Zero Trust Security: Don’t Leave Your Network Exposed!

Zero Trust Security mandates verification for every access request, applying the least privilege and assuming a breach. This approach ensures that no user, whether inside or outside the network, is automatically trusted. By verifying each user, device, and application accessing sensitive resources, Zero Trust Security strengthens protection. Organisations must adopt this strategy to secure their operations in today’s complex digital environments.

Its foundation rests on several principles to improve your security: 

• Explicit Verification: All access attempts are authenticated and authorised based on a comprehensive set of data points, including user identity, location, device health, service or workload, data classification, and anomalies. 
• The Least Privilege Access: Access is restricted to the bare minimum necessary using techniques such as just-in-time and just-enough access (JIT/JEA), risk-based adaptive policies, and data protection measures, thus securing both data and productivity. 
• Assume Breach: To minimise the impact of potential breaches, access is segmented, and the blast radius is reduced. End-to-end encryption is verified, and analytics are utilised for visibility, threat detection, and defence enhancement. 

Zero Trust extends across six core elements: 

• Identities: People, services, and IoT components are verified and authorised based on multiple data points, such as user identity, location, and device health. 
• Devices: Endpoints accessing the network are monitored for compliance with device health standards and updated regularly. 
• Apps and APIs: Applications and services running on the network are secured with appropriate permissions, configurations, and vulnerability scans. 
• Data: Information flowing through the network is protected using encryption, classification, and access policies, while anomalies are monitored. 
• Infrastructure: Physical and virtual resources hosting the network are hardened against attacks and segmented to minimise breach impact. 
• Networks: Connections between elements are controlled using segmentation, encryption, and analysis, and verified end-to-end. 

This approach require a comprehensive and integrated security strategy encompassing the entire digital infrastructure. 

Some benefits of Zero Trust security include: 

• Enhanced Employee Experience: Employees can securely work from any location and on any device. 
• Facilitated Digital Transformation: Intelligent security supports complex and hybrid environments. 
• Reduced Vulnerabilities: Granular policies and closed security gaps minimise security risks and lateral movement. 
• Protection from Threats: Layered defence explicitly verifies all access requests, safeguarding against internal and external threats. 
• Regulatory Compliance: Helps comply with evolving regulatory requirements by offering a consistent and transparent data protection strategy. 

How does it work in Office 365? 

Zero-trust works in Office 365 by applying the following security capabilities: 

• Conditional Access: This allows you to enforce granular policies based on user, device, app, location, and risk factors. For example, you can require multifactor authentication, device compliance, or app protection for accessing specific resources or data. 
• App protection policies: This allows you to protect the data within Office 365 apps on mobile devices, such as Outlook, Word, Excel, etc. For example, you can restrict copy-paste, screen capture, or external sharing of sensitive data. 
• Device compliance policies: This allows you to check the health and compliance status of devices that access Office 365. For example, you can require devices to have a PIN, encryption, antivirus, or latest updates. 
• Microsoft Defender for Office 365: This provides threat protection and intelligence for Office 365 apps and services, such as email, SharePoint, Teams, etc. For example, it can detect and block phishing, malware, ransomware, or spoofing attacks. 

How to apply Zero Trust principles to Azure infrastructure as a service (IaaS)?  

Zero Trust in the context of Infrastructure as a Service (IaaS) in Azure refers to a security model where no implicit trust is granted to assets based on their location (inside or outside the network) or on their identity (whether they are external or internal users).  

In a traditional security model, once someone gains access to the network, they might be trusted to access various resources within that network.  

Zero Trust, on the other hand, assumes that threats could come from both inside and outside the network, and thus, trust should not be granted based solely on the user’s location or identity. 

In Azure IaaS, Zero Trust is implemented through various security measures and technologies: 

• Identity and Access Management (IAM): Azure Active Directory (AAD) is often used to manage user identities and their access to Azure resources. With Zero Trust, access controls are enforced based on a user’s identity, their role, and other contextual factors such as the device being used and the location from which the access is attempted. 
• Multi-Factor Authentication (MFA): MFA adds an extra layer of security by requiring users to provide multiple forms of authentication before granting access. This could include something they know (like a password) and something they have (like a mobile device for receiving a verification code). 
• Conditional Access Policies: Azure allows administrators to define policies that control access to resources based on certain conditions, such as the user’s location, device health, or the sensitivity of the resource being accessed. This ensures that access is granted only when specific conditions are met. 
• Network Segmentation: Azure Virtual Networks (VNETs) can be segmented into smaller, isolated networks using Network Security Groups (NSGs) and Virtual Network Service Endpoints (VNET service endpoints). This helps in minimising the attack surface and containing potential breaches within specific segments of the network. 
• Encryption: Azure offers various encryption options to protect data both at rest and in transit. This includes Azure Disk Encryption for encrypting virtual machine disks, Azure Storage Service Encryption for encrypting data stored in Azure Storage, and Azure VPN Gateway for encrypted communication between virtual networks. 
• Continuous Monitoring and Threat Detection: Azure Security Center provides continuous monitoring of Azure resources and detects potential security threats using advanced analytics and machine learning algorithms. It can identify suspicious activities and recommend actions to mitigate risks. 
• Just-In-Time (JIT) Access: Azure Security Center allows administrators to restrict access to Azure VMs by enabling JIT access. This means that access to VMs is only granted when needed and for a limited time window, reducing the attack surface and minimising the risk of unauthorised access. 

What are the key success factors to set-up a Zero Trust Model in your company? 

Instead of assuming everything behind the corporate firewall is safe, the Zero Trust model assumes breach and verifies each request as though it originates from an open network.  

Regardless of where the request originates or what resource it accesses, Zero Trust teaches us to “never trust, always verify.” Every access request is fully authenticated, authorised, and encrypted before granting access. Microsegmentation and least-privilege access principles are applied to minimise lateral movement. Rich intelligence and analytics are utilised to detect and respond to anomalies in real time. 

For example:  

Zero Trust Security should encompass your entire digital environment. This includes all identities, endpoints, networks, data, applications, and infrastructure. Zero Trust architecture is not a single-layered solution but a complete end-to-end plan requiring integration across these elements.

Comprehensive zero trust coverage

Zero Trust Security should cover your entire digital environment, including identities, endpoints, networks, data, applications, and infrastructure. This approach is an end-to-end plan that integrates across all elements, ensuring that no component is left unprotected.

At its core, Zero Trust is centred on identities—both human and non-human. These identities must be authorised through strong security measures, whether accessing from personal or corporate endpoints. Each access request is based on explicit verification, least-privilege access, and the assumption that a breach may already have occurred.

Ongoing optimisation and governance

Continuous policy optimisation is key to maintaining strong Zero Trust Security. Telemetry and threat intelligence provide real-time feedback, enabling policy adjustments and ensuring a robust security posture. Additionally, runtime controls, adaptive access policies, and version control protect infrastructure, including serverless environments, containers, and IaaS/PaaS.

Unified enforcement and real-time risk management

Zero Trust Security enforces policies that monitor access requests across six key elements: identities, devices, apps, data, infrastructure, and networks. By applying real-time risk assessments, the system automatically adjusts protection measures. As a result, businesses maintain security even during ongoing access sessions.

Continuous feedback loop for enhanced security

Finally, telemetry and analytics provide a continuous feedback loop that optimises security over time. Zero Trust Security adapts to new threats and evolving environments, ensuring organisations remain protected in the face of constant digital change.