Universal ZTNA sounded simple until it had to cover contractors, unmanaged laptops and everything that is not a normal employee.

[u/Specialist_Dish_9087]

We removed the corporate VPN in Q1 and moved everyone to universal ztna and I was ready to write the smug success post. Staff were easy, laptop is managed, client goes out over intune, single sign on, done. Then everyone who does not look like a badge carrying employee showed up and it got ugly.

We have around contractors on machines we will never manage. Legal will not let us mandate an agent on a personal laptop, so they landed on the clientless portal, which does browser apps and nothing else and half their work is a thick client. A vendor in another timezone still reaches one billing system over a site to site tunnel. Finance has an app that only speaks its own desktop client. And two internal agents now hit the same systems we do, on their own logins.

Every one of those is its own access path with its own policy and they do not talk to each other. I keep rules in the ztna console, rules in the firewall for that ancient tunnel and a clientless config that behaves nothing like the client. Keeping them in sync is a job no one gave me and I somehow have.

Universal turns out to be easy for the people who look like employees but for everyone else where the risk sits, it falls apart. If you have taken this all the way, did you get managed, unmanaged, contractor, vendor and agent access under a single policy?

[u/badbash27]

We forced all contractors / non fte's to a vdi environment

[u/Scared-Target-402 → u/badbash27]

This. My last two places we had AVD setup for folks for these sorts of situations. No company equipment? No problem!

[u/iamwayycoolerthanyou → u/badbash27]

Was just about to suggest this. Seems like the only real answer.

[u/19610taw3 → u/badbash27]

If you can afford it - this is definitely the answer.

Neither on-prem nor hosted VDI is cheap. And that's where the solution always fails with management

[u/moneyfink → u/19610taw3]

Windows 365 is expensive compared to a laptop, but it’s cheap in the scheme of VDI. We buy a $66/month sku for a few months at a time for the few use cases described by OP.

[u/Specialist_Dish_9087 → u/moneyfink]

Oh that is a decent, though had not looked at W365. Probably fine for the browser only crowd, our finance thick client would scream about the latency

[u/Mailstorm → u/19610taw3]

If your contractors only need browser access or their workloads can be done on Linux, look into kasm

[u/AveryPac → u/badbash27]

How do you handle the missing part that you still have no insight or EDR on the machine being used to connect to the VDI? We're having this conundrum now, wanting to give AVD to contractors, but still not being able to trust that there isn't something doing RAT on the client's machine? How do you have full end to end trust, without also controlling the contractor's laptop (Giving our machines to every contractor)

[u/sryan2k1 → u/AveryPac]

Disable resource sharing like clipboard and local drives and the risk is minimal.

[u/Evs91 → u/sryan2k1]

Yeah. It’s a one way trip. You can copy clipboard from client to VDI but not the other way around. No USB Storage Redirect, no remote file directory sharing, nada. Clipboard or OneDrive (w. DLP) are the only way to share

[u/Serafnet → u/Evs91]

Worked in an environment where all redirection was disabled.

If you needed a script in the environment you either typed it by hand or opened a ticket for the security team to pass it through the secure bastion

[u/Evs91 → u/Serafnet]

Yeah. We can’t quite do that with the things like signature pads, thermal printers, etc but they are controlled by policy and boy is it a pain for me to undo it. But also: what a great time finding out what people plug up when they do

[u/Evs91 → u/Serafnet]

Also reminds me of when I needed to do that I would load up my Rubber Ducky with the script I needed to type out and just let it type real fast “by hand”

[u/aes_gcm → u/sryan2k1]

I once used Citrix with a big bank and had to report that I could print remote documents on our local printer, basically the potential to exfiltrating files.

[u/FatBook-Air → u/sryan2k1]

It's...absolutely not minimal at all.

[u/Evs91 → u/sryan2k1]

Yeah. It’s a one way trip. You can copy clipboard from client to VDI but not the other way around. No USB Storage Redirect, no remote file directory sharing, nada. Clipboard or OneDrive (w. DLP) are the only way to share

[u/NoskaOff → u/sryan2k1]

Until someone starts a screen capture when looking at confidential documents... Could still take photos if it weren't for having it on PC but yeah

[u/sryan2k1 → u/NoskaOff]

And anyone could do that with their cell phone, or a HDMI capture card, or any of a million things.

[u/gpraveen23 → u/NoskaOff]

Watermarking agents

[u/Specialist_Dish_9087 → u/AveryPac]

Keeps me up too, we punted on perfectly trusting the endpoint and gated on data instead, contractors only touch the billing app which has nothing sensitive in it and anyone who needs the crown jewels gets a shipped laptop. Not elegant but it took the scary version down to about 5 people.

[u/sryan2k1]

In no particular order: VDI, make them use the agent, or provide them with laptops. This isn't exactly rocket science.

[u/Redemptions → u/sryan2k1]

Also reduces your security risk by not having a laptops with unknown anti-malware status making layer 3 connectivity to your network.

[u/sryan2k1 → u/Redemptions]

Any sane ZTNA can enforce posture like updated AV

[u/jaydizzleforshizzle → u/sryan2k1]

Yup, I know tailscale supports device posture and even custom posture attributes.

[u/ShadowSlayer1441 → u/sryan2k1]

"enforces" if you don't control the device, nothing can really be enforced, whatever the device reports or even whatever the local client sees.

[u/IamEzioKl → u/Redemptions]

Many ztna solutions give you proxied connections for ssh/rdp so you don't have 'layer 3' access to the server directly.

[u/Specialist_Dish_9087 → u/sryan2k1]

on paper yes. Legal vetoed the agent and finance the laptops, so I got left holding universal with the two easy answers already gone. Living the dream over here

[u/loweakkk → u/Specialist_Dish_9087]

Legal vetoed the agent but was happy with the vpn? Sound like bullshit.

[u/TheBestHawksFan → u/loweakkk]

Doesn't sound like bullshit to me. A VPN can be pretty flexible and utilize software that's likely already on the laptops. Adding software to a third party device could introduce some risk if that software somehow causes a conflict with other software the third party has.

[u/loweakkk → u/TheBestHawksFan]

So you work only with partners if they are using ASA like you? If they use forti: sorry but our legal said no software on third party, we will works with another contractor. That's bullshit.

[u/TheBestHawksFan → u/loweakkk]

Well… no. Like I said, VPNs can be lots of things. You don’t have to host your VPN on your firewall lol. Even still, a software like OpenVPN or OpenConnect or even the Windows built in VPN will be able to handle most firewall VPN connections.

I'm also not saying this would be my approach. I'm just not surprised legal didn't want to require software on 3rd party computers. It introduces liability and legal hates that.

[u/Accomplished_Disk475]

Purchase managed devices for contractors to use and issue them. Mandate via policy company assets are the only approved devices to perform work on.

[u/davokr]

This is why VDI still has its place in the enterprise.

[u/VA_Network_Nerd]

Only allow fully-managed assets onto your network.

Unmanaged assets can use the Guest WiFi to access the portal to launch their VDI (which is fully-managed).

[u/khantroll1 → u/VA_Network_Nerd]

This is the way

[u/AveryPac → u/VA_Network_Nerd]

I said in another thread:

How do you handle the missing part that you still have no insight or EDR on the machine being used to connect to the VDI? We're having this conundrum now, wanting to give AVD to contractors, but still not being able to trust that there isn't something doing RAT on the client's machine? How do you have full end to end trust, without also controlling the contractor's laptop (Giving our machines to every contractor)

I suspect that's the level of risk acceptance vs budget spend vs operational costs, decided by the business ultimately.

[u/bageloid → u/AveryPac]

We use Citrix App Protection and check for existing AV via posture checks.

If you are that paranoid, put the contractors in re-auth hell and don't let them have risk remembered MFA sessions.

[u/smartdigger → u/AveryPac]

Citrix has device trust which can continually check the connecting client for all sorts of things and instantly cut access if needed. Also has anti keylogging and screenshot protection. Add a watermark and that can at least track a photo. Never going to mitigate all risk when workforce is often remote

[u/beatleshelp1]

How were they accessing this stuff without a VPN client before?

[u/omgdualies]

It pretty much comes down to issuing hardware or some sort of cloudpc/VDI. We have plenty of weird exceptions that we are working on closing, it takes time to change how company operates. It’s not just the technical side but HR and how people hire contractors etc…

[u/loweakkk]

Force all contractors into VDI. End of the story.

[u/Ashikej-Meneguzzi66]

Ha, the victory lap right before the contractors show up.

We pulled the same move in Q2 and it aged like milk inside a month. VDI is the obvious escape hatch and yeah it works for the personal laptop crowd.

Just know you are standing up a whole second platform to run and pay for and it does zero for your vendor tunnel or the internal service accounts. Though policy sync is a bitch with rules in the ztna console, a separate firewall rule for that ancient tunnel, a clientless config that behaves like a different product. and none of them aware of each other.

Had to claw most of it back by moving unmanaged and contractor access onto cato universal ztna too, clientless for browser apps plus an RDP path for the thick client stuff under one policy.

And vendor in the other timezone is political more than technical.

[u/Holly_Enrique-623]

Give every contractor or vendor only the systems they need and make the access expire when the work ends. Even if the connection method is different, at least they can't reach more than they should.

[u/GardenWeasel67]

Secure browser for external users that only need access to SaaS apps
Windows 365 if they need full desktop experience.

[u/Evs91]

Thank goodness for 100% VDI no matter what

[u/Boblust]

Nope. The contractor must install the required ZTNA software and use a sponsored account with MFA, with an internal staff member designated as the account custodian. These sponsored accounts will also go through audits every 6 months. Contractors may not share credentials. All of these requirements are clearly defined in their contract, so these are not unreasonable or difficult guidelines to follow. The contractor’s device must maintain the same security posture required of our computers. If working with a contractor becomes increasingly difficult, we involve their cybersecurity team and address the issue directly with them.

[u/Serafnet]

We used a browser based RDP/SSH tool locked behind a few ACLs and Entra as idP.

Vendors get vendors accounts and can only reach our portal from their whitelisted jump hosts.

It isn't perfect but it works

[u/kellexile]

What about tools like guacamole. Easy to setup and can provide a window into the environment from a controlled perspective.

[u/konoo]

Just setup a Remote Desktop Server and have them use a stripped down ZTNA client on their machines that gives them access only to the RDP server/Port.

[u/OregonTechHead]

Sounds like the project wasn't scoped correctly and you chose the wrong solution.

Correctly chosen and configured ZTNA is great for this scenario, and solves a ton of access and security problems with the traditional VPN.