Beyond VPN: Why Give Access to the Network When Users Only Need an App?
Zero Trust in the Real World | XenTegra Canada
Know the User. Trust the Device. Secure the Application.
The Problem: One Login, Too Much Access
Imagine a contractor who needs access to one financial application.
You provide VPN credentials, authenticate the user, and allow them to connect to your corporate network.
The contractor gets their application. But depending on how the VPN and network are configured, they may also gain connectivity to systems they never needed.
Now imagine those credentials are stolen.
The attacker may have inherited more access than the original user required.
The question isn't whether VPN technology is inherently insecure. It's whether network-level access is necessary in the first place.
Traditional VPNs still serve legitimate purposes. But today's hybrid workforce, SaaS applications, distributed infrastructure, and third-party access requirements demand a more granular approach.
Zero Trust offers a different starting point:
Give users access to the applications they need, not the entire network.
Real-World Lesson #1: Colonial Pipeline — One Password, Major Consequences
In May 2021, Colonial Pipeline suffered a ransomware attack associated with a compromised legacy VPN account.
The account did not have multifactor authentication enabled.
The company subsequently shut down pipeline operations as a precaution, causing significant disruption to fuel distribution across the eastern United States.
The incident demonstrates why protecting credentials alone isn't enough.
Organizations should ask:
- Are unused VPN accounts being disabled?
- Is MFA enforced for remote access?
- Can users reach more network resources than their roles require?
- Can compromised credentials enable lateral movement?
The Zero Trust lesson: Minimize the resources accessible through any single identity.
Real-World Lesson #2: MGM Resorts — A Valid Identity Isn't Always a Trusted Identity
In September 2023, MGM Resorts experienced a major cyberattack involving social engineering and identity compromise.
Attackers reportedly manipulated help-desk processes to obtain access, contributing to operational disruptions affecting hotel and casino systems.
MGM disclosed approximately $100 million in negative financial impact.
This illustrates a critical weakness in relying solely on initial authentication.
A legitimate-looking identity can still represent a compromised session or unauthorized individual.
Modern Zero Trust architectures evaluate multiple signals:
User: Who is requesting access?
Device: Is the device managed, healthy, and compliant?
Application: What resource is being requested, and what permissions are necessary?
Context: Does the request match expected behaviour, location, risk, and policy?
Authentication should not be treated as a permanent grant of trust.
The Zero Trust lesson: Verify identity and context, then authorize only the required access.
Real-World Lesson #3: CrowdStrike — What Happens When Recovery Systems Are Unavailable?
In July 2024, a faulty CrowdStrike content update caused widespread Windows system crashes, affecting approximately 8.5 million devices.
This was not a cyberattack. It was a major operational resilience incident.
It nevertheless exposed an important architectural consideration: recovery becomes harder when the systems required to perform recovery are themselves unavailable.
For example, IT teams may depend on identity services, privileged access systems, device management tools, or recovery-key repositories to restore affected infrastructure.
What happens when those dependencies are inaccessible?
Organizations need to plan for:
- Emergency administrative access
- Securely stored recovery credentials
- Independent or resilient management paths
- Segmented recovery infrastructure
- Regularly tested recovery procedures
The Zero Trust lesson: Secure access must also be resilient access.
Real-World Lesson #4: AI Agents Need Zero Trust Too
Imagine hiring a temporary contractor.
Would you immediately provide unrestricted access to your finance systems, customer databases, production servers, and corporate applications?
Probably not.
Yet organizations can unintentionally create similar risks when deploying AI agents with highly privileged identities and broad application integrations.
AI agents can retrieve information, perform workflows, connect to APIs, and interact with enterprise systems.
Their permissions deserve the same scrutiny as those of human users.
Organizations should apply:
- Dedicated identities for AI agents
- Least-privilege access
- Restricted API permissions
- Activity monitoring and auditing
- Credential lifecycle management
- Human approval for sensitive actions
The Zero Trust lesson: Treat AI agents like contractors, not superusers.
Moving Beyond VPN: Know the User, Device, and Application
Modern secure access should begin with three questions.
1. Know the User
Who is requesting access?
Is the identity verified through appropriate authentication controls?
Does the user actually require access to the requested resource?
2. Evaluate the Device
Is the endpoint managed or unmanaged?
Does it meet the organization's security requirements?
Should the user be permitted to download data, transfer files, or access sensitive applications from this device?
3. Secure the Application
What application does the user need?
Can access be delivered without providing broad network connectivity?
Can permissions be restricted to the user's specific role?
These questions help organizations move from network-centric security toward identity-aware, application-specific access.
Four Technologies That Enable Modern Secure Access
There is no single technology that solves every Zero Trust requirement.
The right solution depends on the application, endpoint, user experience, and security policy.
Secure Enterprise Browser
Secure Enterprise Browsers can provide controlled access to web and SaaS applications.
Depending on the platform, organizations can enforce policies for downloads, clipboard usage, file transfers, session activity, and data handling.
This can be especially valuable for contractors, third parties, and unmanaged devices.
Zero Trust Network Access (ZTNA)
ZTNA solutions provide policy-controlled access to specific private applications.
Unlike traditional broad network connectivity, properly designed ZTNA architectures can limit access to authorized applications and reduce unnecessary exposure.
Application Virtualization
Application virtualization enables organizations to deliver centrally hosted applications to users without requiring the full application environment to reside on their endpoints.
Solutions such as Citrix Virtual Apps and Parallels RAS can support secure application delivery, centralized management, and granular access policies.
Desktop Virtualization
Some users require a complete managed workspace rather than access to an individual application.
Citrix DaaS, Parallels RAS, Microsoft Azure Virtual Desktop, and Omnissa Horizon can help organizations deliver centrally managed virtual desktops.
These platforms can reduce the need to expose internal resources directly to unmanaged endpoints, although security still depends on appropriate configuration and access controls.
The goal isn't to replace one technology with another everywhere. It's to select the appropriate access model for each use case.
Don't Boil the Ocean: Start With 10 Applications in 90 Days
One of the biggest mistakes organizations make with Zero Trust is treating it as a massive infrastructure transformation that must happen all at once.
It doesn't.
A focused 90-day initiative can establish measurable progress.
Days 1–30: Discover and Assess
Identify 10 business-critical or high-risk applications.
Document:
- Who accesses each application
- Which devices are used
- How access is currently provided
- Whether VPN connectivity is required
- Existing authentication and authorization controls
- Unnecessary network exposure
Prioritize opportunities where access can be modernized with manageable effort and business risk.
Days 31–60: Design and Pilot
Select the appropriate delivery model for each application.
That might include a Secure Enterprise Browser, ZTNA, application virtualization, or desktop virtualization.
Implement a controlled pilot with representative users.
Validate authentication, device policies, user experience, application functionality, and operational support requirements.
Days 61–90: Deploy and Measure
Expand successful pilots.
Reduce unnecessary VPN dependencies where practical.
Measure progress using metrics such as:
- Applications transitioned to application-specific access
- Users no longer requiring broad VPN connectivity
- Reduction in exposed network resources
- MFA and device-compliance coverage
- User experience and support-ticket trends
Not every application will be fully migrated within 90 days. The objective is to establish a repeatable model and demonstrate measurable risk reduction.
How XenTegra Canada Can Help
At XenTegra Canada, we believe Zero Trust should be practical, measurable, and aligned with business requirements.
Our expertise across End User Computing, networking, cybersecurity, cloud, and managed services enables us to evaluate secure access from multiple perspectives.
Whether your environment relies on Citrix, Parallels, Microsoft Azure Virtual Desktop, Omnissa, secure enterprise browsers, or ZTNA technologies, the objective remains the same:
Deliver the right access to the right user, from the right device, under the right conditions.
Rather than recommending a complete replacement of your existing infrastructure, we help identify opportunities to modernize access incrementally.
Start With a Zero Trust MicroAssessment
Not sure where to begin?
Engage XenTegra Canada's architects for an initial Zero Trust MicroAssessment.
We'll help you examine your current remote-access model, identify potential exposure, and explore which applications may be suitable for more granular access controls.
The conversation starts with your environment, not a product demonstration.
Don't boil the ocean. Start with 10 applications.
Know the User. Trust the Device. Secure the Application.
Give access to the app. Not the entire network.
XenTegra Canada | Zero Trust in the Real World
People. Solutions. Outcomes.