Does a VPN contradict zero trust?

A classic VPN does in one way: once connected, the user's device is usually inside the network with wide access, which is the trusted-because-inside model that zero trust moves away from. That does not mean the VPN must go tomorrow. You can bring it much closer to zero trust: require multi-factor authentication, give each group access only to the systems it needs, check that the device is a managed, updated company laptop before it connects, and log every session. Zero-trust network access (ZTNA) products take the next step and connect a user to one application at a time instead of to the network. Either way, assume that a VPN session can be abused and watch what it does. With a sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port behind the VPN gateway, NetSenX flags scanning, lateral movement and beaconing from VPN users' devices, on every plan.

← All 45 questions on Zero trust, identity and segmentationAll topics