What is Zero Trust?
Zero Trust is neither a technology nor a framework – it is a strategy built on three core principles:
- Verify every access request – no user, device or application should be granted implicit trust.
- Limit access according to the principle of least privilege.
- Assume a breach has already occurred – and act accordingly.
The strategy is based on the understanding that threats may exist both outside and inside the organisation. Therefore, every access request must be verified, authenticated and logged, regardless of its source or location.
Why Zero Trust is necessary now
Bring Your Own Device (BYOD), remote working, phishing attacks, cloud applications and increasingly complex supply chains have rendered traditional perimeter security obsolete. A leaked credential or an exposed API key can provide attackers with access to critical systems.
By adopting a Zero Trust approach to your infrastructure, you reduce the risk of lateral movement – that is, an attacker progressing further within your environment after gaining an initial foothold. You may not be able to prevent every breach, but you can make it significantly harder for attackers to move freely and minimise the impact of any compromise.
How to implement Zero Trust in practice
1. Identify and map assets
If you do not already have complete visibility, start by inventorying users, devices, systems and data flows. You cannot protect what you do not know exists.
2. Strengthen identity and access management
Implement multi-factor authentication (MFA) wherever possible (and avoid using SMS as an MFA method). Use Privileged Access Workstations (PAWs) for administrators. The additional hardware cost is negligible compared to the potential damage caused by a successful breach.
Manage access through an Identity Provider (IdP) and Single Sign-On (SSO). Phase out application-specific authentication solutions wherever possible.
3. Segment the network
Divide networks into zones based on risk level or usage. Restrict lateral movement through micro-segmentation, particularly in cloud and OT/ICS environments. Smaller segments result in lower risk.
4. Continuous verification and monitoring
Implement SIEM and SOC capabilities for real-time monitoring. Analyse logs using User and Entity Behaviour Analytics (UEBA) to detect suspicious activity.
5. Encrypt and protect data
Encrypt data both at rest and in transit – including within the organisation’s internal network. Ensure that only authorised users can decrypt sensitive information.
6. Automate response and recovery
Integrate monitoring systems with automated incident response capabilities (SOAR). Test processes regularly through red team exercises.
Organisational measures
- Establish a CISO function with the necessary authority and budget.
- Integrate your Zero Trust strategy into the organisation’s wider cyber security and risk management strategies.
- Educate users – Zero Trust only works when everyone understands why security requirements are stringent.
- Ensure that suppliers and third parties follow the same principles.
Technical quick wins
- Enable MFA across all cloud services (Microsoft Azure/Microsoft 365, Google Workspace, etc.).
- Eliminate shared accounts and implement Just-in-Time (JIT) access, particularly for administrative accounts.
- Deploy Endpoint Detection and Response (EDR) across all endpoints.
- Use Conditional Access Policies to block high-risk sign-in attempts.