As the need for remote access grows, organizations increasingly move away from traditional VPN implementations and towards safer, more effective remote access solutions. Zero Trust Network Access or ZTNA creates safe limits around specific applications, private IPs and host names, replacing default authorized VPN with preset denial policies that grant access based on identity and context.

In 2020, approximately 5% of total usage of remote access was handled mainly by ZTNA, due to the access limitations of traditional VPN and the need to provide session control and more precise access. This number is expected to rise to 40% by 2024.

VPN vs Zero Trust Security

VPN Security

Although VPN offers basic privacy for remote users, it was not designed for security or scalability. Traditionally, organizations have used VPN to connect some remote users to the corporate network for short periods of time. However, issues around VPN are beginning to multiply:

- Users experience slow performance. If the VPN infrastructure lacks the capacity to handle the traffic performance and simultaneous connections created for the workforce, users experience slower Internet connection.

- Corporate networks become vulnerable to attacks. VPN often uses a castle-and-moat model, where the user has limitless access to all corporate resources once they connect to the network.

Zero Trust Security

Zero Trust Security avoids several of the challenges inherent to VPN. It relies on the principle that you cannot preemptively trust in any user or device inside or outside of your network.

With the aim of reducing risk and impact of data leaks, internal attacks and other threats, a zero trust approach:

- Authenticates and logs every log-in and request,

- Requires strict verification of all users and devices,

- Limits information accessible by each user and device base on identity and context

- Adds end-to-end encryption to isolate applications and data within the network.

Ways of configuring ZTNA

- Clientless ZTNA (or service based) uses an existing browser in lieu of a client to create a safe connection and authenticate users’ devices. Traditionally, clientless ZTNA has been limited to applications with HTTP/HTTPS protocols, but compatibility is evolving rapidly.

- Client Based ZTNA (or end-point based) installs the software on each of the user’s devices before they can establish an encrypted connection between the control agent and authorized applications.

•  
• Challenges to Implementing ZTNA

Although ZTNA offers clear advantages over traditional VPN, it is not a perfect approach for ensuring network access for remote users. During the Zero Trust adoption, you may run into one or more of the following challenges:

1. Solutions are not truly cloud native.

2. Providers may not offer client-based or clientless ZTNA options.

3. Set up may be complex and time-consuming.

This content will be of interest to you:

Cloudflare: Long-term Connectivity for Remote Workers

Cybersecurity: Why is it and why protect your business?

Protect and Optimize the Infrastructure of your Business Network with SASE

Cloudflare Approach for Remote Workers

Ensuring and scaling remote access should be a fluid process that doesn’t overlap rigid security solutions, generate performance compensations or unnecessary costs. Cloudflare empowers teams to handle each remote access use case, with the following benefits:

- Simple and risk-free onboarding for users and administrators. Cloudflare easily integrates with existing identity providers and endpoint protection platforms to enforce zero trust policies that limit access to corporate applications and resources.

- Flexibility for client-based and clientless ZTNA deployments. Cloudflare provides clientless support for connections to web applications, SSH, VNC (and soon, RDP), and client-based support for non-HTTP applications and private routing to internal IP addresses.

How Does Cloudflare Approach Remote Access Challenges?

Access without making compromises in protocol support or functionality. The recommended migration path varies depending on the business priorities driving your project:

- If faster connectivity to applications is your priority, first implement client-based ZTNA for non-web applications.

- If improving the security of your application access rules is more important, start with web applications.

- Replacing your VPN is just the first step in a complete network transformation. Because the transition to a SASE model can be overwhelming, we've broken down a common path to Zero Trust security based on the approach our customers have taken.