ZTNA separates application access from network access. This means that users must be authenticated to use each application individually as opposed to the network as a whole.
Once the user is authenticated, the ZTNA tool establishes a secure, encrypted tunnel to grant access to a resource. Like software defined perimeters (SDPs), ZTNA tools use “dark cloud” principals to shield the user’s IP address and limit the user’s visibility into other applications and services that they do not have access to.
By authenticating each user and isolating access in this way, the organization can reduce the risk of infection from a compromised device as well as prevent lateral movement in the event of a breach.