Zero › Module 6 › Lesson 3
Edge Hygiene
VPN vs ZTNA comparison literacy — trust model, blast radius, logging — comparison table on YOUR $ZT_LAB network folder.
Visual · t40_vpn_vs_ztna
VPN vs ZTNA. $ZT_LAB. Original Cyberlium.
Opening
Legacy VPN checked a password — ZTNA checks identity, device, and app every time — document migration criteria on LAB-ZT-001 roadmap stub.
Compare: VPN often grants network segment access; ZTNA grants named app sessions; VPN split tunneling debates; ZTNA default deny other resources; logging granularity; device posture integration. Write comparison table + migration criteria: which apps move first, VPN coexist period, decommission milestone — fictional. Next: Network Lab.
1. Comparison dimensions (named)
Access scope: network vs app. Trust model: perimeter vs per-request. Device posture: often weak vs integrated. Lateral movement risk: higher vs lower by design.
Ops: VPN concentrator vs cloud broker scale literacy.
Command guide
Try these commands — Comparison dimensions (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Coexistence literacy
Real migrations run parallel: ZTNA for SaaS and new apps, VPN for legacy protocols temporarily. Document sunset criteria for VPN on LAB-ZT-001.
Not rip-and-replace day one — phased roadmap link to M9.
3. Comparison table
Six-row VPN vs ZTNA table + three app migration priority rows.
Ship: comparison + migration priority stub. Next: Network Lab.
4. What you ship: VPN vs ZTNA comparison
Six-dimension table + three app migration rows. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. VPN vs ZTNA table. $ZT_LAB named. File t40-m06-l03-vpn-vs-ztna.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Claim VPN is always evil with no coexist note. Teach VPN bypass as ZT lab.
Right
Write comparison table with phased migration rows. Next: Network Lab.
Mission: VPN vs ZTNA comparison
1) Six comparison dimension rows. 2) Three apps prioritized for ZTNA first. 3) VPN sunset criteria sentence. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Migration priority: high-risk apps and remote users first — not big bang.
Knowledge Check
APPLY: ZTNA vs legacy VPN access scope:
Multiple choice
Knowledge Check
APPLY: True or False: Real migrations often run VPN and ZTNA in parallel temporarily.
True or False
Knowledge Check
APPLY: VPN bypass tutorials:
Multiple choice