Home » Zero Trust Network: Identity-Based Access, Micro-Segmentation, SDP, SASE, ZTNA และ Implementation
Zero Trust Network: Identity-Based Access, Micro-Segmentation, SDP, SASE, ZTNA และ Implementation
Zero Trust Network: Identity-Based Access, Micro-Segmentation, SDP, SASE, ZTNA และ Implementation
Zero Trust Network เปลี่ยนแนวคิดจาก “trust but verify” เป็น “never trust, always verify” Identity-Based Access ใช้ identity เป็นหลักในการให้สิทธิ์, Micro-Segmentation แบ่ง network เป็นส่วนเล็กๆ, SDP (Software-Defined Perimeter) ซ่อน resources จนกว่าจะ authenticate, SASE รวม networking + security ใน cloud, ZTNA ให้ access เฉพาะ application ที่ได้รับอนุญาต และ Implementation วางแผนทีละขั้น
Traditional perimeter security ล้มเหลวเพราะ perimeter ไม่มีอีกต่อไป: users ทำงานจากทุกที่ (remote work), applications อยู่ใน cloud (SaaS, IaaS), IoT devices เข้ามาใน network, ผู้โจมตีที่เข้ามาได้แล้วเคลื่อนที่ได้อย่างอิสระ (lateral movement) Zero Trust: ไม่เชื่อใครโดยอัตโนมัติ ทุก request ต้อง verify — user + device + context + application → ลด attack surface 70%+ (Forrester)
Zero Trust Principles
| Principle |
Description |
Implementation |
| Never Trust, Always Verify |
No implicit trust based on network location |
Authenticate and authorize every access request |
| Least Privilege |
Give minimum access needed for the task |
RBAC, JIT access, remove standing privileges |
| Assume Breach |
Design as if attacker is already inside |
Micro-segmentation, monitoring, incident response ready |
| Verify Explicitly |
Use all available data points for decisions |
User identity + device health + location + behavior + risk score |
| Limit Blast Radius |
Contain damage if breach occurs |
Segmentation, session timeouts, encryption everywhere |
Zero Trust Architecture Components
| Component |
Function |
Examples |
| Identity Provider (IdP) |
Authenticate users — SSO, MFA, conditional access |
Azure AD/Entra ID, Okta, Ping Identity |
| Policy Engine |
Make access decisions based on context (who, what, where, when, how) |
Policy Decision Point (PDP) in NIST 800-207 |
| Policy Enforcement |
Enforce decisions — allow/deny/limit access |
ZTNA gateway, micro-segmentation firewall, proxy |
| Device Trust |
Verify device health — patched, compliant, managed, encrypted |
MDM/UEM: Intune, Jamf, SCCM, CrowdStrike Falcon |
| Micro-Segmentation |
Per-workload firewall — limit lateral movement |
Illumio, VMware NSX, Cisco ACI, Guardicore |
| Monitoring/Analytics |
Continuous monitoring — detect anomalies, log everything |
SIEM, UEBA, XDR — Splunk, Sentinel, CrowdStrike |
ZTNA (Zero Trust Network Access)
| Feature |
VPN (Traditional) |
ZTNA |
| Access Model |
Network-level: connect to VPN → access entire network |
Application-level: access only specific app (not network) |
| Visibility |
Resources visible to VPN users (can scan network) |
Dark cloud: resources invisible until authorized (SDP) |
| Authentication |
Once at VPN login → trusted for entire session |
Continuous: re-verify identity, device, context per request |
| Lateral Movement |
Easy: VPN user on network → move freely |
Prevented: access only to authorized application, nothing else |
| Performance |
Backhaul: all traffic through VPN concentrator (bottleneck) |
Direct: connect to nearest PoP/edge → direct to application |
| Vendors |
Cisco AnyConnect, Palo Alto GlobalProtect, FortiClient |
Zscaler ZPA, Cloudflare Access, Palo Alto Prisma, Netskope |
SASE (Secure Access Service Edge)
| Component |
Function |
| SD-WAN |
Optimized connectivity for branches — app-aware routing, direct internet breakout |
| ZTNA |
Application-level access for remote users and branches |
| SWG (Secure Web Gateway) |
Inspect web traffic — URL filtering, malware scanning, DLP |
| CASB (Cloud Access Security Broker) |
Control access to SaaS apps — visibility, compliance, threat protection |
| FWaaS (Firewall as a Service) |
Cloud-delivered firewall — inspect all traffic at PoP |
| DLP (Data Loss Prevention) |
Prevent sensitive data from leaving organization |
Implementation Roadmap
| Phase |
Actions |
Duration |
| 1. Identity Foundation |
Deploy MFA everywhere, SSO, conditional access, inventory all identities |
1-3 months |
| 2. Device Trust |
MDM/UEM enrollment, compliance policies, device health checks |
2-4 months |
| 3. Application Discovery |
Map all applications, data flows, dependencies, classify sensitivity |
1-2 months |
| 4. ZTNA for Remote |
Replace VPN with ZTNA for remote users — start with low-risk apps |
2-4 months |
| 5. Micro-Segmentation |
Segment critical workloads — start with crown jewels (database, finance) |
3-6 months |
| 6. Continuous Monitoring |
SIEM, UEBA, XDR — detect anomalies, automate response |
Ongoing |
ทิ้งท้าย: Zero Trust = Security for the Cloud-First, Remote-Work Era
Zero Trust Network Principles: never trust/always verify, least privilege, assume breach, verify explicitly, limit blast radius Components: IdP (identity), policy engine/enforcement, device trust (MDM), micro-segmentation, monitoring ZTNA vs VPN: app-level (not network), dark cloud (invisible), continuous auth, no lateral movement, better performance SASE: SD-WAN + ZTNA + SWG + CASB + FWaaS + DLP — converged cloud-delivered security Implementation: identity first (MFA/SSO) → device trust → app discovery → ZTNA → micro-segmentation → monitoring Key: Zero Trust reduces attack surface 70%+ — not a product but a journey, implement iteratively starting with identity
อ่านเพิ่มเติมเกี่ยวกับ Network Security Architecture Defense in Depth Segmentation DMZ และ Firewall Deep Dive Stateful NGFW WAF IPS ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
