What should Zero Trust do after all? Explanation of practical steps to start in the field

Translated from 日本語 • View original

西田

Hello, this is Nishida from Colorkrew Security. The word "Zero Trust" is heard everywhere these days. But in the field, I often hear voices like this.

"What should Zero Trust do in the end?"
"If I put a product in it, will it become Zero Trust?"
"It doesn't seem to have anything to do with my company."

There are actually many misunderstandings about this topic.
Zero trust is not a specific product, but a way of thinking and how it works.
And regardless of the size of the company, there is a "first step that can be done right now".

1. Instead of "don't trust", "always verify"

The literal translation of "Zero Trust" in Zero Trust is "not trusting".
However, the essence is the idea that "once you give permission, you will not continue to trust forever".

The security model used to look like this:

Secure internal network
Outside the company (Internet) is dangerous
Once you log in, you can use it freely

However, now that cloud usage and remote work are progressing,
The very concept of "boundary (permitter)" is collapsing.

That's why we always verify who is accessing it, on which device, and under what situation.
This is the core idea of Zero Trust.

2. The Three Pillars of Zero Trust

It is said that "Zero Trust = abolition of boundaries",
What you actually need to do can be simply organized into the following three areas.

(1) Protecting Identity

It is a mechanism that reliably checks "who is accessing".

Thorough multi-factor authentication (MFA)
Conditional access (trusted terminals and location control)
Account Least Privilege (Just-In-Time / Just-Enough Access)

(2) Device and Network Control

We continuously verify what kind of device and what channel they are accessing from.

Device management with MDM, Intune, etc.
Secure Web Gateway (ZTNA)
Network visibility and anomaly detection (Firewall, IDPS)

(3) Data Protection and Usage Audit

Constantly monitor what information is used and how.

Data Loss Prevention (DLP) to prevent information leakage
Audit of cloud storage sharing settings
Log analysis detects unauthorized manipulation and suspicious access

3. The easier it is to start with companies that think "we are still early"

Zero Trust is not about "aiming for a complete form."
The key is to structure trust verification, even if only partially.

For example:

Start by implementing MFA across all your internal systems
Regularly take inventory of who has access to critical data
Control access from external terminals with conditional access

This alone is the first step towards Zero Trust.
Even if you are not a large company, it is rather essential as cloud usage progresses.

4. Zero Trust Pitfalls: Tool Adoption = Not "Realization"

Here are some common misconceptions.

"Now that MFA has been put in, we have completed Zero Trust support"
"Now that I have included SWG and ZTNA products, I can rest assured."

Tools are "means", not "design".
What you really need is:

Which access to trust (policy)
Who will run it (responsible)
How to continuously verify and update (process)

This is the governance mechanism.

Zero Trust is not about "building and finishing" security.
It is a way of thinking that aims for an operation model that "constantly verifies".

5. Colorkrew Security's Approach

At Colorkrew Security, we support "Zero Trust design optimized for each cloud environment."

**Zero Trust is not about not trusting, but about "confirming" trust. **
We will support you in creating such a system, including monitoring.