Ericsson debuts clientless ZTNA for third-party access

Ericsson has announced the expansion of its NetCloud SASE product with a clientless Zero Trust Network Access (ZTNA) solution aimed at improving secure connections for third-party and BYOD users.

The new clientless ZTNA functionality aims to provide organisations with a way to securely connect external users to authorised resources, offering added security while addressing the challenges of managing access to both managed and unmanaged devices, particularly in environments that prioritise wireless connectivity.

This expanded solution builds on Ericsson's existing client-based ZTNA, introducing a flexible system designed to support IT teams that often need to accommodate a diverse range of devices and users.

According to Ericsson, a significant advantage is its application isolation approach, which creates a virtual 'air gap' between corporate resources and devices that may not be secure, thereby reducing the risk of malware infiltration.

Highlighting the prevalence of related security incidents, Ericsson pointed to data from KPMG, which indicates that 73% of organisations have experienced at least one significant disruption linked to third-party cyber incidents within the past three years.

Ericsson's new clientless ZTNA solution utilises embedded isolation technology, differentiating itself from other solutions that depend solely on access controls by initiating application sessions within isolated cloud containers when accessed from unsecured devices.

"5G uniquely introduces a surge of IoT and OT assets, which are frequently monitored and maintained by third-party suppliers and contractors. Unlike legacy VPNs that provide broad network access and are difficult to implement, NetCloud ZTNA offers a straightforward, policy-based solution that ensures users have isolated access to resources based on the principle of least privilege," Pankaj Malhotra, Head of WWAN & Security, Enterprise Wireless Solutions at Ericsson, said.

The key features of the NetCloud SASE with clientless ZTNA include allowing contractors and BYOD users to access isolated applications via a secure URL without the use of VPNs, clients, or special browsers. The system also isolates interactions between unmanaged users and corporate systems in cloud containers, safeguarding against potential malware risks.

Furthermore, access is governed by granular policies based on user roles and device types, following the principle of least privilege. The system conducts continuous risk assessments by leveraging real-time analytics and intrusion detection and prevention tools, with the capability to immediately revoke access in response to changes in user context or risk profile.

The architecture eliminates the need for static public IP addresses. It hides internal IP information, operating under a default-deny model and micro-segmentation policies to block lateral movement within networks. All features are managed within the NetCloud Manager platform for simplified deployment and oversight, and the solution integrates with existing enterprise identity and access management systems to streamline authentication and reduce the issue of identity sprawl.

"VPNs fail to address modern secure access needs due to their complexity, management overhead, security vulnerabilities, and performance issues, making ZTNA a must. But ZTNA solutions that rely on agents make it difficult for overburdened IT teams to deploy to third parties needing access to corporate resources. For organisations adopting a wireless-centric strategy, NetCloud SASE clientless ZTNA offers a unique, isolation-based approach which grants access to specified assets while providing effective protection against malicious activity and the threat of malware," John Grady, Principal Analyst at Enterprise Strategy Group, now part of Omdia, said.

NetCloud SASE with clientless ZTNA is now included as part of the NetCloud ZTNA license. The addition allows enterprises to avoid reliance on VPNs, clients, or browser plug-ins, while providing what Ericsson describes as unified management for both security and connectivity solutions, including those related to 5G wireless WAN and SD-WAN.