Zero Trust on a budget
Nov 19th, 2019 by Jesper Kråkhede
After my posts about Zero Trust I have got a few questions from managers along the lines of: ‘Sounds great, what does it cost?’ Fair question. The answer is that it depends on where you start, but probably less than you think.
Zero Trust is not a product you buy. It is a way of building, and most companies already own a good part of the pieces. Identity platform, device management, logging. The problem is seldom the licenses, it is that the functions are not used.
So how should management approach it? Don´t start a big bang project with a three year plan and a hundred page report. Start where the risk is the highest: your admin accounts and your most sensitive data. Protect those first, measure the effect and move on. Every step should reduce a known risk, and if it doesn´t, skip it.
Make it a program, not a project. Give it a sponsor in management, a small yearly budget and a follow-up twice a year. Ask for simple metrics: How many admin accounts do we have? How many devices are managed? How much of our sensitive data is protected?
And please, don´t let the vendors sell you Zero Trust in a box. There is no such thing.
Do the right things first. The rest will follow.