Zero Trust

Zero Trust Network Access (ZTNA) is an architectural approach for controlling how users and devices access applications over a network. 

For many years, organisations have relied on a perimeter-based model (also described as a ‘walled garden’ or ‘castle and moat’) to manage their network security. In this model, strong controls such as firewalls protect the boundary of the network. Users are authenticated at the perimeter, and once inside, are typically granted broad access to internal systems. The model implicitly trusts users based on network location.

This approach was effective when users, devices, and services were largely contained within a well-defined network boundary.

The risk environment in which organisations operate has changed significantly, which means network location alone is no longer a reliable basis for trust. For example:

• Attackers are increasingly capable of stealing credentials, compromising endpoints, and moving laterally within a network once they have established an initial foothold.
• Modern working practices – such as remote access, widespread use of Software as a Service (SaaS) and the adoption of cloud-hosted services – mean that applications, users, and devices are no longer confined to a single network perimeter.

The NCSC’s zero trust architecture design principles address this shift in the risk environment by removing implicit trust from users, devices, services, and networks.

ZTNA applies zero trust principles specifically to access. In a ZTNA approach:

• network connectivity alone never grants access to a service
• each access request is explicitly authorised, based on defined policy and contextual information

This guidance explains how the NCSC’s zero trust principles may be translated into ZTNA design requirements, and how those requirements can be used to design access architectures that better reflect the realities of modern threats and working practices. This is achieved when access patterns, segmentation, and policy enforcement are deliberately designed to align with zero trust principles.

A well-designed ZTNA architecture should:

• Ensure access is explicitly authorised, based on a set of signals.
• Reduce the overall attack surface by limiting application exposure.
• Restrict lateral movement so that compromise of one device or account cannot easily spread across the network.
• Limit the blast radius of a security incident.
• Enforce continual verification, not one-time access decisions.
• Apply consistent access control across private applications, SaaS and cloud services.

For further background on zero trust and common misconceptions, see the NCSC’s guidance on demystifying zero trust.

ZTNA architectures typically apply in 2 particular access scenarios:

• Private application access. This provides secure, brokered access to internally hosted applications (for example, on-premises or private cloud services) while minimising external connectivity.
• SaaS application access. This is an identity-centric access control for internet-hosted applications, typically enforced through single sign-on (SSO) and application-level policy enforcement.

The unifying principle for both scenarios is the same: access is explicitly authorised, narrowly scoped, continually enforced, and observable, regardless of where users, devices or applications are located.