Back 
Behind tremendous interest in zero trust security and its crucial role in the SASE journey, many practitioners choose zero trust network access (ZTNA) as their first step toward transformation.
If you are planning a ZTNA project, here are some ideas and tips that can increase your odds of success and provide a smooth transition from legacy remote access VPNs to ZTNA.
Know your organization and how ZTNA will benefit multiple teams
Have a clear understanding of your organization’s goals and objectives. It helps to be explicit, as zero trust and ZTNA may mean different things to different teams. Is the project initiated from the networking team, or the security team, or is it a joint project? What are the business drivers and the desired outcomes? Is there a broad zero trust or SASE initiative from your CIO or CISO for security transformation? Is it to support remote and hybrid work? Or to support cloud migration?
Different teams may have different aspirations
Zero trust is increasingly a shared project that unifies the security and networking teams around common goals and outcomes. This is not a surprise considering ZTNA delivers benefits that, while different, are valuable to each team. For security teams, ZTNA solutions shrink the digital attack surface, reduce the liability of VPNs and DMZs, and eliminate unauthorized lateral movement within your network. For networking teams, ZTNA can simplify network operations and routing, connect users directly to corporate resources regardless of where they are hosted (including in private data centers), and eliminate the need to hairpin network traffic through a cumbersome VPN concentrator.
Once you have a clear understanding of your organization’s goals and those of each individual team, you can identify the key use case to start. A detailed understanding of your users and applications—including your exposure to unmanaged (or “shadow IT”) applications will greatly assist this analysis.
Identify your first use cases
Identifying key use cases and selecting some quick wins is an easy way to build confidence in ZTNA projects.
Here are some common use cases:
- Employee remote access – Now that hybrid work is the new normal, this is the most common use case both for ZTNA and for SASE as a whole. If this is your primary first use case, it makes sense to start small with your ZTNA project and focus on one user group at a time, or one geographic location of your enterprise. You might want to start with corporate issued (managed) devices and later expand the scope to support employees using BOYD as well.
- Cloud migration – This is a great opportunity to leverage cloud-delivered ZTNA to connect employees directly to private applications hosted in the public environments, and to provide native DevOp access, using SSH or RDP without exposing the applications to the public internet. This will help you eliminate the headaches of setting up VPN virtual appliances, or routing traffic through your corporate data center and VPN concentrator only to send users to the cloud.
- Third-party access – Does your organization need to extend application access to third-party users, partners, suppliers, and contractors? It is risky to extend VPN access to third-parties where you don’t have clear visibility and often do not have control over their security practices. ZTNA allows you to enable application specific access, and no more.
ZTNA services like Netskope Private Access, support clientless access and can protect your sensitive data from being downloaded by a third-party, and/or to unmanaged devices such as employees using BYOD. With the same centralized DLP controls, you are able to extend access, enable collaboration with third-parties, and at the same time enforce data protection to prevent sensitive data from leaving your organization.
- VPN replacement – I view this more as an overall motivation rather than one specific use case. All of the use cases above can help chip away your reliance on remote access VPN. If your organizational goal is to replace VPNs, this will be a journey—a rewarding one. Moving from VPNs to ZTNA is not a simple rip-and-replace. Think about the specific use case and take it one step at a time and give your team ample time on this journey, with proper planning and execution.
Plan to support both VPNs and ZTNA during the transition period, however long the journey. To enhance user experience, focus on one user group at a time and deliver application access to this user group supporting all the applications they need to access. This will help ensure a harmonious experience for your users throughout the transition.
Identifying your users, apps, and devices
As a highly regarded ZTNA solution, Netskope Private Access connects users and their devices to the resources directly and securely, using the power of identity and context. With NPA and its integration with identity providers, you can define granular access policies based on user identity, roles, and risks, as well as device posture, and for managed or unmanaged devices.
Following users, you need to have a clear picture of what applications your target users need to access. Where are these applications hosted, legacy apps in data centers, in the cloud, or hybrid? It is a good idea to discuss with your applications team and understand any future plans to migrate these applications from enterprise data centers to host them in cloud environments, or change to SaaS.
Remember: Migrating to ZTNA is like providing a white-glove concierge service that not only takes each individual employee into the “building” they’re trying to access, but also leads them to the specific room they’re supposed to visit. To extend our metaphor, achieving this requires detailed knowledge of the building and who needs to go where in that building.
A good ZTNA solution can also help you map out your application landscape; in Netskope Private Access, we call this application discovery. You can use detailed discovery information to define application-specific access policies. To accelerate this process, Netskope also provides API tools to automate the process of administrative application settings and ongoing maintenance, such as scaling up and down the resources to meet demand and optimize cost.
Additional automation can also link with ticketing systems to grant user requests for access. For example, users raise a ticket to request access to an application. Once approved, the system can automatically update the access policy and enable access, as well as automatically deprovision access once users no longer have the privilege or have left the organization.
Moving to ZTNA is a journey—one that gets a lot easier with the right solutions, such as Netskope Private Access—and it takes a village. I encourage you to partner with application owners and line-of-business owners to gain a clear understanding of applications, access, and user roles. Over time, you will build up conditional access, and through the power of adaptive trust and context, you should revisit access policies on a regular basis, while continuing to enhance the controls and layer on data protection.
For more on Netskope Private Access:
Read the blog