Zero trust

What it means

Zero trust is a security approach in which no user, device or network is trusted automatically, even inside the company. Every access to data or an application is verified afresh each time based on identity, device health and context.

The traditional model protected the company like a castle with a wall: anyone inside the network, for example through a VPN, had access almost everywhere. With remote work, cloud services and attacks using stolen passwords this model fails, because an attacker who gets in can move around freely.

Zero trust rests on a few principles: strong identity verification with two-factor authentication, least-privilege access, dividing networks and systems into smaller segments, and continuous monitoring for suspicious activity.

How it works in practice

Even for a small company we recommend starting with simple zero trust steps: two-factor login to all key services, a password manager, separate accounts for everyday work and administration, and regular reviews of who has access to what.

In our firm we access client data through applications with individual authentication and access management by client and role. Each employee sees only what they are working on, and access changes immediately when a role changes or someone leaves.

For larger clients within the scope of NIS2, zero trust is part of the required security measures. We help them link the technical steps with the documentation and risk management the law demands.

What to watch out for

Zero trust is not a product you can buy but a way of designing access. A vendor promising zero trust in a single tool is oversimplifying. Without changing rules and habits, technology alone is not enough.

Settings that are too strict and ignore how people work lead staff to find workarounds, such as sending files through private email. Security and usability must be designed together, or the risk of an attack will not fall.