Technology finally supports the process
Aug 21st, 2022 by Jesper Kråkhede
I have written about Zero Trust on this blog since 2019. For a long time, the honest answer to ‘how do we do it?’ was a lot of policies, processes and manual work, with technology that only partly helped.
That has changed in the last couple of years, and I think management should know about it.
Today the technology actually supports the Zero Trust processes. Verify explicitly: Conditional Access checks user, device, location and risk on every logon, automatically. Least privilege: just in time access, access reviews and entitlement management handle what used to be spreadsheets and emails. Assume breach: the detection tools are connected, so an attack on one layer is seen in context and can be stopped automatically across several.
What this means for the business is that Zero Trust is no longer a big, expensive transformation programme that only the largest companies can afford. Many of the capabilities come with licences you may already have. The job is to configure them, connect them and build the processes around them.
It also means the organisation must change. When the technology can disable an account or isolate a machine automatically, someone needs to decide when it is allowed to. That is a management decision, not an IT decision.
The tools are ready. Are your processes?