Zero trust architectures have gained rapid adoption by cybersecurity teams recently with the rise of knowledge workers moving to remote or hybrid work models. The need to secure access for these workers without compromising their productivity, especially in light of increased cyber threats, drove cybersecurity teams globally to explore, evaluate, and implement a zero trust model. With their flexibility and scalability, zero trust architectures help keep enterprise workers and enterprise data safe by eliminating implicit trust and giving employees “just-enough” access based on contextual factors such as user identity, location, specific applications, and security of the endpoint.
By ensuring that workers only receive access to the apps they requested and are authenticated to access, zero trust architectures help reduce the enterprise attack surface by blocking threat actors from using vulnerable or compromised endpoints as launch points for lateral movement toward enterprise “crown jewels.”
What Are the Principles Behind Zero Trust Network Access (ZTNA)?
The most basic principle of zero trust network access (ZTNA) is that users are only given as much access to an application as they need to complete their given tasks. At its core, a zero trust approach works on the principle of “never trust, always verify.” This means that no one should be given access to any protected application unless they have proved that their identity and that their device is safe. Once identity and context awareness are established, “just enough” access is granted. This means that access is only given to the specific application — not to the full network. Also, the connection from the application is an outbound connection — the application does not broadcast its IP address to the open internet. As a result, a zero trust security approach makes it more difficult for threat actors to target the application in a DDoS attack.
Context awareness and continuous authentication determine information about each individual user and their device, such as location, user role, user risk profile, device type, software installed on the device, which is used to help verify that they are the correct person to access specific information. If something doesn’t match what’s known about the user, network access gets declined.
Why Do Companies Today Need ZTNA?
The landscape of the working world has changed completely, remote work is here to stay, and knowledge workers aren’t looking to move back to the office any time soon. With classic approaches to network security and access management policies being tested to their limits by this new normal, innovative solutions are required to ensure that access in a hybrid-work, multi-cloud environment is secure. Zero trust architectures help ensure better enterprise cybersecurity by allowing companies to easily implement “just-enough” access control policies to better secure both their on-premises and cloud applications. A zero trust security model also makes your organization more effective at risk mitigation and helps control lateral movement of threats in your networks.
What makes a zero trust model so robust for cloud security is that it does not provide users with network access, they can only have access to individual application layers. When combined with the fact that ZTNA hides services from discovery by malicious actors — it becomes far more challenging to compromise than traditional security solutions like VPN or firewall. For these reasons, the cybersecurity provided by implementing zero trust architecture is a reliable block against some of the most prevalent security threats to the cloud, including malware, phishing attempts, and ransomware, as well as more targeted and advanced attacks. A zero trust model can also be used to limit cloud access of your contractors or other temporary employees to only what they need to see to complete their jobs, helping your company achieve a stronger security and regulatory compliance posture.
ZTNA also allows organizations to completely replace their VPN systems. VPNs worked fine when there were only a few employees who would be using them regularly. Today they are not efficient or protected enough for the task, especially with remote workers and hybrid workers becoming more the norm. With modern work styles, VPNs are highly vulnerable to network-level attacks, whereas a zero trust security model can lock threat actors out of the infrastructure and limit the amount of damage they can do. BYO devices are increasingly the norm, especially for contractors and temporary workers who you may not want to let into your network infrastructure as a matter of access management policy. ZTNA helps far better than a VPN both for onboarding and network security.
To give a partial example of some of the uses of zero trust architecture for a company, consider the following hypothetical use case regarding least privilege user access based on specific user needs:
Least Privilege Access Based on Specific User Needs
Scenario: Hercules Athletics LLC hires a supply chain expert, a contractor from Singapore, to assist with an urgent issue. She uses her personal laptop — an unmanaged device — and will only need access to one specific internal application.
What is at risk: Contractors and temporary workers are usually given access in full or no access at all to internal applications. If given full access, the contractor can view sensitive pricing information across multiple suppliers and accidental or intentional leak of this info could have major consequences for the company. And if they are denied access, they are far less effective at doing the job they were hired for.
How Citrix ZTNA protects: Policies and controls can be configured to provide access on a per-application basis, without sacrificing security based on the user’s identity and authorization levels, by Citrix Secure Private Access (SPA). These policies can apply to any individual or specific type of group — for example, contractors.
How Can You Implement ZTNA?
When looking to build a zero trust model, it’s important to remember that it’s a collection of capabilities like an IdP, MFA, and the core ZTNA product itself, that are guided by a framework that focuses on constantly evaluating the company’s risk position and focuses on access control. If you think about it, ZTNA is like peace or happiness — a state of mind, backed up by some fun toys to play with. Every organization will be different in how they go about implementing a zero trust architecture but there are some common steps that every organization should focus on when looking to build a network security framework, including:
- Assess your existing cybersecurity posture and access controls and develop an understanding of key network flows and places of potential vulnerability.
- Determine the surfaces in your network that need to be protected and will benefit most from taking zero trust security measures.
- Implement specific technologies that suit your organization’s security needs such as multi-factor authentication, proxies that don’t rely on VPNs, and strong authentication protocols like adaptive or risk-based authentication.
- Develop systems, processes, and tools to keep your organization’s network constantly monitored for suspicious activity, then optimize your approach to create a streamlined and frictionless zero trust strategy.
Following this general framework, modified specifically for your company, is a strong way to start off on your zero trust architecture journey. After implementation, there are a few key concepts of zero trust security that you must always keep in mind when honing and developing your system. A white paper created by ESG for Citrix highlights these as key components to maintaining your zero trust security posture. It recommends that organizations always take care to:
- Deliver a digital workspace.
- Ensure that devices are secured.
- Create a way of consistent secure access.
- Protect against data loss and significant threats.
- Monitor the activity of all users for erratic behavior.
What Makes an Ideal ZTNA Vendor?
When looking for a zero trust architecture vendor, you want to look for a company that can meet your specific business needs and can deliver a suite of products that will help you easily manage and organize your company’s new security method. At minimum, your ZTNA service provider should be able to help supply you with the following features:
- Scalability to meet your needs and the needs of a growing remote workforce.
- Advanced threat protection to help your security team stop malware, ransomware, and zero-day threats.
- BYOD deployment options, ideally agentless to help support your organization’s BYOD security
- Robust data breach and loss protection services including encryption and exact data matching to assist with your company’s data retention and protection policies.
- Granular visibility to assist with regulatory compliance and data gathering.
Citrix, a provider of zero trust network access solutions, hits all these marks and more. Trusted by 98 percent of Fortune 500 companies and with 100 million users worldwide, Citrix is a premier provider of ZTNA solutions to meet every corporate need. Our wide suite of zero trust security measures includes Citrix DaaS, which protects access to virtualized apps; Citrix Secure Private Access, an adaptive authentication solution that removes the need for unsecure VPNs; and Citrix Analytics for Security, which tracks users and identifies suspicious behavior through individualized risk scores.
Zero trust network access is an essential element of any business and IT strategy and security policy that looks to leverage hybrid or remote workers for either the short- or long-term future. With its flexibility and scalability, it works to keep your network safe whether it’s based on-premises or in the cloud. By giving your employees and contractors access only to applications instead of your specific network, you minimize your attack surface, limit the risk of malicious actors harming your data, and increase your regulatory compliance posture.