This is the core belief to the Zero Trust security strategy. Unlike other models, it doesn’t assume trust for anyone, including existing users. It’s a proactive approach which limits access to data, networks or resources for everyone (and everything), internally and externally. It demands continuous verification for every transaction within all digital estate layers.
Microsoft offers various products and protections built upon the Zero Trust model, across the Microsoft 365 and Azure suites, including Microsoft Sentinel, Azure Defender, Azure Firewall, Web Application Firewall, to name a few.
You can implement Zero Trust security for your business by following the three core principles and choosing the most relevant technologies below:
- Verify explicitly. Always validate and authorise based on all available data points. Use as many attributes as possible when granting or denying access. For instance, location, endpoint, device, workload, etc. The multi-factor and continuous verification help to minimise the risk of each user gaining access to sensitive data they shouldn’t. You can boost your verification processes and criteria using Azure AD Conditional Access, Privileged Identity Management and Just-In-Time (JIT) access technologies from Microsoft.
- Use least privilege access. Limit user access with Just-In-Time (JIT) and Just-Enough-Access (JEA), risk-based adaptive policies, and data protection. Essentially, it only gives people the necessary to do their jobs, not more. The key is to apply it across all levels, like on-premises infrastructure, endpoints, and Windows workstations. You can control this granular level of permissions using role-based access control (RBAC) within Azure and the broader Microsoft cloud stack.
- Assume breach. Segment access to minimise destruction. By appreciating that all defences eventually fail, you can reduce a failure’s impact. Think of it like the blast doors or flood defences. By segmenting a network, you can effectively box in an attacker and prevent lateral damage.
Limit the damage by verifying end-to-end encryption and using analytics to see threats, drive threat detection, and improve defences. You can limit or segment through Azure network access control and use Microsoft Defender Threat Intelligence for analysis.
