Loading...
Publication
IMPLEMENTATION AND ANALYSI OF A ZTNA SOLUTION
| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 3.98 MB | Adobe PDF |
Abstract(s)
À medida que as ameaças cibernéticas continuam a evoluir, os mecanismos tradicionais
de segurança baseados em perímetro, como VPNs IPsec e SSL, tornam-se
cada vez mais ineficazes contra ataques baseados em identidade e movimentos
laterais em ambientes distribuídos. Ao conceder um acesso amplo ao nível da rede
após a autenticação, as VPNs ampliam a superfície de ataque e falham em aplicar
o princípio de Zero Trust — “nunca confiar, verificar sempre”. Para colmatar esta
lacuna, esta dissertação investiga a viabilidade de implementar uma solução de Zero
Trust Network Access (ZTNA) em contexto de pequena e média empresa (PME),
utilizando o OpenZiti, uma plataforma open-source.
A investigação combina uma revisão da literatura com uma análise comparativa de
soluções ZTNA/SASE, posicionando o OpenZiti face a alternativas de mercado. Foi
então concebida e implementada uma arquitetura prática num ambiente semelhante
a uma PME, com dois sites interligados e um controlador em Azure, simulando
uma topologia híbrida. A implementação incluiu o provisionamento de controlador
e edge routers, integração Okta–Active Directory e definições granulares de serviços
através de configurações de intercept, host e políticas de acesso.
Para além de reproduzir modelos existentes, o trabalho fornece uma avaliação
prática e original das capacidades e limitações do OpenZiti, contribuindo para o
estado da arte ao evidenciar lacunas nas soluções open-source de ZTNA.
Os resultados demonstram que o OpenZiti impõe acesso rigoroso ao nível do
serviço, reduzindo significativamente as oportunidades de movimento lateral em
comparação com as VPNs. A revogação de identidades e a propagação de políticas
ocorreram em tempo quase real, e a descoberta não autorizada de serviços foi
impedida. Foram identificadas limitações ao nível da segmentação leste–oeste, do
suporte a federação de identidades e da integração nativa de registos, que requerem
controlos complementares ou ferramentas externas. Ainda assim, o estudo confirma
que soluções open-source de ZTNA podem fornecer às PMEs uma alternativa
economicamente viável e tecnicamente robusta às VPNs, proporcionando melhorias
mensuráveis na postura de segurança e apoiando a transição de modelos baseados
em perímetro para Zero Trust em organizações com recursos limitados.
As cyber threats continue to evolve, traditional perimeter-based security mechanisms, such as IPsec and SSL VPNs, are increasingly ineffective against identity-based and lateral movement attacks in distributed environments. By granting broad, network-level access once authenticated, VPNs expand the attack surface and fail to enforce the Zero Trust principle of “never trust, always verify.” To address this gap, this thesis investigates the feasibility of deploying a Zero Trust Network Access (ZTNA) solution in a small-to-medium enterprise (SME) context using OpenZiti, an open-source platform. The research combines a literature review with a comparative analysis of ZTNA/SASE solutions, positioning OpenZiti against market alternatives. A practical architecture was then designed and implemented in an SME-like environment, consisting of two interconnected sites and an Azure-based controller, simulating a hybrid environment. Beyond reproducing existing models, the work provides an original, hands-on evaluation of OpenZiti’s capabilities and limitations. It contributes to the state of the art by highlighting gaps in open-source ZTNA solutions. The implementation was validated using a structured test suite covering authentication enforcement, encrypted communication, identity revocation, and service visibility. The results demonstrate that OpenZiti enforces fine-grained, service-level access while significantly reducing lateral movement opportunities compared to VPNs. Identity revocation and policy updates propagated in near real time, and unauthorised service discovery was prevented. Limitations were identified in areas such as east–west segmentation, federated identity support, and native logging integration, which require complementary controls or third-party tools. Nevertheless, the study confirms that open-source ZTNA solutions can provide SMEs with a cost-effective and technically viable alternative to VPNs, delivering measurable improvements in security posture and supporting the broader transition from perimeter-based security to Zero Trust in resource-constrained organisations.
As cyber threats continue to evolve, traditional perimeter-based security mechanisms, such as IPsec and SSL VPNs, are increasingly ineffective against identity-based and lateral movement attacks in distributed environments. By granting broad, network-level access once authenticated, VPNs expand the attack surface and fail to enforce the Zero Trust principle of “never trust, always verify.” To address this gap, this thesis investigates the feasibility of deploying a Zero Trust Network Access (ZTNA) solution in a small-to-medium enterprise (SME) context using OpenZiti, an open-source platform. The research combines a literature review with a comparative analysis of ZTNA/SASE solutions, positioning OpenZiti against market alternatives. A practical architecture was then designed and implemented in an SME-like environment, consisting of two interconnected sites and an Azure-based controller, simulating a hybrid environment. Beyond reproducing existing models, the work provides an original, hands-on evaluation of OpenZiti’s capabilities and limitations. It contributes to the state of the art by highlighting gaps in open-source ZTNA solutions. The implementation was validated using a structured test suite covering authentication enforcement, encrypted communication, identity revocation, and service visibility. The results demonstrate that OpenZiti enforces fine-grained, service-level access while significantly reducing lateral movement opportunities compared to VPNs. Identity revocation and policy updates propagated in near real time, and unauthorised service discovery was prevented. Limitations were identified in areas such as east–west segmentation, federated identity support, and native logging integration, which require complementary controls or third-party tools. Nevertheless, the study confirms that open-source ZTNA solutions can provide SMEs with a cost-effective and technically viable alternative to VPNs, delivering measurable improvements in security posture and supporting the broader transition from perimeter-based security to Zero Trust in resource-constrained organisations.
Description
Keywords
Informática Forense Cibersegurança Ztna Solution Trust Network Access (ZTNA) Pequena e média empresa (PME) OpenZiti Plataforma open-source