Zero › Module 6 › Lesson 3
Edge Hygiene
VPN vs ZTNA comparison literacy — trust model, blast radius, logging — comparison table on YOUR $ZT_LAB network folder.
Visual · t40_vpn_vs_ztna
VPN vs ZTNA. $ZT_LAB. Original Cyberlium.
Opening
Legacy VPN checked a password — ZTNA checks identity, device, and app every time — document migration criteria on LAB-ZT-001 roadmap stub.
Compare: VPN often grants network segment access; ZTNA grants named app sessions; VPN split tunneling debates; ZTNA default deny other resources; logging granularity; device posture integration. Write comparison table + migration criteria: which apps move first, VPN coexist period, decommission milestone — fictional. Next: Network Lab.
1. Comparison dimensions (named)
Access scope: network vs app. Trust model: perimeter vs per-request. Device posture: often weak vs integrated. Lateral movement risk: higher vs lower by design.
Ops: VPN concentrator vs cloud broker scale literacy.
Command guide
Try these commands — Comparison dimensions (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Networks — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_NETWORK=${ZT_NETWORK:-$ZT_LAB/LAB-ZT-001/network}
cat > "$ZT_NETWORK/vpn-vs-ztna-comparison.md" <<'EOF'
# VPN vs ZTNA Comparison — LAB-ZT-001
| Dimension | Legacy VPN | ZTNA |
|-----------|------------|------|
| Access scope | Often full network | App-specific sessions |
| Trust model | Perimeter / tunnel | Per-request verify |
| Device posture | Often weak | Integrated CA check |
| Lateral movement risk | Higher | Lower by design |
| Logging | Connection-focused | App session granular |
## Migration priority (fictional)
1. finance.internal.zt (high sensitivity)
2. git.internal.zt (dev remote)
3. legacy-erp (VPN coexist until Phase 3)
Refused: VPN bypass tutorials
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'VPN vs ZTNA|Migration|Refused|LAB SAMPLE' "$ZT_NETWORK/vpn-vs-ztna-comparison.md"
python3 -c "print('Migration: phased coexist — not rip-and-replace day one')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Coexistence literacy
Real migrations run parallel: ZTNA for SaaS and new apps, VPN for legacy protocols temporarily. Document sunset criteria for VPN on LAB-ZT-001.
Not rip-and-replace day one — phased roadmap link to M9.
3. Comparison table
Six-row VPN vs ZTNA table + three app migration priority rows.
Ship: comparison + migration priority stub. Next: Network Lab.
4. What you ship: VPN vs ZTNA comparison
Six-dimension table + three app migration rows. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. VPN vs ZTNA table. $ZT_LAB named. File t40-m06-l03-vpn-vs-ztna.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Claim VPN is always evil with no coexist note. Teach VPN bypass as ZT lab.
Right
Write comparison table with phased migration rows. Next: Network Lab.
Mission: VPN vs ZTNA comparison
1) Six comparison dimension rows. 2) Three apps prioritized for ZTNA first. 3) VPN sunset criteria sentence. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Migration priority: high-risk apps and remote users first — not big bang.
Knowledge Check
APPLY: ZTNA vs legacy VPN access scope:
Multiple choice
Knowledge Check
APPLY: True or False: Real migrations often run VPN and ZTNA in parallel temporarily.
True or False
Knowledge Check
APPLY: VPN bypass tutorials:
Multiple choice