Palo Alto Networks calls on cybersecurity industry to adopt ZTNA 2.0

First-gen ZTNA solutions have major gaps in security protection and can put organizations at significant risk.

  • 1 week ago Posted in

Palo Alto Networks has urged the industry to move to Zero Trust Network Access 2.0 (ZTNA 2.0) — the foundation for a new era of secure access. ZTNA was developed as a replacement for virtual private networks (VPNs) when it became clear that most VPNs did not adequately scale and were overly permissive, but the first-generation ZTNA products (ZTNA 1.0) are too trusting and can put customers at significant risk. ZTNA 2.0 solves these problems by removing implicit trust to help ensure organizations are properly secured.



“This is a critical time for cybersecurity. We are in an era of unprecedented cyberattacks, and the past two years have dramatically changed work — for many, work is now an activity, not a place. This means that securing employees and the applications they need is both harder and more important,” said Nir Zuk, founder and chief technology officer at Palo Alto Networks. “Zero trust has been embraced as the solution — and it is absolutely the right approach! Unfortunately, not every solution with Zero Trust in its name can be trusted. ZTNA 1.0 — for example — falls short.”



For modern organizations where hybrid work and distributed applications are the norm, ZTNA 1.0 has several limitations. It is overly permissive in granting access to applications because it can’t control access to sub-applications or particular functions. Additionally, there is no ability to monitor changes in user, application or device behavior, and it can’t detect or prevent malware or lateral movement across connections. ZTNA 1.0 also cannot protect all enterprise data.



ZTNA 2.0-capable products, such as Palo Alto Networks Prisma® Access, help organizations meet the security challenges of modern applications, threats and the hybrid workforce. ZTNA 2.0 incorporates the following key principles:


Least-privileged access — enables precise access control at the application and sub-application levels, independent of network constructs like IP addresses and port numbers.

Continuous trust verification — after access to an application is granted, continuous trust assessment is ongoing based on changes in device posture, user behavior and application behavior.

Continuous security inspection — uses deep and ongoing inspection of all application traffic, even for allowed connections to help prevent threats, including zero-day threats.

Protection of all data — provides consistent control of data across all applications, including private applications and SaaS applications, with a single data loss prevention (DLP) policy.

Security for all applications — consistently secures all types of applications used across the enterprise, including modern cloud native applications, legacy private applications and SaaS applications.


In a new report, John Grady, ESG senior analyst, said: “[F]irst-generation/ZTNA 1.0 solutions fall short in many ways on delivering on the promise of true zero trust. In fact, they grant more access than is desired. What’s more, once access is granted in ZTNA 1.0 solutions, the connection is implicitly trusted forever, allowing a handy exploit route for sophisticated threats and/or malicious actions and behavior.” Grady also said, “It is time to embrace a new approach to ZTNA, one that has been designed from the ground up to meet the specific challenges of modern applications, threats, and a hybrid workforce.“



“Securing today’s hybrid workforce, with an increase in cloud and mobile technologies and evolving requirements can be complicated,” said Jerry Chapman, Engineering Fellow, Optiv. “Rethinking Zero Trust is essential for modern, hybrid organizations to prevent threats. Together with Palo Alto Networks, we’re advising our customers to incorporate ZTNA 2.0 principles like continuous review of identity and connection across their domains to stay secure.”

New report from Tessian and the Ponemon Institute reveals that email has become the riskiest channel for data security in today’s organizations.
Energy professionals believe that cyber-attacks on the industry are likely to cause harm to life, property and the environment in the next two years. 84% expect physical damage to assets and 57% anticipate loss of life.
Veeam unveils the results of its 2022 Ransomware Trends Report at VeeamON 2022, finds that cyber criminals are successfully encrypting an average of 47% of production data and victims are only able to recover 69% of impacted data.
ThreatQ Platform and ThreatQ Investigations will be used by telecom conglomerate Comcast, parent of NBC Universal and SKY Group, to operationalise security intelligence across cybersecurity use cases.
Flexible options, funded directly by the specialist distributor, will help partners easily transition to the subscription economy and make tech more accessible and affordable.
Nuvias partners gain access to the entire Armis portfolio, addressing the considerable asset visibility market opportunity in Western Europe.
Data from more than 1,300 global respondents combined with expert analysis to reveal goals, benefits, and challenges of cloud-native technology in 2022.
Infoblox unveils a global report examining the state of security concerns, costs, and remedies.