Why we rethought Zero Trust at NCP

How Changing Access Needs Shaped Our Zero Trust Solution

How can companies protect their applications and data without making access unnecessarily complicated for authorized users? At NCP, this question has guided our work in secure remote access for years.

In this blog series, I’ll share how we developed our Zero Trust solution — from the ideas that shaped our approach to the technical details behind individual features.

Table of Contents

1. Why Secure Access Requirements Have Changed

2. Our Approach: Zero Trust Instead of Implicit Trust

• Isolate Applications
• Define Access Policies in the Control Plane
• Enforce Policies in the Data Plane

3. Why We Combine Zero Trust With VPN Expertise 

Why Secure Access Requirements Have Changed

The way people work and access company resources has changed significantly. Employees work from home or on the go, applications run in the cloud, and external partners need access to selected systems. Many IT environments also include personal devices and devices managed under different policies.

These changes create more access scenarios — and more security challenges.

One concern is lateral movement. After compromising an account or device, attackers may try to reach other systems and applications. How far they get depends partly on access permissions and the rules governing communication between systems.

These developments led us to explore more precise, flexible access controls. Our goal was to give companies greater control over who can access each application, under what conditions, and for how long.

Our Approach: Zero Trust Instead of Implicit Trust

Zero Trust does not automatically trust an access request simply because it comes from a known network or uses an established connection.

For NCP, this meant shifting our perspective. Rather than using network access as the basis for broader permissions, we focused on the user’s identity, the context of the request, and the specific resource involved.

Three principles guided our approach.

1. Isolate Applications

Permission to use one application should not automatically grant access to the entire network.

Our approach combines granular access controls with application isolation, following the principle of microsegmentation. The aim is to give users access only to the resources they need and limit unnecessary connections between systems.

This also helps reduce an attacker’s ability to reach other applications after compromising an account or device.

2. Define Access Policies in the Control Plane

An established connection alone is not enough to justify access. Decisions must also consider who is requesting access, which resource they need, and which rules apply.

The control plane makes these decisions based on defined policies. For example, a policy might allow a user to access an application only until 7 p.m. or require additional conditions to be met.

This provides centralized control over access permissions while allowing companies to set detailed rules for individual applications and users.

3. Enforce Policies in the Data Plane

The data plane enforces access decisions on the actual connections. It ensures that the rules defined in the control plane apply to data traffic.

Enforcement must extend beyond the initial connection. Existing connections also need to respond when conditions change, permissions expire, or policies are updated. Depending on the requirements, access may need to be restricted or terminated.

This relationship is central to our architecture: the control plane decides what access is allowed and under which conditions; the data plane puts those decisions into effect.

Why We Combine Zero Trust With VPN Expertise

We developed our solution with the understanding that Zero Trust is a security approach, not a standalone technology.

NCP brings years of experience in secure network connections and remote access. Rather than discard that foundation, we wanted to build on it.

Companies rarely have the option to replace their entire infrastructure. They must support a mix of applications, established permissions, and existing access arrangements. A practical Zero Trust solution needs to address new requirements while working within that environment.

Our approach brings Zero Trust and proven VPN technology together. It allows companies to strengthen access security, protect individual applications, and retain VPN connections where they remain useful.

For us, Zero Trust is not simply a replacement for VPN. It is the next step in secure enterprise access.

These principles shaped the development of the NCP Zero Trust solution. In the next installment, I’ll introduce its core components and explain how they put Zero Trust into practice.