Core: Security

Zero Trust and ZTNA

Miro Kosut

Miro Kosut

— 2 min read
Share

Requirement / business driver

Move from "trust the inside, guard the perimeter" to never trust, always verify - because the perimeter has dissolved (cloud, remote work, lateral movement).

Principles

Never trust / always verify, least privilege, assume breach, identity-centric access, and microsegmentation so a compromise can't move laterally. Every access is authenticated, authorised, and continuously evaluated on identity + device posture + context.

ZTNA vs classic VPN

ZTNA grants per-application, identity-and-posture-based access (no implicit network-wide reach), unlike a VPN that drops a user onto the network. ZTNA is typically delivered via SASE/SSE, integrating with SD-WAN (SD-WAN design) and cloud security.

Building it (and migrating)

Build on what you have: identity/NAC + TrustSec SGTs (Network access control and segmentation - NAC, TrustSec, guest and BYOD, AAA and identity - RADIUS, TACACS+, 802.1X) for microsegmentation, encryption everywhere (Transport security and encrypted-traffic implications). AI/ML can help derive least-privilege policy from observed flows. Migrate gradually: start with high-value apps/segments, run alongside the classic perimeter, and tighten - a phased approach (Reference models and migration considerations).

Recommendation / justification

Treat zero trust as the architecture goal that ties identity, segmentation, encryption, and perimeter together - not a product. Lead with identity + microsegmentation + per-app access (ZTNA) and migrate in phases. Justify by the loss of a meaningful perimeter and the need to contain lateral movement.

What would change this (mid-scenario twist)

  • Heavy remote/cloud access -> ZTNA/SASE over traditional VPN.
  • Lateral-movement risk -> SGT microsegmentation first.

Validation checks

  • Is access per-application, least-privilege, evaluated on identity+posture (not network-wide)?
  • Is there a phased migration with the classic perimeter running until cutover?

IPv6 / dual-stack note

Zero-trust policy/microsegmentation must apply to v6 and v4 uniformly; an unsegmented v6 path defeats the model.

Spaced repetition

ZTNA vs VPN in one line: ZTNA = [...]; VPN = [...].

ZTNA vs VPN in one line: ZTNA = per-application, identity+posture access (no implicit network reach); VPN = drops the user onto the network (broad reach).

State the core zero-trust principles.

Never trust / always verify, least privilege, assume breach, identity-centric, microsegmentation.

The pragmatic way to adopt zero trust is [...] - building on identity/NAC + SGT microsegmentation.

The pragmatic way to adopt zero trust is phased: start with high-value apps/segments, run alongside the classic perimeter, tighten over time - building on identity/NAC + SGT microsegmentation.

Sources

  • Cisco Press, SCOR; NIST SP 800-207 (Zero Trust Architecture); Cisco SASE/zero-trust guides.

domain: Core · blueprint-ref: Core 6.4 Zero trust (ZTNA, principles, migration, AI/ML policy) · type: design-decision · status: complete · tags: [core, core/security, tradeoff/security, tradeoff/operability]

Read more