What Is Zero Trust Remote Access?

Zero Trust remote access is an approach to securing remote connectivity that offers more robust protection, faster connections and greater control than traditional technologies like VPNs. Also known as Zero Trust Network Access (ZTNA), Zero Trust remote access applies the principles of Zero Trust, requiring every user, device and application to authenticate on every request when accessing IT resources remotely. 

While VPNs give users broad access to a network and its applications, Zero Trust remote access gives minimal permissions, allowing users and devices only to access the resources they need for a specific task. User sessions and device activity are continuously monitored to mitigate the risk of unauthorized access and prevent threat actors who have entered an IT environment from accessing applications and resources. 
 

Zero Trust remote access is gaining wide adoption as organizations transition to hybrid workforces. Gartner’s Market Guide For Zero Trust Network Access reports that organizations are adopting Zero Trust Network Access technologies at a year-over-year growth rate of 60 percent, spurred by the many benefits of this approach.

• Stronger security. By requiring users and devices to authenticate constantly, ZTNA systems prevent attackers who have gained access to the network from moving freely within it and accessing high-value targets. 
• Reduced attack surface. Users and devices given access to specific applications have no visibility into broader network infrastructure or additional IP addresses, dramatically reducing the attack surface.
• Superior user experiences. ZTNA solutions enable faster performance than VPNs, introducing latency by backhauling traffic through a central network hub. By providing uninterrupted, direct-to-cloud access to private applications, ZTNA technology delivers a more consistent experience for cloud and private network access.
• Ease of management. Zero Trust remote access allows security teams to manage remote access security and enforce policies more easily. Superior ZTNA solutions provide a single dashboard where IT teams can enjoy complete visibility as they monitor user and device activity.
• Effortless scalability. While scaling VPN technology quickly is prohibitively difficult and expensive, ZTNA systems can scale quickly as organizations add users.
• Fast deployment. Zero Trust remote access solutions can be deployed in a matter of days, far faster than traditional technologies.

Organizations can implement Zero Trust remote access by deploying technologies and practices aligned with the principles of a Zero Trust framework. These include:

• Never trust – always verify. Trust is never automatically granted to anyone or any machine inside or outside the network. Every user, device and application must authenticate and continually revalidate when accessing IT resources. 
• Grant least-privilege access. Zero Trust systems grant very narrow permission to access resources. Users, devices and applications may only access the resources they need to perform a specific job.
• Limit the attack surface. In addition to employing least-privileged access, security teams reduce the attack surface by using microsegmentation. This practice creates security perimeters around many smaller areas of a network to prevent attacks based on lateral movement. Microsegmentation may even create security perimeters around individual workloads, applications and business-critical assets.
• Assume threats are present. By assuming that attacks are already underway, security teams can take a more proactive approach to finding them and limit the damage they can cause.

To implement these principles for remote access, organizations typically adopt one or more solutions from ZTNA or network access control vendors. ZTNA technologies create a secure, encrypted tunnel via an outbound connection to a ZTNA service or broker hosted in the cloud. The service monitors access to the network by verifying users and validating the security posture of devices and authenticating identities. The service also provisions secure access to specific applications. 
 

There are two main categories of ZTNA solutions: agent-based solutions and agentless solutions.

Agent-based solutions use software agents on user devices to send security-related information to a ZTNA controller. The controller manages authentication, granting access to limited applications and resources. Most agent-based solutions require some device management infrastructure or installation of software on end-user devices. This model is typically preferred by organizations wishing to reduce the number of unmanaged devices accessing the network.

Agentless ZTNA solutions require no software to be installed on individual devices. This model protects applications in a network or in the cloud by a lightweight ZTNA connector that communicates with a cloud-based ZTNA controller. After the controller authenticates a user or device, traffic flows through the ZTNA provider, isolating applications from direct access. This agentless approach is more attractive for organizations where users are connecting with unmanaged or personal devices.

As part of Forcepoint ONE, Forcepoint ZTNA makes it easy for organizations to implement and manage Zero Trust remote access. 

This ZTNA solution controls access to the private web and non-web apps, enabling organizations to secure both managed and unmanaged devices, including those used in BYOD and by contractors. 

Forcepoint ZTNA also offers continuous, fine-grained controls for easier management, industry-best performance for superior user experiences and built-in malware and Data Loss Prevention (DLP) for superior threat detection and data protection.

With Forcepoint ZTNA, organizations can:

• Replace VPNs. IT teams can limit access to private web apps based on the requesting user's identity, group membership, device type and location. With non-web apps, teams can apply controls per port and protect access from unknown locations or devices.
• Provide safe agentless access. Organizations can deliver agentless access to private web apps on any browser or device, even BYOD and unmanaged devices.
• Control uploads and downloads of sensitive data. Built-in DLP capabilities include keyword search, advanced regex with pattern proximity detection, exact data match, file fingerprinting, MIME types and more.
• Block malware hidden in data files. Malware-scanning engines run in the public cloud, requiring no endpoint AV installations.
• Safeguard access to private non-web servers. With a Forcepoint ONE unified agent, IT teams can enable access to personal non-web apps like a secure shell (SSH) and remote desktop from managed PCs or Macs.
• Rely on high availability. Forcepoint ONE offers proven 99.99% uptime.
• Choose a ZTNA and SASE solution. Forcepoint ZTNA is part of the unified security solution for web, cloud and private apps and the only Security Service Edge (SSE) platform built in the public cloud on a distributed, autoscaling architecture.