Blog Details

Many businesses still connect remote staff with a VPN. It works, but it’s a broad way of giving access. Zero Trust Network Access (ZTNA) takes a narrower approach. Here’s how the two differ, and how to decide.

The problem with broad access

A traditional remote access VPN puts the user’s device on your network. If that device or password is compromised, an attacker may be able to reach far more than that person needed for their job. This is why stolen VPN credentials are so valuable to attackers.

How ZTNA is different

• Access to applications, not the network: users connect only to the apps they need.
• Hidden applications: Sophos says ZTNA makes your applications invisible to the outside world.
• Identity checked every time: Sophos ZTNA requires multi-factor authentication to verify identity.
• Device health counts: access policy can take device posture into account, so a compromised device can be blocked from connecting.

How Sophos ZTNA is delivered

Sophos ZTNA is part of Sophos Workspace Protection, a subscription based on your number of users. That bundle also includes Sophos Protected Browser, DNS Protection for endpoints and the Email Monitoring System. Sophos says a ZTNA gateway is built into every Sophos Firewall, and Workspace Protection is included in the Xstream Plus firewall bundle, with user numbers depending on the model.

Should you replace your VPN?

Sophos positions ZTNA as a replacement for remote access VPN. That’s different from site-to-site VPNs that link offices together, which ZTNA doesn’t aim to replace. A sensible way to move is in stages:

1. List your apps: write down what remote staff actually use.
2. Map who needs what: most people need far less than the VPN gives them.
3. Start small: move one team or one application first, and test it.
4. Close the old route: once users have moved, remove their VPN access. Leaving it open keeps the old risk in place.