2022-09-07

What is ZTNA? Ultimate Guide to Zero Trust Network Access

As someone who has been paying attention to enterprise cybersecurity trends for more than a decade, you might be getting tired of hearing about zero trust network access — but it turns out you should probably listen, because it’s not going anywhere. The way we work has fundamentally changed. Remote work isn’t the exception anymore, it is the rule. Staffers log in from home offices, coffee shops, hotel lobbies and international borders. Meanwhile, the old-school notion of a secure corporate perimeter — the “castle and moat” model — has quietly collapsed.

That’s the promise of zero trust network access (ZTNA). It’s not just another buzzword. This is a real reimagining of how enterprises provide access to their most sensitive assets. In this article, we’ll explain everything you need to know about zero trust network access — what it is, how it works, why it’s important and how your company can implement the technology today.

What is Zero Trust Network Access (ZTNA)?

At its simplest, zero trust network access (ZTNA) is a trust-but-verify security model on steroids: Trust no one implicitly, even if they are inside your enterprise network. A corporate office user is accessing from within their office, or a user at your site visiting from a distant location in another country — every single request to access must be checked, authenticated, and authorized prior to being allowed.

Traditional security models assumed that anyone already inside the network perimeter could be trusted. That assumption has proven dangerously wrong. Insider threats, stolen credentials, and compromised devices have made it clear that being "inside the network" means absolutely nothing on its own.

Zero Trust Network Access actually reverses this logic. Rather than providing end users full access to the network to then reach needed applications, resources, files and whatnot, ZTNA enables users to access only the very specific application or resource they require and no more. This is by the principle of least privilege which is something that is recommended by security professionals and also forms one of the key pillars of zero trust network access.

You can think of it as: instead of giving someone a master key to an entire building, you’re giving them a key card that only unlocks the doors they need to get into. If that key card is stolen, the damage is contained. That’s the philosophy behind zero-trust network access.

Why Zero Trust Network Access Matters Now More Than Ever

The cybersecurity landscape nowadays looks nothing like it did a decade ago. Organizations are no longer operating from a single, centralized data center. Applications live in the cloud. Employees work from everywhere. And threat actors have become increasingly sophisticated — exploiting not just technical vulnerabilities, but human ones too.

Here's why zero trust network access is a strategic imperative:

The proliferation of remote work and BYOD (Bring Your Own Device): When employees log in via personal devices from home networks, the traditional perimeter doesn’t exist. Zero trust network access confirms that each device — personal or corporate — is authenticated prior to making contact with sensitive information.
It’s getting harder to attribute internal threats: Not all threats come from outside. Disgruntled employees, stolen credentials, and inadvertent data leaks are real-world threats. ZTNA also helps limit the blast radius of an insider incident by limiting an individual’s access to the bare minimum of what they need.
Perimeter evaporated with cloud adoption: With applications living in AWS, Azure, Google Cloud, and SaaS, there is no “inside” anymore to protect. Zero trust network access is by nature cloud native and was developed with this very distributed scenario in mind.
Ransomware and Lateral Movement attacks: The most damaging actions an attacker can perform after gaining an initial foothold in a network is moving laterally — jumping from target to target in the network to escalate privileges and access sensitive resources. Zero trust network access can put a stop once and for all to lateral movement by treating each connection as separate and conducting individual verifications.

How Does Zero Trust Network Access Work?

Having a better idea of how zero trust network access actually works under the hood goes a long way to explaining what makes it so good. It isn't too hard to do once you take it one step at a time.

Step 1 — Identity Verification

When a user wants to access a resource, zero trust network access determines who the user is first. This usually means multi-factor authentication (MFA), validating credentials with an identity provider (IdP), and looking at contextual clues such as the user’s role, location, and the health of their device.

Step 2 — Device Posture Assessment

Zero trust network access is focused on both identity and device posture — but also the health of your device. Is the device using current software? Does it have endpoint protection? Does it comply with company security requirements? A user may have valid credentials, but if their device is compromised, zero trust network access will block or limit access as appropriate.

Step 3 — Contextual Policy Evaluation

This is the point where zero trust network access starts becoming truly intelligent. Access decisions are not binary (grant/deny) — they are contextual. Things such as time of day, location, IP address and the sensitivity of the resource being requested are all inputs to a dynamic policy engine that determines the exact amount of access to provide.

Step 4 — Least-Privilege Access Enforcement

When all checks have passed, zero trust network access establishes an encrypted, one-to-one micro-tunnel between the user's device and the application required. The user cannot access anywhere else on the network, but no other part of the network is visible or accessible to them. This layer of application-level segmentation is what makes zero trust network access so fundamentally different from a VPN.

Step 5 — Continuous Monitoring and Re-verification

Here's something a lot of folks don't realize: zero trust network access does more than perform a single identity verification at login. It is monitoring session behavior in real time for any unusual behavior that could indicate a compromised account or bad actor activity. If a suspicious activity is detected during an ongoing session, access can be terminated immediately.

ZTNA vs. VPN: Why Zero Trust Network Access is a Better Choice

VPNs have been the standard for remote access for a long time. They are known quantities, well established and reasonably straightforward to implement. However, with the modern threat landscape, VPNs have several fundamental vulnerabilities that zero trust network access was built to mitigate.

VPN vs. Zero Trust Network Access (ZTNA)
Feature	VPN	Zero Trust Network Access (ZTNA)
Access scope	Full network access	Application-specific access only
Trust model	Implicit trust once connected	Continuous verification, never implicit trust
Lateral movement risk	High — attackers can move freely	Minimal — micro-tunnels isolate each session
Cloud compatibility	Limited, often requires hardware re	Cloud-native, works across multi-cloud
User experience	Often slow, especially over distance	Optimized, direct-to-application connections
Visibility	Limited traffic visibility	Deep, continuous session monitoring
Scalability	Hardware-dependent, costly to scale	Scales elastically via cloud infrastructure

The problem with a VPN, fundamentally, is that it is putting a trusted user inside the network – and that user can potentially go much further than they should once inside. Zero trust network access removes that risk entirely by simply never putting users “inside” networks to begin with. Each connection is isolated, encrypted, and scoped to exactly what is needed.

There’s also a performance argument. VPNs frequently send traffic through centralized servers, where bottlenecks build, aggravating users and slowing their productivity. Delivered via the cloud, zero trust network access directs users straight to their applications with the least possible delay — a bonus for both security and user experience.

The Fundamental Precepts of Zero Trust Network Access

Zero trust network access is supported by a series of principles that, when combined, deliver a radically more resilient security posture.

1. Never Trust, Always Verify

This is what is at the core of the “never trust; always verify” motto of zero trust. No user, device, or system is ever trusted by default — not even those within the corporate network walls. Every request for access is considered to be hostile until proven otherwise.

2. Least Privilege Access

Zero Trust Network Access – users should be given access to only those resources they really need to do their job — and nothing else. That potential damage is greatly limited.

3. Assume Breach

Zero trust network access considers a breach has occurred or will occur. Rather than attempt to construct an unassailable perimeter, it prioritizes damage control and limiting what a potential attacker can reach once inside.

4. Micro-Segmentation

Micro-Segmentation Zero trust network access does not treat the entire network as one continuous area but rather enables granular divisions within. Each application, workload, and resource resides in its own isolated zone connected only through authenticated, encrypted micro-tunnels to users.

5. Continuous Validation

Continuous Validation Access is not a one-time decision in zero trust network access. Sessions are continuously monitored and re-evaluated. For example, if a user's risk profile changes while the user is connected — they suddenly begin downloading unusual amounts of data — the level of access they are granted can be modified or revoked in real time.

The Technologies That Make Up Zero Trust Network Access

There’s no one technology on which zero trust network access depends — it’s an architecture that relies on several complementary technologies.

Software-Defined Perimeter (SDP)

The software-defined perimeter is also a core component of zero trust network access. SDP hides network resources from unauthorized users – they cannot find them, nor reach them. Only once a user has been authenticated and authorized, will the SDP establish a direct, encrypted link to the particular resource that the user requested. This "dark cloud" approach is one of the reasons why zero trust network access is very effective at diminishing attack surface.

Identity and Access Management (IAM)

Strong identity verification is key to zero trust network access. Contemporary Identity and Access Management (IAM) solutions are integrated with ZTNA to apply multi-factor authentication, role-based access control and single sign-on (SSO) – enabling each access request to be associated with a validated, authentic identity.

Multi-Factor Authentication (MFA)

Zero trust network access is heavily dependent on MFA to prevent stolen credentials from being used to gain access. By adding a second (or third) factor — such as a biometric scan, hardware token, or push notification — ZTNA significantly reduces the value of stolen credentials as an attack vector.

Micro-Segmentation

As stated above, micro-segmentation is what makes ZTNA work when separating workloads or applications from each other. If an attacker succeeds in breaching one segment, they are not able to walk laterally to other segments without being re-verified.

Continuous Monitoring and Analytics

Zero trust network access systems utilize behavioral analytics and real time monitoring to identify suspicious activities. These technologies learn what is normal for a user or device and can identify anomalous behavior — such as a user logging in at 3 a.m. from a location they don't usually access resources from — and initiate automated responses.

ZTNA and SASE: A Powerful Combination

Zero trust network access is not designed to be used alone. It's increasingly being built-in as a foundational element of the Secure Access Service Edge (SASE) model — a cloud-centric model that fuses networking and security services together in a singular, cohesive service. Identity-centric, application-level access control in zero trust network access is handled by ZTNA within the SASE framework, with the rest (Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), SD-WAN) providing additional networking and threat protection services. They combine to form a comprehensive security fabric for every user, device, and application — anywhere.

For organizations that are on the path to a complete zero trust network access implementation – SASE offers a realistic, scalable route. Instead of integrating many point solutions, SASE combines zero trust network access with other essential security functions into one cloud-based service.

Real-World Use Cases for Zero Trust Network Access

Zero trust network access is not only a conceptual approach — it actually addresses real and urgent problems organizations deal with daily.

Securing Remote Workforce Access

This is probably the most popular use case for zero trust network access today. As employees work from home, on the road, or at client sites, organizations have to find a way to provide secure access to internal applications without opening up the entire corporate network. Zero trust network access provides just that: Safe, application-level access on any device, from any location.

Third Party and Vendor Access

Allowing vendors, contractors and partners to access certain tools but not your wider network is a classic security challenge. Zero trust network access addresses it well — you can provide a third party access to a single application for a limited time, and you’ll have an audit log for the full transaction.

Protecting Cloud and Hybrid Environments

As organizations move workloads to the cloud, zero trust network access enforces the same access controls for on premises, cloud, and hybrid workloads. Users have a consistent experience no matter where the application is, and security teams have centralized visibility and control.

Replacing Legacy VPN Infrastructure

Many companies are already in the process of replacing legacy VPN infrastructure with zero trust network access solutions. The advantages are obvious: enhanced security, improved performance, reduced operational burden, and an architecture that scales with the business.

Preventing Ransomware Spread

ZTNA is very effective in limiting propagation of ransomware in the first place. It also segments the network — and requires you to re-verify at every step — so that even if someone punches in, they can’t use that access to break out into other parts of the network, limiting the potential damage to a single, quarantined segment.

How to Deploy Zero Trust Network Access: A Practical Guide

Implementing zero trust network access is a journey, not a light-switch moment. Here’s a realistic phased approach that scales for all sizes of organizations.

Phase 1: Discover and Map Your Assets

You can’t protect what you don’t have, and you can’t protect what you don’t know about. Begin by listing all applications, data stores, users, and devices in your organization. Know how traffic traverses each — which links are business-critical, which are redundant or outdated. This reconnaissance phase is the cornerstone to any good zero trust network access rollout.

Phase 2: Define Your Access Policies

With a complete inventory of your assets, you can begin to decide who should be allowed to access what — and under what conditions. This involves assigning user roles to applications, specifying device compliance criteria, and creating location-based policies (e.g., “contractors can access the project management tool only from 9 AM to 6 PM on authorized devices”). The more specific your policies, the better the implementation of ZTNA will be.

Phase 3: Deploy Identity and Device Verification

Roll out strong identity verification -- ideally MFA -- throughout your organization. Connect your identity provider to your zero trust network access platform. Use endpoint detection tools to evaluate device health and compliance. These are the foundational elements that enable zero trust network access to function in reality.

Phase 4: Implement Micro-Segmentation

Start to divide your network and applications. Start with your most critical assets — financial systems, customer data, intellectual property — and radiate out. Zero trust network access micro-segmentation can also guarantee that if a segment is breached, the attacker cannot move laterally into the rest of your environment.

Phase 5: Monitor, Tune, and Iterate

Zero trust network access isn’t "set it and forget it." After implementation, you must continually observe access habits, assess policy efficacy, and realign with your organization as it changes. New applications, employees switch roles, the threat landscape evolves — your zero trust network access policies must keep up.

Typical Issues in the Adoption of ZTNA

Adopting zero trust network access (ZTNA) can be challenging. Knowing what these challenges are at the beginning enables the organization to better prepare.

Compatibility with the legacy infrastructure is usually the first challenge. Older apps weren’t designed with zero trust network access (ZTNA) in mind and retrofitting them can be tough. The most pragmatic path often is a phased one — focusing initially on modern, cloud-native applications and then extending to legacy systems.

Concerns about user experience are valid. If zero trust network access induces friction — additional login steps, sluggish connections, constant re-authentication requests — users will circumvent it. The challenge lies in finding a zero trust network access solution that offers a proper level of security while providing a smooth, seamless user experience.

Culture and change management in an organization can be more challenging than expected. Transitioning from a perimeter-based system to zero trust network access involves more than technical adjustments; it's a change in mentality—from “trust but verify” to “never trust, always verify.” Engaging leadership and keeping end users informed is key to success.

Zero Trust Network Access: Key Benefits Summary

To summarize, here is a quick overview of the benefits zero trust network access brings to modern enterprises:

Benefit	What It Means in Practice
Reduced attack surface	Applications and resources are invisible to unauthorized users
Lateral movement prevention	Micro-segmentation stops attackers from spreading through the network
Stronger compliance posture	Granular access logging supports regulatory requirements
Better remote work security	Secure access from any device, any location, any time
Improved user experience	Direct-to-application connections reduce latency vs. VPN
Centralized visibility	Unified policy management and real-time monitoring across all access
Cloud and hybrid ready	Works seamlessly across on-premises, cloud, and multi-cloud environments

Start Your Zero Trust Network Access Journey with TrueCONNECT™ SASE

To tie it all back up, here’s a quick recap of what zero trust network access means for modern organizations.

Begin Your Zero Trust Network Access Path with TrueCONNECT™ SASE. The road to strong zero trust network access doesn't have to be confusing — but it does require the right partner. CITIC Telecom CPC's TrueCONNECT™ SASE is designed to enable enterprises of all scales to adopt zero trust network access within a holistic, cloud-native security architecture.

Purpose-designed for modern decentralized enterprises, TrueCONNECT™ SASE moves security to the software-defined perimeter — removing performance chokepoints as it guarantees that each user, application, and device is secured at every access location. It also perfectly complements TrueCONNECT™ Hybrid, a fully-managed SD-WAN solution, to provide a genuinely secure, high-performance SD-WAN architecture that helps you accomplish your zero trust network access objectives from start to finish.

If you’re new to zero trust network access or you want to speed up an existing deployment, TrueCONNECT™ SASE puts the tools, know-how and infrastructure within reach – without the complexity.

Ready for the next level? Download the TrueCONNECT™ SASE product leaflet or send us a query to talk with one of our cybersecurity experts.

Related Blog: