Page 124 - Cyber Defense eMagazine August 2023

somewhere–the hasty embrace of ZTNA was shortsighted, and has led to further complication, false
starts, and budget waste for early adopters.

99 Security Problems, Now ZTNA is 1

While initial ZTNA solutions have undoubtedly marked a notable step forward in addressing remote
access security concerns and generally popularizing the concept of zero trust, the technology itself is
problematic on several fronts:

Implementation is a Bear

If you’ve implemented a ZTNA solution, you know it’s not a “plug and play” operation. Far from it. Instead,
you’ll be sidelined by the need to redesign your network architecture from the outset. That may sound
dramatic, but it’s true. Chances are that your perimeter-based security apparatus can’t immediately
secure individual applications and verify every access request no matter the network location of the user.
So, you’re forced to establish an encrypted tunnel between the user and the target application. This
means sending traffic externally (likely to a third-party cloud service), and then back to your network to
verify the request and authenticate the user.

In short, you’ve got your work cut out for you from a re-engineering perspective. You also have a greater
chance of dealing with latency due to the external traffic routing, which can disrupt productivity. For many,
these issues make ZTNA implementation a non-starter, which means it’s actually hampering the growth
of zero trust adoption.

Physical Networks Are Ignored

Sure, securing access for your remote workforce needs to be a priority – that's not a question. People
still work in the office and rely on your organization’s physical wired and wireless networks, however.
While a balance has largely been struck on hybrid work across most industries, many companies have
tamped down on full-time remote work.

This is really just to say that ZTNA misses the mark when it comes to the reach of its zero trust coverage.
The same “trust no one, ever” policy needs to be applied to those plugged into the ethernet or connected
to the Wi-Fi at the office. Without support for these access layers, companies using ZTNA are forced to
adopt another tool (or set of tools) - primarily network access control (NAC) - to define and enforce
authentication, authorization, and accounting (AAA) policies for its on-site users. As anyone in IT knows,
the more tools you have to manage, the greater the threat surface.

Cyber Defense eMagazine – August 2023 Edition 124
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.