Home » Zero Trust Network Architecture (ZTNA): Design และ Implementation
Zero Trust Network Architecture (ZTNA): Design และ Implementation
Zero Trust Network Architecture (ZTNA): Design และ Implementation
Zero Trust เป็น security framework ที่ยึดหลัก “never trust, always verify” ทุก request ต้องถูก authenticate และ authorize ก่อนได้รับ access ไม่ว่าจะมาจาก inside หรือ outside network ZTNA แทนที่ perimeter-based security ด้วย identity-based, context-aware access control ที่ทำงานทุก layer
Traditional network security ใช้ “castle-and-moat” model — trust ทุกอย่างข้างใน firewall ซึ่งไม่เพียงพอเมื่อมี remote workers, cloud workloads และ BYOD Zero Trust ถือว่าทุกอย่าง compromised ได้ ทุก request ต้อง verify ทุกครั้ง ลด blast radius เมื่อเกิด breach
Zero Trust Principles
| Principle |
ความหมาย |
| Verify Explicitly |
Authenticate + authorize ทุก request ด้วย all available data (identity, location, device, etc.) |
| Least Privilege Access |
ให้ minimum access ที่จำเป็นเท่านั้น (JIT/JEA) |
| Assume Breach |
ออกแบบเหมือนถูก breach แล้ว → minimize blast radius, segment access, verify end-to-end |
Traditional vs Zero Trust
| Feature |
Traditional (Perimeter) |
Zero Trust |
| Trust Model |
Trust inside, distrust outside |
Trust no one, verify everything |
| Network Access |
VPN → full network access |
Per-application access (micro-tunnel) |
| Segmentation |
Flat internal network |
Micro-segmentation per workload |
| Authentication |
Once at perimeter (VPN login) |
Continuous verification every request |
| Visibility |
North-south only (firewall) |
East-west + north-south (all traffic) |
| Remote Access |
VPN (full tunnel) |
ZTNA (per-app, identity-based) |
Zero Trust Architecture Components
| Component |
Function |
| Identity Provider (IdP) |
Authenticate users (Azure AD, Okta, Google) |
| MFA |
Multi-factor authentication ทุก access |
| Device Trust |
Verify device health (MDM, EDR, compliance) |
| Policy Engine |
Evaluate access policies (identity + device + context → allow/deny) |
| ZTNA Gateway |
Broker connections (per-app, not per-network) |
| Micro-segmentation |
Isolate workloads (east-west control) |
| SIEM/XDR |
Monitor, detect anomalies, continuous evaluation |
| Data Protection |
Encrypt data at rest + in transit + DLP |
Zero Trust Pillars (NIST SP 800-207)
| Pillar |
ครอบคลุม |
| Identity |
Users, service accounts, API keys → MFA, SSO, conditional access |
| Devices |
Endpoints, IoT, servers → MDM, EDR, device compliance |
| Network |
Segments, micro-perimeters → micro-segmentation, encrypted transport |
| Applications |
SaaS, on-prem apps → ZTNA, CASB, per-app access |
| Data |
Files, databases → classification, encryption, DLP |
| Visibility & Analytics |
Logs, telemetry → SIEM, XDR, UEBA, continuous monitoring |
ZTNA vs VPN
| Feature |
VPN |
ZTNA |
| Access Scope |
Full network access |
Per-application access only |
| Trust Model |
Trust after VPN login |
Continuous verification |
| Lateral Movement |
Possible (full network) |
Prevented (app-level isolation) |
| User Experience |
Slow (full tunnel), split-tunnel issues |
Fast (direct to app), transparent |
| Scalability |
VPN concentrator bottleneck |
Cloud-native, globally distributed |
| Device Posture |
Usually not checked |
Checked every connection |
ZTNA Vendors
| Vendor |
Product |
จุดเด่น |
| Zscaler |
ZPA (Private Access) |
Cloud-native ZTNA leader, global edge |
| Cloudflare |
Access / WARP |
Fast network, easy setup, free tier |
| Palo Alto |
Prisma Access |
SASE + ZTNA, strong security |
| Microsoft |
Entra Private Access |
Azure AD integration, Microsoft ecosystem |
| Cisco |
Duo + Secure Access |
MFA + ZTNA, enterprise |
| Tailscale |
Tailscale |
WireGuard-based mesh, developer-friendly |
Implementation Roadmap
| Phase |
Action |
| 1. Identity Foundation |
SSO + MFA ทุก application (Azure AD/Okta) |
| 2. Device Trust |
MDM + EDR + device compliance checks |
| 3. ZTNA for Remote |
Replace VPN with ZTNA (per-app access) |
| 4. Micro-segmentation |
Segment internal workloads (east-west control) |
| 5. Data Protection |
Classify data + encrypt + DLP policies |
| 6. Continuous Monitoring |
SIEM/XDR + UEBA + automated response |
| 7. Iterate |
Expand coverage + tune policies + reduce trust zones |
ทิ้งท้าย: Zero Trust = Never Trust, Always Verify
Zero Trust = verify every request, least privilege, assume breach ZTNA แทน VPN: per-app access, continuous auth, no lateral movement 5 Pillars: Identity + Device + Network + App + Data เริ่มจาก MFA/SSO → device trust → ZTNA → micro-segmentation Cloudflare, Zscaler, Palo Alto = leading ZTNA vendors
อ่านเพิ่มเติมเกี่ยวกับ Network Security Zones และ SSL TLS Best Practices ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
