The Terminlogy page reinforces the issue that all technology is a linguistic phenomenon. So let’s dissect/decompose the last one: Gartner’s definition of ZTNA word for word and see if we can make some sense of it. The only defined context for me is the MEF’s 118 Zero Trust Framework and Service Attributes (November 2022).

Gartner’s words: “Zero trust network access (ZTNA) is a product or service that creates an identity- and context-based, logical access boundary around an application or set of applications. Cybyr.com comment: I have no idea what this “identity- and context-based, logical access boundary” marketing mumbo jumbo means but let’s assume it refers to authenticated and identified subject actors desiring access to target actors based on a policy and access control – and no others can access that target.

“The applications are hidden from discovery, and access is restricted via a trust broker (“broker” is undefined but in MEF terms this likely refers to Policy Management) to a set of named entities. The broker verifies the identity, context and policy adherence of the specified participants (in MEF terms this could mean subject and target actors) before allowing access and prohibits lateral movement elsewhere in the network. (I assume this means the access control is specific only to the designated target actor in their current location) This removes application assets from public visibility and significantly reduces the surface area for attack.” (I assume again that it means the only access to the asset is via the brokerage or Policy Management service.) The three elements that are missing from the definition are (1) time when access is permitted (2) ongoing automated monitoring and event notification and (3) likely separation of policy management and policy enforcement. There is no mention of block lists or allow lists. Again, Least Privilege and NIST defined Access control types are not mentioned but we’ll let those pass.

The question remains however: “What has this to with Zero Trust or Network Access?” The answer is that ican nable the Zero Trust principle of preventing data exfiltration but does not mention that. Secondly, It does not mention Network Access. What it does do is address the issue of accessing network connected Cloud based software and data by unauthorized actors. So it’s the language of the term ZTNA itself that is misleading to me. Like everyone else, my understanding is based on what I have learned and which will likely be differnet from you the reader. maybe the time was right to have Zero Trust in a term and there was no element that showed how the other elements were glued together.

I hope this analysis was useful and gives an ideas of the issues faced when an attempt is made to implement a well-meaning marketing idea without a carefully thought through standard. As we said earlier, SASE was a very nice idea and it caught on. It’s a great example of how a competitive market was generated at speed that standards bodies cannot do while maintaining the integrity of their work. – Mark Fishburn, February 2023.