<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-zero-trust-network-access
description: >-
  Design and implement Zero Trust Network Access (ZTNA) replacing VPN with identity-aware, least-privilege network access controls.
domain: cybersecurity
subdomain: network-security
tags:
  - ztna
  - zero-trust
  - network-access
  - microsegmentation
  - identity-aware-proxy
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  nist-csf: ["PR.AC-3", "PR.AC-4", "PR.AC-5"]
  frameworks: ["NIST SP 800-207", "CISA Zero Trust Maturity Model"]
---

# Implementing Zero Trust Network Access

## Overview

ZTNA replaces implicit trust (VPN "once in, trust everything") with continuous verification: every access request is authenticated, authorized against policy, and restricted to only the resources needed. Network location is never sufficient for trust.

Mode: `[MODE: ARCHITECT]` — Design before implementation. Pilot before full rollout.

## ZTNA vs VPN Comparison

| Dimension | Traditional VPN | ZTNA |
|---|---|---|
| Trust model | Network-level — trust after auth | Identity + device + context per-request |
| Access scope | Full network segment | Specific application or resource |
| Lateral movement risk | High — broad access once inside | Low — application-level segmentation |
| Device health | Optional, post-connect | Enforced pre-connect |
| Visibility | Limited per-session | Per-request, full audit trail |
| User experience | Client required, latency | Direct-to-app, lower latency |

## ZTNA Pillars

| Pillar | What It Means | Controls |
|---|---|---|
| Identity verification | Every user authenticated per request | MFA, IdP integration, risk-based auth |
| Device posture | Device health checked before access | MDM enrollment, EDR presence, patch level |
| Least privilege | Minimum access needed, no more | Per-app policies, time-limited access |
| Continuous validation | Trust re-evaluated during session | Session risk scoring, step-up auth |
| Microsegmentation | Applications isolated from each other | Service mesh, software-defined perimeter |
| Encryption everywhere | All traffic encrypted in transit | TLS 1.3, mTLS between services |

## Implementation Phases

| Phase | Duration | Deliverables | Success Criteria |
|---|---|---|---|
| Discovery | 4 weeks | Application inventory, access map, identity gaps | All apps cataloged, owners identified |
| Pilot | 6 weeks | ZTNA broker deployed, 1 app migrated, 50 users | Pilot users report no productivity loss |
| Expansion | 12 weeks | All high-risk apps migrated, VPN scope reduced | 80% of remote access via ZTNA |
| Full adoption | 6 months | VPN decommissioned or emergency-only, all apps | Zero VPN for normal operations |
| Optimization | Ongoing | Access policies tuned, device posture refined | Access denied rate <5% false positive |

## Access Policy Template

```yaml
policy:
  name: Engineering-GitHub-Access
  resources:
    - app: github.company.internal
      ports: [443]
  conditions:
    identity:
      groups: [engineering, contractors-engineering]
      mfa_required: true
    device:
      mdm_enrolled: true
      edr_active: true
      os_patch_days: 30
    context:
      risk_score_max: 60
      allowed_countries: [US, UK, CA, DE]
  action: allow
  session:
    max_duration_hours: 8
    re_verify_interval_hours: 2
```

## Verification

- [ ] All applications inventoried with owner and sensitivity classification
- [ ] IdP integrated with ZTNA broker — no local auth bypasses
- [ ] Device posture checks enforced before any access grant
- [ ] Lateral movement between apps blocked at policy level
- [ ] Access logs flowing to SIEM with per-request detail
- [ ] VPN scope documented and reduction targets set

## Related Techniques

- [Detecting Lateral Movement in Networks](../detecting-lateral-movement-in-networks/SKILL.md)
- [Implementing Network Microsegmentation](../configuring-network-segmentation/SKILL.md)
