Zero Trust for technology leaders: start with access decisions

Zero Trust changes the security question: rather than trusting a connection because it is inside a network, assess who is requesting access, to which resource and under what conditions. NIST SP 800-207 focuses on users, assets and resources without granting implicit trust solely because of their location.

Start with a specific resource

A first engagement could focus on administrator access to a critical application. Identify its users, service accounts, devices and dependencies. Record who approves each permission and how access is revoked. This map gives the team a scope it can verify and maintain.

For example, an administrator may need to change a configuration during a maintenance window without retaining permanent access to every application. Defining that need before selecting tools makes the policy clearer.

Verify and limit access

Explicit verification, least privilege and designing for a possible breach are the principles summarised by Microsoft. Review shared accounts, unnecessary privileges and exceptions without an owner. Stronger authentication should be paired with permissions appropriate to the task.

Segmentation helps constrain communications, but does not replace decisions about identity and resource authorisation.

Design operations and recovery

A policy also needs procedures for legitimate lockouts, lost devices and emergency access recovery. The team should know who can approve an exception and when it must be reviewed.

Before expanding, rehearse an everyday case and a failure case. Check that the available evidence explains why access was allowed or rejected.

Measure a verifiable change

A useful first result is one application with identified owners, reviewed permissions and a tested recovery procedure. Extend the approach when the team can operate it reliably.

Explore our Identity & Access Management approach to connect identities, permissions and business needs.