policies allowed employees to access company assets from home and personal devices. Supply-chain partners also now needed remote access to information.
Until now, companies relied on Virtual Private Networks (VPNs) and premises-based security methods for secure remote access. Since 2020, the limitations of these methods have become painfully clear:
• They can’t scale easily
• IT lacks visibility into users and activity
• It’s not practical to install and maintain VPN clients on BYOD and partner devices
• Performance suffers
• They’re complex to use with cloud environment
• They lack Privileged Access Management (PAM) capabilities for DevOps and engineering users
• They’re costly
Securing Access with Zero Trust
For these reasons, Zero Trust Network Access (ZTNA) is becoming a critical element of standardized security architecture. A ZTNA model “never trusts and always verifies.” When implemented, ZTNA:
• Limits access on an application-by-application basis
• Authenticates every device and user, no matter where they are located
• Acknowledges today’s complex networks and makes zero assumptions
Gartner defines ZTNA as “products and services that create an identity- and context-based, a logical-access boundary that encompasses an enterprise user and an internally hosted application or set of applications. The applications are hidden from discovery, and access is restricted via a trust broker to a collection of named entities. The broker verifies the identity, context and policy adherence of the specified participants before allowing access and minimizes lateral movement elsewhere in the network.”
Gartner’s definition separates the control plane from the data plane, as shown below:
More than simply a VPN replacement, ZTNA ensures all users and devices—whether inside or outside the organization’s network—are authenticated, authorized, and continuously validated for security configuration and posture before being granted or maintaining access to applications and data.
Choose the Best ZTNA Solution
When evaluating ZTNA solutions for your environment, here are seven things to keep in mind.
Ensure Support for All Users
The solution must secure access for everyone—employees with managed devices, BYOD devices, mobile devices, third-party partners, engineering teams, and DevOps users. Look for client-based access to secure employees using managed devices and a clientless architecture for secure access to web applications, databases, remote desktops, and secure shell (SSH) servers. Be sure to also consider basic PAM requirements for teams who need access to multi-cloud environments and single sign-on (SSO) into private resources, such as servers, terminals, and databases.
Ensure Support for All Target Resources
Ensure the ZTNA solution supports all high-priority private applications and resources, not just Web apps. This includes access to SSH terminals, SQL databases, remote desktops (RDP) and servers. DevOps and engineering teams need ZT access to Infrastructure-as-a-Service (IaaS) offerings, cloud production environments, microservices, and virtual private clouds.
Ensure Simple Deployment and Rapid Time to Value
Look for out-of-the-box identity provider (IdP) integration through a standard like SAML 2.0, as well as intuitive, granular policy configuration. See how to deploy clientless ZTNA in 15 minutes for fast time to value.
Ensure Easy Operation
Look for a ZTNA solution offering maximum value with minimum maintenance and no need to hire additional staff. Cloud-based solutions with a unified console are easy to use and provide visibility across all ZTNA use cases.
Ensure High Performance and Service Availability
A ZTNA service must deliver close to 99.999% uptime and high performance backed by Service Level Agreements (SLAs). Review a vendor’s SLAs and look for a global network of points of presence (PoPs) with redundancy in each zone.
Ensure Zero Trust Security Soundness
Look for ZTNA solutions that separate the control and data planes to enable true least privilege access to applications and other resources. They should offer granular in-app controls, such as read, write, administer permissions, and enable policies at the command and query levels. The ability to report on groups, users and application usage with access to video session recordings provides deep visibility. Also check for additional integrated security features such as sandboxing, cloud IPS, and DLP.
Part of a Future-Ready Security Service Edge
Consider how the ZTNA solution can be extended to other use cases—branch access, Internet access, private applications—through a Security Service Edge (SSE). Securing remote ZTNA is a critical step toward a larger zero-trust security architecture.
About the author:
Manish Alshi is the Head of Channels and Growth Technologies – India & SAARC at Check Point Software Technologies.
