Tegan Eikenberg — Cyber Security Analyst

What is Zero Trust?

Zero Trust is a security framework that operates on the principle of "never trust, always verify." Unlike traditional perimeter-based security models, Zero Trust assumes that threats can come from both inside and outside the network.

Core Principles

Verify Explicitly — Always authenticate and authorize based on all available data points, including user identity, location, device health, and the sensitivity of the resource being accessed.

Use Least Privilege Access — Limit user access with just-in-time and just-enough-access policies. Reduce the blast radius of any single compromised account.

Assume Breach — Segment access, verify end-to-end encryption, and use analytics to detect anomalies. Don't assume your perimeter is secure.

Practical Implementation Steps

1. Identity Verification

Start with strong identity management. Multi-factor authentication (MFA) is non-negotiable. Consider implementing:

Conditional access policies based on risk signals
Passwordless authentication where possible
Regular access reviews and certification campaigns

2. Device Trust

Every device accessing your resources should be verified:

Endpoint detection and response (EDR) agents
Device compliance checks before granting access
Certificate-based authentication for managed devices

3. Micro-Segmentation

Break your network into isolated segments so that compromising one area doesn't give attackers lateral movement across the entire environment.

4. Continuous Monitoring

Zero Trust isn't a "set and forget" approach. Implement continuous monitoring with:

Real-time analytics on user behavior
Automated response to anomalous activity
Regular penetration testing to validate controls

Getting Started

You don't need to implement everything at once. Start with identity — get MFA deployed everywhere, implement conditional access, and build from there. Each layer you add reduces your attack surface.