Moving away from VPNs as a means to protect corporate networks at the perimeter and moving toward zero-trust network access requires careful enterprise planning and may require implementing technologies that are new to individual organizations.\nZTNA employs identity-based authentication to establish trust with entities trying to access the network and grants each authorized entity access only to the data and applications they require to accomplish their tasks. It also provides new tools for IT to control access to sensitive data by those entities that are deemed trusted.\nIt can take many different forms\u2014software, hardware and as a service\u2014and can be provided by a large number of networking and security vendors.\n\nZero trust and SASE\nZTNA is compatible with the broader secure access service edge (SASE) architecture for the convergence of security and network features into a unified cloud service.\u00a0 SASE is in line with ZTNA assumptions that any user, device or application could be compromised, so ZTNA can be thought of as technology to help migrate towards a SASE architecture. But implementing ZTNA is not a simple task.\nRolling out ZTNA\nAdopting it requires significant, coordinated work by enterprise IT and security teams, which is always a potential source of delay, so teams should focus on their business goals, streamlining access while securing sensitive data and maintaining compliance.\nThe first steps are to discover what data needs to be protected and to identify current access and data flows across the network. This is necessary to reveal possible weaknesses in security and to create policies that defend against them.\nOne method to limit damage caused by successful breaches is network segmentation, which limits the resources that each authorized entity has access to. That way if a breach is successful, the attacker has access only to the network segment that has been compromised.\nThis implements one of ZTNA\u2019s basic principles: enforcing least privilege, which grants users access to only the applications and data that they require.\nZTNA authorizes access based on identity (who you are) rather than your location.\u00a0 It minimizes risk by applying granular access polices to data via a dynamic policy engine that assesses multiple factors including device, location, network, behavior, and the data being requested in order to confirm an authentic identity or to request reauthentication.\u00a0\u00a0 For example, ZTNA may deny access to a user requesting sensitive data from an unfamiliar location, in the middle of the night from an unknown device.\nAs part of ZTNA, enterprises need to monitor access so they can better enforce their specific access policies. And they should also implement automation and orchestration to reduce complex, time-consuming manual changes that would otherwise be needed to create and enforce policies.\nBenefits\nZTNA is compelling in the current distributed environment of cloud-applications, remote users with BYOD and a multitude of IoT devices.\u00a0\u00a0\nIt is based on an architecture that virtualizes software and hardware layers and establishes segmentation that isolates critical data. Further, it provides a consistent method for authenticating and authorizing access to both private and public clouds, including SaaS applications.\nIts centralized management provides IT and security teams the flexibility to custom design appropriate access for users given time of day, device type and location. And ZTNA can unify the IT and OT security divide by providing secure access for IoT devices, which can be numerous.