Organizations today are challenged by increased network architecture complexity,phishing, ransomware and sophisticated credential theft that includes the ability tobypass traditional forms of MFA.
Companies support complex network architectures with on-premises, cloud and hybrid
segments and applications. Securing these with a high degree of certainty and low risk isa persistent challenge for network, operations and security teams. In addition, credential
phishing and legacy MFA attacks continue to increase in volume and impact.
How can users securely and easily access applications and dispersed network services?

How to Solve
Extend the reach of your zero trust
program with a focus on securely andcontinuously authenticating users anddevices while protecting networks anddelivering workload access.

The solution requires three key
components: zero trust network
access (ZTNA) to secure networks
and applications, unphishable secureauthentication, and the evaluation of thedevice security control settings upon initialaccess and on a continuous basis.

Required capabilities for unphishable
MFA and ZNTA•••
Figure 1: NIST SP 800-207: Zero Trust Architecture

Protect applications and networks withalways-on threat protection based onidentity and context.
Authenticate securely who andwhat are requesting access to yourapplications.
Evaluate regularly if the connecting
device meets your organization’s
security posture requirements.

Partner Brief

Zscaler & Beyond Identity
Integration Solution Brief

Solution

This synergy achieves a high degree ofcertainty on who and what are accessing
your network and applications and if they areauthorized to do so.

The combination of the Zscaler Zero Trust
Exchange that provides secure access toapplications plus Beyond Identity’s Secure
Workforce to validate users and devicesdelivers these needed capabilities.

Features

Zscaler, the industry leader in ZTNA, allows
direct and secure connections to applications
based on the principle of least-privileged
access, which means that no user orapplication is inherently trusted. Connections
are authorized based on validation of theuser’s identity, risk-based context, andbusiness policy.
Beyond Identity provides the user and device
validation required for phishing-resistant,zero trust authentication and identity-centriczero trust.

Identity
Centric Zero
TrustApplication
Centric Zero
Trust

Figure 2: Intersection of Application and Identity centriczero trust initiatives

Reference Architecture

Increase security with passwordlessauthentication for Zscaler Internet Access(ZIA) and Zscaler Private Access (ZPA).
Minimize risk by eliminating passwords, themost exploited threat vector.
Validate device security controls for allconnected devices. Prior to authentication,
confirm the device meets your organization’s
security requirements. If not, deny access via
policy directives.
Assess on a continuous basis that connected
devices remain aligned with security
prerequisites. For example, confirm disk
encryption or Endpoint Detection & Response(EDR) has not been disabled and remains
active during the connected session.
Minimize risk by disabling access when therisk of the identity or endpoint falls out ofcompliance with policy. Beyond Identity
continuously checks device security settings.
If a setting is found to fail policy, it signals
Zscaler to log the user out and the user must
re-authenticate. Access will not be granted
until the device posture comes in line withpolicy.
Figure 3: Zscaler + Beyond Identity Integration architecture

SSOAPISignal the posture
has changed

SSO-protected web apps

Beyond Identity
Authenticator

ZTX CloudDisconnect user/session and force
re-authentication with focus on
device posture evaluation
Zscaler ClientConnector

Key Benefits•

Combining the Zscaler Zero Trust
Exchange with Beyond Identity’s identitycentric zero trust solution reduces the riskof two of the most targeted attack vectors- the individual and their device.

•The joint solution strengthens a zerotrust architecture and minimizes theattack surface by validating the user anddevice and enabling secure access toapplications.

•Device security checks and continuous
reassessment moves security to aproactive stance, actively disconnecting
non-compliant devices.

Beyond Identity
Beyond Identity is fundamentally changing the way the world logs in–eliminating passwords and all phishable factors toprovide users with the most secure and frictionless authentication on the planet. Our invisible, passwordless MFA platform
enables companies to secure access to applications and critical data, stop ransomware and account takeover attacks, meetcompliance requirements, and dramatically improve the user experience and conversion rates. Our revolutionary zero-trust
approach to authentication cryptographically binds the user’s identity to their device, and continuously analyzes hundredsof risk signals for risk-based authentication. For more information on why Snowflake, Unqork, Roblox, and IAG use Beyond
Identity, check out www.beyondidentity.com.