SASE ZTNA Traffic Routing for Secure Private Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large employee workforces accessing cloud resources remotely strain network capacity and security, allowing compromised users/devices to move laterally through corporate networks, compromising security and network integrity.
Innovation Solution
Implementing a secure access service edge (SASE) with zero trust network access (ZTNA) to provide intelligent routing and authentication, authorization, and conditional access, ensuring consistent security posture for both remote and local users by routing traffic through a security service based on client location and resource type.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If employees access company resources remotely through VPN or direct Internet connection, then network capacity and security stamps are strained, but employees can still access resources
Solution Approach 1:
A SASE security service acts as an intermediary between remote employees and company resources. Instead of direct connections that strain network capacity, all traffic is routed through the SASE service which provides authentication, authorization, and security enforcement. This mediator approach maintains security while optimizing network performance by centralizing security functions and enabling intelligent traffic routing decisions.
2Ease of operation
If VPN connections are used for remote access, then employees can access resources, but compromised users/devices can move laterally through corporate networks
Solution Approach 1:
The system segments network access by implementing Zero Trust Network Access (ZTNA) that provides granular control over which specific resources individual users can access. Instead of providing broad network access through VPN, the SASE service with ZTNA breaks down access into discrete, controlled connections to specific applications or data sets. This segmentation prevents lateral movement because compromised credentials can only access their designated resources, not the entire network.
Solution Approach 2:
The system dynamically changes access parameters based on user identity, device state, location, and resource type. The SASE service continuously evaluates security conditions and adjusts access permissions in real-time. This parameter-based control replaces static VPN access with dynamic, context-aware authorization that adapts to changing security conditions, preventing unauthorized lateral movement while maintaining legitimate access.
3Adaptability or versatility
If different security postures are maintained for remote and local users, then specific security needs are met, but system complexity increases
Solution Approach 1:
The SASE service provides a universal security platform that handles both remote and local user access through a single integrated system. Instead of maintaining separate security infrastructures for different user types, the multi-functional SASE service consolidates authentication, authorization, threat protection, and traffic management into one platform. This universal approach reduces complexity while maintaining the ability to apply different security policies to different user contexts.
Data Source
AI summary
Methods, systems and computer program products are provided for intelligent secure access to private resources. A security service (e.g., SASE ZTNA) may maintain the same or similar security posture for users who work remotely and/or locally by providing authentication, authorization, and/or ongoing conditional access via a security service (e.g., private or public SASE) while intelligently routing remote client traffic to private resources through the security service and routing local client traffic to private resources locally. A traffic routing determination may be made by a security client and/or security server. A traffic routing determination may be based on the location of a client computing device, such as a trusted network detection for a private/trusted network. Traffic routing determinations may be based on conditions alternative or in addition to location, such as the type of private resource or information being accessed by a client computing device.