Many organizations like yours are adopting a Zero Trust architecture. Zero Trust encourages approaching security as if attackers have already infiltrated your network and are lurking, waiting for the opportunity to launch their attack. A Zero Trust approach to security eliminates the idea of a trusted insider within a defined network perimeter. It assumes that there is a limited, or even no, secure network perimeter, unlike the “castle and moat” security approach that has been employed for decades. And with many applications migrating to public clouds or being replaced by SaaS applications, and network resources being usurped by those in the clouds, a Zero Trust approach is more relevant and applicable than ever.

The Zero Trust axiom is, “Never trust, always verify.” Never trust users, even if they’ve already been authenticated, authorized, and granted access to applications and resources. Always verify and scrutinize user identity, device type and integrity, location, the applications and resources to which access is being requested, and more. And verify not just at the time a user requests access, but throughout the entire time they have access to the application or resource, and upon every subsequent access request and attempt. A Zero Trust approach means applying least privilege rights to user access; that is, allowing users access only to the applications and resources to which they are authorized, and restricting their access to a single application or resource at a time.

The core tenets of a Zero Trust architecture are identity and context. Always ensure that a user is who they claim to be by leveraging a trusted, verifiable source of identity. And ensure that only the right user securely accesses the right app, at the right time, with the right device, with the right configuration, from the right place.

Identity- and context-awareness are also what Identity Aware Proxy (IAP) enables and delivers. Identity Aware Proxy provides secure access to specific applications leveraging a fine-grained approach to user authentication and authorization. IAP enables only per request application access, which is very different than the broad access approach of VPNs, which apply session-based access. The difference is between limiting user access to a specific application or resource to which they are authorized access, versus enabling them to access every application or resource that they are authorized to access. Centralizing authorization enables application-level access controls to be created.

Context is vital within IAP. It enables the creation and enforcement of granular application access policies based on contextual attributes, such as user identity, device integrity, and user location, to name only a few. IAP relies on application-level access controls, not network-layer imposed rules. Configured policies reflect user and application intent and context, not ports and IP addresses. Finally, IAP requires a strong root of trusted identity to verify users and their devices, and to stringently enforce what they are authorized to access.

Identity Aware Proxy is principal in F5 BIG-IP Access Policy Manager (APM). BIG-IP APM and F5 Access Guard deliver Identity Aware Proxy, using a Zero Trust model validation for every access request. Providing authenticated and authorized secure access to specific applications, it leverages F5’s best-in-class access proxy. BIG-IP APM centralizes user identity and authorization. Authorization is based on the principles of least privileged access. With its IAP approach, BIG-IP APM is able to examine, terminate, and authorize application access requests. The context-awareness required for Zero Trust compels the development and enforcement of extremely granular authorization policies. BIG-IP APM, through its IAP support, delivers just that. Policies within BIG-IP APM may be created to verify user identity, check device appropriateness and posture, and validate user authorization.

You can also create policies to:

• Confirm application integrity and sensitivity
• Confirm time and date accessibility
• Limit or halt access if the user’s location is deemed incorrect, inappropriate, or insecure
• Request additional forms of authentication—including multi-factor authentication (MFA)—if the user’s location or the sensitive nature of the device or the application or files to which access is being requested warrant it
• Integrate data from user and entity behavior analytics (UEBA) and other API-driven risk sources

To ensure a device is appropriate and secure, and before the user can be authenticated and their application access authorized, BIG-IP APM checks their device security posture via F5 Access Guard, which is included with BIG-IP APM. However, BIG-IP APM and F5 Access Guard go beyond simply checking device integrity at authentication. Instead, they deliver continuous, ongoing device posture checks, ensuring that user devices not only meet but continuously adhere to endpoint security policies throughout the user’s application access. And if BIG-IP APM senses any change in the device integrity, it may either limit or stop the user’s application access, thereby limiting or eliminating potential attacks before they can be launched.

Identity Aware Proxy also simplifies application access for remote or home-based workers and better enables and secures application accessibility for your organization. Since VPN access allows users to access any application or resource to which they’re authorized, it does not adhere to a Zero Trust model. However, Identity Aware Proxy empowers users to request access to a specific application directly and to have encryption protection. This significantly reduces your need for VPNs, saving your organization time and cost, while delivering a safer alternative.

A true Zero Trust security approach, though, requires that access to all applications to which a user may be authorized be secured, including applications that are not native to the public cloud or offered as Software-as-a-Service (SaaS). This must include even classic or custom applications that may not or cannot work with cloud-based identity, such as Identity-as-a-Service (IDaaS). Many of these applications remain on-premises, in a data center, or in a private cloud. Most of these applications also support classic authentication methods, like Kerberos, header-based, or others. They are unable to support modern authentication and authorization protocols like Secure Assertion Markup Language (SAML), or OpenID Connect (OIDC) and OAuth. They can’t support identity federation, single sign-on (SSO), or even MFA.

BIG-IP APM solves this issue. BIG-IP APM, working closely with IDaaS providers including Microsoft (Azure Active Directory), Okta, and others, bridges the identity gap between modern and classic authentication. BIG-IP APM is able to ensure that classic and custom applications can support identity federation and SSO. This not only enhances your user experience, simplifying application access by centralizing access control, but also ensures that a secure, trusted source of identity is in place. By enabling MFA for all applications, BIG-IP APM protects all applications against inappropriate access and enables another layer of security to ensure appropriate application access. BIG-IP APM is a single, centralized control point for managing and securing user access to applications, wherever they may be hosted.

F5 BIG-IP APM, through its support for Identity Aware Proxy, enables deployment of Zero Trust application access. BIG-IP APM delivers per-request application access, while securing and managing access to all applications, regardless of their location, and authentication and authorization methods. It offers the scalability and reliability synonymous with F5, and leverages F5’s industry-leading full-proxy architecture.

BIG-IP APM with Identity Aware Proxy reduces infrastructure costs, increases application security, and enhances your user and administrative experiences.