Key takeaways
- CISA's Emergency Directive 24-01 followed widespread exploitation of Ivanti VPN gateways in January 2024.
- CISA, the FBI and partner agencies in Canada and New Zealand urged organizations of all sizes in 2024 to move toward zero trust, SSE and SASE.
- NIST SP 800-207 defines zero trust as granting no implicit trust based solely on network location.
- To replace a VPN with zero trust, publish applications one at a time and run both in parallel before shutting the VPN down.
- ZTNA controls access but does not make large model files open faster over slow connections.
- NIST SP 800-171 remote access requirements do not name a technology, so a ZTNA design can be documented against them.
Your project managers open the VPN from a jobsite trailer, a subconsultant may still have an account from a job that closed months ago, and the VPN appliance at the edge of your office network is the kind of device attackers have targeted hardest in recent years. This guide shows how architecture, engineering and construction firms can replace a VPN with zero trust network access (ZTNA), one application and one team at a time, without stopping project work.
Why are AEC firms replacing their VPNs?
AEC firms are replacing VPNs because a traditional VPN puts a remote user on the office network, and the VPN appliance itself has become a favorite target. Once connected, a user, or an attacker holding that user's password, can often reach far more than the one project share they needed. For firms with offices, jobsites and remote staff, that broad access is the risk.
The appliances are a problem in their own right. In January 2024, CISA issued Emergency Directive 24-01 after widespread, active exploitation of Ivanti Connect Secure and Policy Secure gateways, two widely deployed remote access products. Attackers chained an authentication bypass with a command injection flaw, captured credentials and moved laterally, and CISA's supplemental direction ordered federal agencies to disconnect the affected products by February 2, 2024. That directive bound federal agencies, yet the same products sit at the edge of many private firms.
Later in 2024, CISA, the FBI and partner agencies in Canada and New Zealand published Modern Approaches to Network Access Security. It describes the weaknesses of traditional remote access and VPN deployments and urges organizations of every size to move toward zero trust, Security Service Edge (SSE) and Secure Access Service Edge (SASE) models that give better visibility into network activity.
What is zero trust network access?
Zero trust network access (ZTNA) connects a verified user on a checked device to one specific application. The rest of the network stays out of reach. NIST SP 800-207, the federal reference architecture for zero trust, describes the premise as "no implicit trust granted to assets or user accounts based solely on their physical or network location." Authentication and authorization happen before each session to a resource begins.
Most ZTNA services work the same basic way. A small agent runs on the laptop. A cloud broker checks who the user is, whether the device meets policy and what that person is allowed to reach. A connector inside the office or cloud environment makes an outbound link to the broker, so the office no longer needs an inbound port open to the internet. A project manager gets the project server and the accounting system. A subconsultant gets one folder. Neither sees the rest of the network.
Zero trust vs VPN: how is day-to-day use different?
For most users, zero trust is simpler than a VPN: there is no separate connect button, and access follows them from the office to home to the jobsite trailer. The bigger change is on the administration side.
- Access is granted per application and per role.
- Device health checks can block a laptop that is missing updates or encryption.
- Every connection is logged with the user, device and application, which makes investigations faster.
- Removing a departing employee or a finished subconsultant is one change in one place.
Will ZTNA make large Revit and CAD files open faster?
Not by itself. ZTNA controls who can reach a file server; it does not change how much data has to cross a home or jobsite internet connection. If central models live on an office file server, remote users will still feel the size of those files. Test with real project files during the pilot. Firms already moving project data to cloud storage or a cloud file system can use ZTNA to protect the applications that remain on premises, such as license servers and accounting systems.
Can ZTNA meet NIST SP 800-171 remote access requirements?
Yes, if it is designed and documented for them. The remote access requirements in NIST SP 800-171 do not name a technology, so a ZTNA design can be mapped to each one. NIST SP 800-171 Rev. 2 requirement 3.1.12 says to "monitor and control remote access sessions," 3.1.13 calls for cryptographic protection of remote access sessions, and 3.1.14 says to "route remote access via managed access control points." Requirement 3.5.3 calls for multifactor authentication for network access. The CMMC program rule at 32 CFR 170.2 incorporates Rev. 2 by reference. If you hold controlled unclassified information, describe the ZTNA broker, policies and logs in your system security plan so an assessor can follow how each requirement is met. For the wider picture, see which NIST 800-171 gaps to close first for your SPRS score.
How do you replace a VPN with zero trust, step by step?
Replace the VPN in stages: plan around what people actually use it for, and run both side by side until the new path is proven.
- Inventory every resource reached over the VPN today: file shares, license servers, accounting and project management systems, plotters and remote desktops. This builds on the asset and software inventory in CIS Controls 1 and 2.
- Group users by role, such as office staff, project managers, field superintendents, IT and outside subconsultants, and write down what each group needs.
- Fix identity first. Require multifactor authentication for every account and phishing-resistant methods for administrators, and enroll firm laptops in device management.
- Choose a ZTNA service that supports per-application policies, device posture checks, exportable logs and your mix of Windows and Mac devices.
- Pilot with one team, including at least one person who works from a jobsite.
- Publish applications one at a time, starting with the simplest, and confirm each works before moving on.
- Run the VPN and ZTNA in parallel for a set period, then disable VPN accounts group by group.
- Retire the VPN: close the inbound ports, remove the appliance from the internet and update your network diagram and policies.
- Review access logs and role assignments monthly, and remove access for finished projects and departed staff.
What should an AEC firm do this quarter?
- Confirm your current VPN appliance is on a supported version and fully patched while you plan.
- Build the resource and user-group inventory from steps 1 and 2.
- Close multifactor authentication gaps on every account.
- Pick a pilot team and set a target date to turn off the VPN.
- If you work on defense contracts, schedule a system security plan update for the new design.
How s90 helps
s90 designs and runs Zero Trust Network Access for AEC firms, from the resource inventory through the pilot, the parallel run and the day the VPN comes down. We set per-project and per-role access, connect device health checks to your laptops, and give subconsultants scoped access that ends when the project does. If you are weighing a VPN replacement, we are glad to walk through what the move would look like for your offices and jobsites.
