Question 1

BN: Why shouldn't enterprises rely on ZTNA alone to secure their zero trust architecture?

Accepted Answer

BS: The problem here is with the word 'alone'. ZTNA solutions primarily focus on device posture and getting users to applications or private network enclaves. For clarity, I'm using ZTNA to describe both of these use cases, including access to public applications such as SaaS that are intended by a company to have restricted access. Many ZTNA implementations are part of Secure Service Edge (SSE) or Secure Access Service Edge (SASE) and also incorporate proxies such as Secure Web Gateways (SWGs) and Cloud Access Security Brokers (CASBs). However, once a user is transported to an application through the ZTNA or ZTNA+SSE stack, most of these solutions lose visibility into what the user can do or is actively doing within the application. This means that authorization policies with ZTNA are typically coarse-grained as they can only make authorization decisions in the form of whether or not a user should be provided transport to an application. It gets even more complicated when we see how many SaaS applications have multiple generations of technologies, integrations of acquired products, or other layered interfaces working in parallel. While a proxy or CASB vendor may be able to reverse engineer limited portions of a few selected SaaS apps, this approach will always be unsupported and at odds with the application, generally leaving large gaps. Now consider the NIST reference architecture on Zero Trust (800-207) and other authorities on what a Zero Trust Architecture (ZTA) needs to achieve: With ZTNA, we can continuously access device posture but not the applications themselves. Also, SaaS applications are independent systems available over the Internet. ZTNA protections don't mean much when they can be completely bypassed by attackers when application security posture doesn’t enforce mandatory SSO or that users may only access the application through the ZTNA. User activities and behavior are somewhat monitored but on a crude basis. As the proxy layer watching user behaviors doesn't really understand the internals of the application and what the user is doing while interacting with those applications, it's highly limited in what it can observe and behaviors it can track. There is also no concept of least privilege or monitoring with respect to external users and cloud to cloud applications. ZTNA and inline proxy solutions were never intended to provide coverage or protections within these SaaS applications to any entities beyond corporate users. As large and flexible platforms, SaaS applications are very often collaboration points between companies and their customers, partners, and prospects. These apps can have dozens of cloud to cloud integrations and thousands, even millions, of external users accessing data and other resources directly within the SaaS platform. All of those integrations and external users are invisible to the ZTNA and proxy implementations. Having zero trust enforced end-to-end is definitely not possible as it really stops at access to the applications. This eliminates the feedback loop that should allow for dynamic policies and continuous adjustment of security controls, another goal of zero trust. Does ZTNA, especially as part of SSE or SASE, add security value for organizations? Absolutely. Does it alone achieve what NIST, the NSA, and others have defined as the goals for zero trust? It does not.

Question 2

BN: How can applications be secured while still maintaining a zero trust posture?

Accepted Answer

BS: The goal is not to replace or even diminish zero trust principles but instead to extend and enforce them through the applications that are necessarily a part of a ZTA. This leads to a more comprehensive embrace of zero trust and stronger security throughout the infrastructure. There are now options available to complement ZTNA and ensure that security principles are not only applied to all resources and access, but are also intricately woven within the fabric of the applications themselves. These enhancements create an end-to-end ZTA and allow organizations to fully achieve the zero trust principles. By ensuring that applications are configured and used in a manner that aligns with zero trust principles, organizations effectively bridge the SaaS security gap. These new capabilities:

Question 3

BN: How does ZTNA tie in with privileged access management?

Accepted Answer

BS: PAM and other changes in user access within applications is naturally a part of continuous assessment and authorization. As a user's access changes, a ZTA should recognize these changes and dynamically adjust policies as appropriate. These behaviors should be automatic and integrated into a ZTA, incorporating the principles of fine-grained authorization decisions and an end-to-end scope. Beyond PAM, it's also possible that a user’s permissions and entitlements don’t change but the applications themselves change. For example, new data or business processes could be added to an application that is now available to users without any change to the user accounts or their permissions. These and other manifestations of context changes must all be handled within a ZTA.

Question 4

BN: Can zero trust help businesses meet compliance standards as well as securing access?

Accepted Answer

BS: In the complex world of compliance, and even more so for security, no single approach can meet every need. However, as the number of compliance mandates continue to grow in volume and complexity -- encompassing perhaps every function in every industry -- there's no question that zero trust principles can indeed help ensure compliance while strengthening security protocols. By now the notion of zero trust is three decades old, and it has largely held firm while just about every corner of the technology market that it originally encompassed has been drastically transformed. In order for zero trust to retain its vitality, it is crucial for those principles to be extended past the network layer and into core applications. A more comprehensive approach that ensures 'never trust, always verify' guardrails by, for example, enabling continuous monitoring into broad-scale access to widely used SaaS applications can go a long way toward not only boosting security but enduring compliance.

Question 5

BN: Does zero trust need to become part of the design process for new apps?

Accepted Answer

BS: The 'Secure by Design' concept has gained popularity precisely because it offers a clear path forward -- when security is an afterthought, as it is in so many consumer creations for example -- it is often inadequate. However, product development is not a singular field. A consumer-friendly mobile app and a piece of network hardware should both be designed with security as a priority, but the process for each is very different. There are likely many fields in which zero trust can play a critical role in product development. However, legislating the inclusion of this notion into every field is likely unrealistic. Image Credit: Nuttapong Punna/Dreamstime.com

ZTNA

The critical gap in zero trust [Q&A]

Recent Headlines

Tuxedo unveils Gemini 17 Gen4 Linux laptop for high performance workloads

Threats improve to slip past firewalls and filters

Paranoia rules -- how automation can enable better detection and response [Q&A]

Google reveals Year in Search 2025

Apple announces more changes at the top

Microsoft is preparing to give the Windows 11 Run dialog a much-needed makeover

Google shares its favorite Chrome extensions of 2025 as AI takes over the browser

Most Commented Stories

Spotify Wrapped 2025 is here, and this time it’s interactive and competitive

Crucial brand to disappear as Micron shifts focus to AI data center memory

Open-source BitTorrent app FrostWire 7 launches with rebuilt engine and zero ads

Google shares its favorite Chrome extensions of 2025 as AI takes over the browser

Opera brings upgraded Google AI to its browsers

Tuxedo unveils Gemini 17 Gen4 Linux laptop for high performance workloads

Google has dropped its antitrust complaint against Microsoft in the EU

Raspberry Pi launches 1GB Raspberry Pi 5 at $45, raises the price of other models

NEWS