Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

Question

I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of networking security very enticing. So I researched on providers of zero trust solutions and also read the appropriate NIST architecture specification.

So generally speaking, in a zero trust network, clients register via an installed application at a gateway and send all of their data to that gateway. The gateway then checks if the user's request is legitimate and forwards it to the appropriate server. The server's return data is again checked for anomalies and, provided nothing was found, forwarded to the user. Failing the existence of a client, users may be able to use a web-gateway (similar to a Captive Portal in a 802.1X setup).

What strikes me as odd is that this explanation sounds awfully a lot like a network architecture where users are accessing resources through a VPN, ideally provided by a firewall, and the VPN gateway then acts as a Man-in-the-Middle to decrypt the TLS connections between user and server so as to perform ARM, DPI and AV functions (and re-encrypt if no anomalies have been found).

This may become problematic if you have hard restrictions by way of data protection regulations or other hurdles that prevent you from inspecting basically all (user) data in your network. In fact, one of the major criticisms of NGFW solutions is that to produce the advertised security, the firewall needs to decrypt the encrypted packets so as to be able to prevent malicious data from entering the corporate network. But if Zero Trust architectures functionally are doing the same thing by actively being a Man-in-the-Middle, then this criticism is not alleviated.

Is there another aspect to current zero trust architecture solutions that I am currently missing?

Answer 1

The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components to make a whole package.

Simply providing a VPN tunnel for remote clients (or local clients with no trust, doesn't matter in ZTNA) is not enough to accomplish Zero Trust, even if the VPN client software provides features for verifying 'client posture' to make sure it has functional anti-virus etc. Securing the client only makes part of the network 'zero trust'. Resources on the local network also need to be secured. ZTNA requires those internal platforms and cloud platforms the organization uses also have software to help control their connections and data transfer, including between devices on the internal network.

For example: Employees may bring in devices or data that is infected or suspect and infect an internal system that is 'trusted'. Without controls on the internal devices, a beachhead infection on a trusted device could easily spread to other trusted devices.

Also it helps limit and mitigate trusted people doing things they should not by interfacing between devices that would not otherwise pass traffic through a gateway where the traffic might be inspected.

To make it effective, you need a mostly centralized or fully centralized management platform for this kind of approach, otherwise it becomes too complex for administration to keep an effective handle on it all.

Simply controlling data access from remote users is not enough.

Answer 2

Conceptually speaking, TLS and VPN are very similar. Vendors can, and often do, recast their VPN products as Zero Trust in order to capitalize on the marketing value.

Answer 3

Zero Trust (ZT) is a security concept that assumes all users and devices are untrusted until proven otherwise.

Your question is about Zero Trust Network Access (ZTNA) which is an implementation of the ZT concept that applies to network access.

Where ZTNA conceptually diverges from the previous user-based network access concepts (802.1x, VPN, WPA-Enterprise, ...) is in the fact that the old model put a user into a network segment assigned to their role (accounting, IT, ...) - macro-segmentation. What this network segment can access afterwards is implemented somewhere else and on a per-group basis. With ZTNA, on the other hand, users are not segmented per-group, rather per-user. Once authenticated, a user can access specific services separately from the other users (micro-segmentation w/ overlay tunnels).

That being said, ZTNA is concept which is well over a decade old but which only recently got popular with major vendors, each fitting their solutions under the ZTNA umbrella (no pun intended). The ZTNA concept does not require DPI firewall or TLS decrypting (MitM) proxy. You can and you should ask your favorite vendors whether their ZTNA service allows you to run w/o DPI and TLS decryption.

Answer 4

Don't forget about all your IOT/OT devices that cannot accept a vendor ZTNA client when working on this framework. There are ways to create micro-segmentation of the LAN in a campus environment to limit device-to-device communication and protect against the L2 adjacency issue. Airgap Networks turns L2 networks into L3 networks by using /32 concept.