Unit 10: Edge devices and remote access · Lesson 5 of 5 · 16 min

Flat VPN or per-app access

Measure how much of the network the VPN hands to every user and compare it with per-application access.

mission

You are
The architect proposing a replacement for the staff VPN.
Situation
The VPN profile and a draft zero trust access policy are in ~/edge.
Goal
Show how much a stolen VPN login exposes today and what the alternative exposes.
Hand in
Two numbers and a recommendation.

Network access versus app access

  1. Per-app access (ZTNA)each user reaches named apps on named ports, checked per request
  2. Segmented VPNgroups get routes to some subnets
  3. Flat VPNevery user gets the whole internal network
01

Read the VPN profile

The route a VPN pushes is the network a stolen login can reach.

analyst@net-lab
cat vpn-profile.txt
profile: all-staff
users: 412
routes pushed to clients: 10.0.0.0/8
allowed after connect: any internal address, any port
ipcalc -nb 10.0.0.0/8 | grep Hosts
Hosts/Net: 16777214              Class A, Private Internet

you should see 412 users, each able to reach any of 16777214 addresses on any port.

02

Read the per-app policy

Zero trust access lists applications, not networks.

analyst@net-lab
cat ztna-policy.txt
app            address              port  who
intranet       10.20.0.40           443   all staff
mail           10.20.0.25           443   all staff
hr-portal      10.20.0.70           443   hr group
ssh-bastion    10.20.0.9            22    it admins

you should see Four applications, each limited to one port and one group.

defender tip Migrate in stages: publish the busiest apps through the access broker first, then shrink the VPN routes until the VPN can be retired.

What a stolen login reaches

Flat VPN
routes: 10.0.0.0/8
ports:  any

Every server, every port.

Per-app
intranet 443, mail 443
plus hr-portal only for hr

Two web apps for most staff.

03

Count the published apps

Every app is a separate decision about who may reach it.

analyst@net-lab
tail -n +2 ztna-policy.txt | wc -l
4

you should see Four apps replace a route to the whole /8.

04

Count the apps open to everyone

Per-app access still needs care about who sees what.

analyst@net-lab
grep -c 'all staff' ztna-policy.txt
2

you should see Two apps are open to all staff; the others are limited to a group.

What a defender takes away

  1. 1A VPN login is a network login; scope it.
  2. 2Per-app access limits what a stolen account can touch.
  3. 3Whatever you choose, require MFA and device checks at sign-in.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.