What is Zero Trust Access?

[maucblancha]

Overview 

This session covered Zero Trust Access (ZTA), one of four products in ServiceNow Vault, alongside Data Privacy, Platform Encryption, and Log Export Service. Topics included why customers are moving away from IP-based restrictions, how ZTA applies least-privilege access to privileged users, and how to configure it. A live demo showed how a user’s access changes depending on whether she is on a trusted network.

Zero Trust Access

ZTA is a capability designed to enforce least-privilege access while keeping workflows seamless. It starts from implicit distrust of the context rather than the person. The user, device, network, and location are all treated as unverified until proven otherwise. Access is granted at the start of a session with minimum permissions, and verification continues throughout the session instead of happening once at login.

ZTA takes a balanced approach. Instead of all-or-nothing controls, it adjusts permissions based on session risk factors such as where a user is logging in from, what device they are using, and their geolocation.

ZTA supports two types of policies: 

1. Session-based access policies adjust access for the duration of a login based on risk factors such as IP address, device, identity provider attributes, or location.

2. Continuous authentication policies protect the most sensitive assets. A user who logs in is verified for a set period, but when they try to access a high-privilege asset, they must reverify through MFA or reauthentication before access is granted.

Key Takeaways

- Relaxing IP restrictions to support remote work creates risk, because privileged users can reach the instance from any device or network. ZTA treats the user, device, network, and location as unverified until proven otherwise.

- ZTA offers two policy types. Session-based policies adjust access for the length of a login based on risk signals such as IP, device, identity provider attributes, and geolocation. Continuous authentication policies require reverification before access to high-privilege data or records.

- ZTA adds a reduced-permissions outcome to adaptive authentication. Instead of allowing or denying a login, administrators can grant access with specific roles removed, which keeps users productive while limiting exposure.

- Common use cases include leave of absence, supplier networks, and the employee lifecycle, all managed on one platform instead of through separate instances.

Watch the Full Session

Want to dive deeper into the topics covered in this recap?

Watch the recording here.