Zero Trust Network Access

Zero Trust Network Access (ZTNA) simplifies the management of network access by replacing the traditional VPN approach. Instead of maintaining a complex network of VPN tunnels and perimeter security measures, ZTNA ensures access based on the user's identity and context, regardless of their location. For teleworkers, ZTNA provides a seamless and secure connection without additional infrastructure.

Users in the office also benefit from a more flexible security architecture based on granular access controls. Third-party providers and external partners receive only the minimum access required, which simplifies the administration and monitoring of access. ZTNA thus reduces the workload for IT teams and increases efficiency by providing a centralized, on-demand security solution in hybrid work environments.

With Zero Trust Network Access (ZTNA), multi-factor authentication (MFA) can be integrated into legacy applications without the need to customize these applications themselves. ZTNA acts as a gateway between users and legacy systems by requiring additional authentication steps, such as an SMS confirmation or the use of an authenticator, in addition to the traditional login.

This modernizes the security architecture of the legacy applications without affecting their original functionality. ZTNA continuously verifies the user's identity and context before granting access and can make risk-based decisions that further enhance security. This way, legacy software is made fit for the modern security landscape without the need for extensive changes to implement MFA.

With Zero Trust Network Access (ZTNA), access to cloud environments can be effectively secured by continuously verifying and granting access based on the user's identity, location, and device posture. ZTNA replaces the traditional perimeter model by basing access to cloud resources on the principle of “never trust, always verify”. This involves considering every user and every device as a potential security risk, requiring constant verification and authorization of access.

ZTNA enables fine-grained access controls so that only authorized users can access specific cloud applications or data. In addition, ZTNA protects against unauthorized access through security vulnerabilities in cloud infrastructures by integrating additional authentication and verification mechanisms such as multi-factor authentication (MFA). This ensures that only authorized users with the right permissions can access sensitive data in the cloud.

Access by suppliers and service providers (consultants, outsourcers, support staff, etc.) can be specifically secured with the help of a Zero Trust Network Access solution (ZTNA), in which only authorized users can access specific resources that are relevant to them.  ZTNA ensures that every access is continuously verified based on the user's identity and context, such as location or device state. This ensures that only trusted partners with the right permissions are granted access.
‍
In addition, ZTNA enables fine-grained access control so that suppliers and service providers only see the data and applications they need to do their jobs. Access is further secured by integrating multi-factor authentication (MFA) and risk-based authentication methods. These measures reduce the risk of unauthorized access and minimize potential security vulnerabilities when working with external partners. ZTNA ensures a flexible yet strong security architecture when integrating external parties.

The difference between a Direct Routed and a Cloud Routed Zero Trust Network Access (ZTNA) lies in the way network traffic is routed between users and resources. In a Direct Routed ZTNA, traffic is typically routed directly over the internet and a central ZTNA gateway that verifies access based on the user's identity and context. Resources are accessed from the organization's own network perimeter, allowing a direct connection between the end user and the target systems. By contrast, in a cloud-routed ZTNA, all traffic is routed through a cloud platform that acts as an intermediary. By design, traffic is broken up (decrypted and re-encrypted) at least once at the provider.
‍
The direct-routed approach offers a number of advantages, including complete control over network traffic, universal access controls for all users, devices, and workloads, low latency with high availability, and predictable pricing.

With Zero Trust Network Access (ZTNA), risk-based rules can be dynamically applied to control access based on the user's circumstances. For example, access to sensitive data can be denied or restricted if the user is accessing from an unusual location or an unsecured device. In addition, rules can be defined that only allow access if the user has successfully passed multi-factor authentication (MFA) or certain security standards are met on their device. Higher authentication requirements can be automatically enforced in the event of suspicious login attempts or sudden changes in user behavior. Likewise, it is possible to block access if the user's device is out of date or does not have the latest security updates. Further rules could be based on the time of day, the user's geographic location, or the type of access requested, to ensure that only risk-free connections are allowed.

Ein wesentlicher Vorteil unseres Ansatzes ist die signifikante Reduzierung von False Positives. Während viele herkömmliche Sicherheitsscanner eine Vielzahl an Schwachstellen melden, die in der Praxis nicht ausgenutzt werden können, überprüft unsere Plattform jede identifizierte Schwachstelle auf ihre tatsächliche Ausnutzbarkeit. Dies bedeutet, dass nur realistisch ausnutzbare Lücken in den Berichten erscheinen, wodurch die Anzahl der falschen Alarme drastisch gesenkt wird.

Unsere Lösung bietet zudem nachstellbare Beweise für jede Schwachstelle, die als kritisch eingestuft wird. Dadurch können IT-Teams genau nachvollziehen, wie eine Schwachstelle ausgenutzt werden könnte, und sich gezielt auf die tatsächlichen Risiken konzentrieren. Dies erhöht nicht nur die Effizienz der Sicherheitsbewertung, sondern reduziert auch den Aufwand für die Behebung unnötiger oder irrelevanter Lücken.

Durch die Eliminierung von False Positives sparen Unternehmen wertvolle Zeit und Ressourcen, die andernfalls für die Bearbeitung von nicht relevanten Schwachstellen aufgebracht würden. Stattdessen können die Teams ihre Anstrengungen auf die tatsächlichen Bedrohungen konzentrieren und die Sicherheitslage gezielt verbessern.