Home » Zero Trust Architecture: ZTNA, Microsegmentation, Identity-Centric Security
Zero Trust Architecture: ZTNA, Microsegmentation, Identity-Centric Security
Zero Trust Architecture: ZTNA, Microsegmentation, Identity-Centric Security
Zero Trust Architecture เปลี่ยนแนวคิดจาก “trust but verify” เป็น “never trust, always verify” ZTNA (Zero Trust Network Access) แทนที่ VPN ด้วย identity-based access, Microsegmentation แบ่ง network เป็น segments เล็กๆ เพื่อจำกัด lateral movement และ Identity-Centric Security ใช้ identity เป็นหลักในการ authorize ทุก access request แทนที่จะ trust ตาม network location
Traditional security ใช้ perimeter model: trust everything inside, block everything outside แต่ model นี้ล้มเหลวเพราะ cloud (no perimeter), remote work (users outside), compromised credentials (attacker inside), lateral movement (once inside, move freely) Zero Trust แก้ทุกปัญหา: verify every request, least privilege, assume breach
Zero Trust Principles
| Principle |
รายละเอียด |
| Never Trust, Always Verify |
ทุก access request ต้อง authenticate + authorize ทุกครั้ง (ไม่ว่าจะมาจากไหน) |
| Least Privilege |
ให้สิทธิ์น้อยที่สุดที่จำเป็น (just-enough access, just-in-time access) |
| Assume Breach |
สมมติว่าถูก breach แล้ว → ออกแบบเพื่อจำกัด blast radius |
| Verify Explicitly |
Verify ด้วย multiple signals: identity, device health, location, behavior |
| Microsegmentation |
แบ่ง network เป็น segments เล็กๆ → จำกัด lateral movement |
| Continuous Monitoring |
Monitor ตลอดเวลา (ไม่ใช่แค่ตอน login) → detect anomalies real-time |
Zero Trust vs Traditional Security
| Feature |
Traditional (Perimeter) |
Zero Trust |
| Trust Model |
Trust inside, block outside |
Trust nothing, verify everything |
| Network Access |
VPN → full network access |
ZTNA → app-specific access only |
| Authentication |
Once at login (then trusted) |
Continuous (every request verified) |
| Lateral Movement |
Easy (flat network inside) |
Blocked (microsegmented) |
| User Location |
Important (inside = trusted) |
Irrelevant (verify regardless of location) |
| Device Trust |
Corporate device = trusted |
Device health checked every time |
ZTNA (Zero Trust Network Access)
| Feature |
รายละเอียด |
| คืออะไร |
Application-level access control (แทน VPN ที่ให้ network-level access) |
| How |
User authenticate → verify identity + device + context → grant access เฉพาะ app ที่อนุญาต |
| vs VPN |
VPN: connect → access entire network | ZTNA: connect → access only authorized apps |
| SDP (Software Defined Perimeter) |
Architecture ที่ ZTNA implement — apps invisible จนกว่าจะ authenticate |
| Agent-Based |
Install agent on device → device posture check + identity verification |
| Agentless |
Browser-based access → no agent required (web apps, SaaS) |
ZTNA Vendors
| Vendor |
Product |
จุดเด่น |
| Zscaler |
ZPA (Private Access) |
Cloud-native, largest ZTNA deployment, inside-out connectivity |
| Cloudflare |
Access |
Global edge network, easy setup, free tier available |
| Palo Alto |
Prisma Access (ZTNA 2.0) |
App-level access + continuous trust verification |
| Cisco |
Duo + Secure Access |
MFA + device trust + ZTNA integrated |
| Microsoft |
Entra Private Access |
Azure AD integrated, replace VPN for Microsoft ecosystem |
| Netskope |
Private Access |
SASE platform, inline security + ZTNA |
Microsegmentation
| Feature |
รายละเอียด |
| คืออะไร |
แบ่ง network เป็น segments ขนาดเล็ก → enforce policy ระหว่าง segments |
| Granularity |
Per-workload, per-application, per-process (ละเอียดกว่า VLAN/subnet) |
| Purpose |
จำกัด lateral movement: ถ้า 1 server ถูก compromise → ไม่แพร่ไปที่อื่น |
| Network-Based |
Firewall rules, VLAN ACLs, NSG (cloud) → traditional approach |
| Host-Based |
Agent on each workload → enforce policy at OS level → more granular |
| Identity-Based |
Policy based on workload identity (not IP) → works across cloud/on-prem |
Microsegmentation Vendors
| Vendor |
Product |
Approach |
| Illumio |
Core |
Host-based agent, workload visibility + policy enforcement |
| Guardicore (Akamai) |
Centra |
Host-based, process-level segmentation, deception |
| VMware |
NSX Distributed Firewall |
Hypervisor-level, per-VM policy (vSphere integrated) |
| Cisco |
Secure Workload (Tetration) |
Agent + flow analytics, auto policy recommendation |
| AWS |
Security Groups |
Cloud-native, per-instance firewall rules |
| Azure |
NSG + ASG |
Network Security Groups + Application Security Groups |
Identity-Centric Security
| Component |
Role |
| Identity Provider (IdP) |
Central identity store (Azure AD/Entra, Okta, Ping Identity) |
| MFA |
Multi-Factor Authentication (something you know + have + are) |
| SSO |
Single Sign-On (one login → access all authorized apps) |
| Conditional Access |
Dynamic policies (allow if: MFA passed + compliant device + low risk location) |
| PAM |
Privileged Access Management (control admin/root access, just-in-time) |
| Device Trust |
Verify device health (patched, encrypted, managed, no malware) |
| Risk-Based Auth |
Adjust auth requirements based on risk score (new location → extra MFA) |
Zero Trust Implementation Roadmap
| Phase |
Action |
| 1. Identity |
Deploy strong identity (MFA, SSO, conditional access) → foundation |
| 2. Device Trust |
Endpoint management (MDM/UEM), device compliance checks |
| 3. ZTNA |
Replace VPN with ZTNA (start with critical apps, expand) |
| 4. Microsegmentation |
Segment critical workloads (PCI, PII databases first) |
| 5. Data Protection |
Classify + encrypt + DLP (protect data at rest, in transit, in use) |
| 6. Monitoring |
SIEM + UEBA + continuous monitoring (detect anomalies) |
| 7. Automation |
SOAR + automated response (auto-block, auto-isolate on detection) |
ทิ้งท้าย: Zero Trust = Security for the Modern World
Zero Trust Architecture Principles: never trust, always verify, least privilege, assume breach, microsegment ZTNA: replace VPN with app-specific access (Zscaler ZPA, Cloudflare Access, Prisma) Microsegmentation: limit lateral movement (Illumio, Guardicore, NSX, cloud NSG) Identity-Centric: IdP + MFA + SSO + conditional access + device trust + PAM Roadmap: identity → device trust → ZTNA → microsegmentation → data → monitoring Key: Zero Trust is a journey, not a product — implement in phases
อ่านเพิ่มเติมเกี่ยวกับ DDoS Protection Mitigation Scrubbing และ PKI Certificates X.509 SSL TLS ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
