As we get closer to launching the Early Access Program (EAP) for Sophos ZTNA, expected in the next couple of weeks, we wanted to answer a lot of your questions about our solution and what to expect.  You can also register for the Early Access Program today to stay informed and be the first to know when the EAP starts.

 

Early Access Program Registration

The Early Access Program is expected to start early next month.  You and your customers can register for the EAP Today at sophos.com/ztna!  We will let you know as soon as the program launches.

 

Watch the ZTNA Webcast Recording

If you missed our recent Sophskills session last week that provided an overview of the ZTNA EAP program and what to expect, including a demo of an early build, you can view the recording here.

 

Frequently Asked Questions about Sophos ZTNA

What is ZTNA all about?

Please review this previous article for a great overview of Zero Trust Network Access.

 

What are the Benefits of ZTNA (compared to remote access VPN)?

While remote access VPN continues to serve us well, ZTNA offers a number of added benefits that make it a more attractive solution for connecting users to important applications and data:

• More Granular Control: ZTNA allows more granular control over who can access applications and data minimizing lateral movement and improving segmentation.  VPN is all-or-nothing: once on the network, VPN generally offers access to everything.
• Better Security: ZTNA removes implicit trust and incorporates device status and health in access policies that further enhances security.  VPN does not consider device status which can put application data at risk to a compromised or non-compliant device.
• Easier to Enroll Staff: ZTNA is much easier to roll-out and enroll new employees, especially if they are working remotely.  VPN is more challenging and difficult setup and deploy.
• Transparent to Users: ZTNA offers “just works” transparency to users with frictionless connection management.  VPN can be difficult and prone to initiating support calls.

 

What does Sophos ZTNA Include?

Sophos ZTNA is a brand new cloud-delivered, cloud-managed product to easily and transparently secure important networked applications with granular controls.  It’s scheduled to enter early access next month.

Sophos ZNTA consists of three components:

• Sophos Central – provides the ultimate cloud management and reporting solution for all Sophos products including Sophos ZTNA. Sophos ZTNA is a fully cloud enabled with Sophos Central providing easy deployment, granular policy management, and insightful reporting from the cloud.
• Sophos ZTNA Gateway – will come as a virtual appliance for a variety of platforms to secure networked applications on-premise or in the public cloud with AWS and VMware ESXi support initially closely followed by Azure, Hyper-V, Nutanix, and others.
• Sophos ZTNA Client – provides transparent and frictionless connectivity to controlled applications for end-users based on identity and device health. It will integrate with Synchronized Security for Heartbeat and device health. It is super easy to deploy from Sophos Central, with an option to easily deploy alongside Intercept X with just one click, or it can work stand-alone with any desktop AV client (obtaining health status from Windows Security Center). It will initially support Windows, followed by macOS and later Linux and mobile device platforms as well.

 

When will Sophos ZTNA be available?

The first phase of the Early Access Program (EAP) is targeted for early March.  Launch is expected to be around mid-year 2021. You can register now for the EAP.

 

What types of applications are ideal for ZTNA?

Sophos ZTNA can provide secure connectivity for any networked application hosted on the company’s on-premise network, or in the public cloud or any other hosting site.  Everything from RDP access to network file shares to applications like Jira, Wiki’s, source code repositories, support and ticketing apps, etc.

ZTNA does not control access to SaaS applications like SalesForce.com or Office365 which are public internet facing applications servicing many customers by design.  Secure access to these applications is provided by the SaaS vendor and the application and is often further enhanced through multi-factor authentication.

 

What client, gateway and identity platforms will be supported?

• Clients: Client platforms will initially include a clientless option across all client platforms (EAP1), Native Windows support (EAP2 and GA), macOS support (early 2022) and then Linux and mobile device platforms (iOS and Android) in the future. Device health will initially be assessed via Synchronized Security Heartbeat status (EAP2 and GA), followed by Windows Security Center (early 2022), with additional device assessments to be integrated in the future.
• Gateways: Gateway platforms will be virtual appliances only (no hardware) and initially include VMware ESXi for EAP1 then AWS public cloud for EAP2 and GA. This will be expanded to include other platforms like Azure, Hyper-V, Nutanix, K8S, and GCP following launch.
• Identity Providers: For identity, Sophos ZTNA will initially support Azure Active Directory (AD) for EAP 1 and Okta in EAP2. Supported directory services for EAP 2 and GA include Azure and on-premise AD (including AD Sync supported by Sophos Central today). Customers can take advantage of Azure’s MFA options right away with support for third-party MFA solutions coming in a future release.

 

Is ZTNA a stand-alone product or does it require another Sophos product?

Sophos ZTNA is a stand-alone product and does not require any other Sophos Products.  It is managed by Sophos Central which is free, and obviously offers a ton of benefits when customers have other Sophos products.  It can easily deploy alongside Intercept X, but Intercept X is not a requirement.  Sophos ZTNA can work alongside any vendor’s desktop AV or firewall.

 

How will Sophos ZTNA client deployment work?

Sophos ZTNA will be an easy to deploy option alongside Intercept X and device encryption when protecting devices from Sophos Central. As shown below…

 

Will ZTNA integrate with Sophos XG Firewall and Intercept X?

Sophos ZTNA is fully compatible with XG Firewall and Sophos Intercept X. In fact, it takes advantage of Security Heartbeat to assess device health which can be used in ZTNA policies.  As mentioned above, deployment of the ZTNA client can easily happen as part of an Intercept X roll-out – it’s as simple as checking a box.  Of course Sophos ZTNA can also work perfectly with other vendor desktop AV or firewall products, but it will work better together with other Sophos products such as XG Firewall and Intercept X.

 

How will licensing and pricing work?

Sophos ZTNA will be licensed on a user basis like our Endpoint products.  And it is not per user-device, just per user, so if a user has 3 devices, they only require one license.

Customers can deploy as many ZTNA gateways as they need to protect all their apps.  There is no charge for the gateway or for Central Management.

 

How does ZTNA compare to…

DUO?

DUO is an identity technology provider focused on multi-factor authentication (MFA) to help users verify their identity.  Identity and MFA and thus DUO, are a part of a ZTNA solution.  ZTNA also verifies device health.  Sophos ZTNA will initially support Azure MFA and any identity provider that integrates with Azure including Duo and other MFA solutions as well.

NAC?

NAC and ZTNA technologies may sound similar as they are both about providing access, but that’s where the similarities end.  Network Access Control (NAC) is concerned about controlling physical access to a local on-premise network.  ZTNA is concerned about controlling access to data and specific network applications regardless of what network they are on.

VPN?

While remote-access VPN has served us well, ZTNA has a number of benefits when compared to VPN as outlined above.  Of course there will be some situations where VPN continues to be a good solution… where a relatively small number of people (e.g. the IT department) need broad access to network applications and services to manage them.  And of course, VPN will still be instrumental for site-to-site connectivity.  But for most organization’s  users, ZTNA can replace remote-access VPN to provide a better, more granular security solution while being more transparent and easier for users.

Firewalls?

ZTNA is complimentary to a Firewall just like VPN is complimentary to a Firewall.  Of course, the Firewall still plays a critically important role in protecting corporate network and data center assets from attacks, threats and unauthorized access.  ZTNA bolsters a Firewall by adding granular controls and security for networked applications in the cloud or on-premise.

WAF?

WAF and ZTNA are designed to protect different types of applications from different types of users.  WAF is designed to protect and secure public applications by providing firewall, threat detection and other hardening like SQL injection attack defences.  ZTNA is designed to control access to internal applications – it is not designed to provide public access – in fact it is designed to ensure public users cannot access ZTNA protected apps.

Synchronized Security?

ZTNA and Synchronized Security are both conceptually similar in that they both can use device health to determine network access privileges.  In fact, Sophos ZTNA will use Security Heartbeat as a key component in assessing device health.  If a user has a device with a Red Heartbeat, their application access can be limited through policy, just as their network access can be limited on the firewall. However, ZTNA goes further than Synchronized Security by also integrating user identity verification.  ZTNA is also more about controlling privilege and access to applications while Synchronized Security is more about automated response to threats and preventing threats from moving or stealing data.

SASE?

SASE (pronounced “sassy”) or Secure Access Service Edge, is about the cloud delivery of networking and security and includes many components such as Firewalls, SD-WAN, Secure Web Gateways, CASB, and ZTNA designed to secure any user, on any network, anywhere through the cloud.  So as you can see, ZTNA is a component of SASE and will be an essential part of our overall SASE strategy.