The Correct Starting Point

One frequently asked question is, "Where should the journey to zero trust start?" Strictly speaking, the answer can be found in the systematic approach outlined above. The risk and gap analyses clearly show the most critical topics. IT teams need to prioritize these issues within the framework of budget availability, but at least one area is always going to be a good choice.

As Figure 1 shows, zero trust starts with identity and authentication. If not yet implemented, MFA is always going to be a good place to get the ball rolling because it is a central element of zero trust. The same applies to the development and expansion or modernization of IAM, which includes not only authentication, but also the management of all types of identities and user accounts, the control of access authorizations, and PBAM for dynamic access authorization.

On the other hand, you should also understand that no single solution will allow you to make zero trust architectures a reality. Even approaches such as ZTNA, where "zero trust" is part of the name, are only partial elements in this kind of solution. A differentiated assessment must be made as to whether and to what extent these elements are necessary.

Other sub-elements such as microsegmentation are important, as well, but by no means always necessary. For organizations that work with flexible working models and access from different locations, but only use cloud services and do not have internal IT, microsegmentation is irrelevant; however, it does play a role if many IT services are still operated internally in data centers.

Conclusions

Ultimately, besides IAM and MFA as the logical technical starting points, the correct entry point for zero trust is solution-oriented work, which helps you develop concrete and programmatic planning from an abstract, complex, and often diffuse strategy and implement the planning, step by step. One thing is clear: Zero trust is not outdated, but a model that will continue to shape cybersecurity in the coming years in concrete implementations long after the hype has disappeared.