How Zero Trust Helps Organizations Reduce Cyber Risks

• Security and compliancy

Zero Trust is a modern security concept in which nothing and no one is trusted by default. In other words: never trust, always verify. In practice, this means that all communication within your IT environment must be verified and monitored. In this blog, we examine how Zero Trust helps you reduce cyber risks and how identity and access management play a role.

What is Zero Trust?

The continuous control in Zero Trust fundamentally differs from security in traditional on-premises corporate networks. There, the focus is on logging in to the network. Once inside, users are implicitly trusted, and there is relatively a lot of room for so-called lateral movement. For example, a hacker gains entry through an email account and can then reach other systems from there.

Perimeter security has its limitations, and in cloud environments, that network boundary is absent altogether. Applications and data can, in principle, be hosted anywhere and be directly accessible over the internet, from any location and on different devices. Applications can also exchange data independently.

That requires a completely different approach. You want to control all communication end-to-end between users and systems, and between systems themselves. They must also receive only the rights needed for the prescribed tasks. This is known as the 'Principle of Least Privilege'.

Why Zero Trust is Relevant Now

The relevance of Zero Trust can be traced directly to the large-scale adoption of cloud services. Cloud environments are also becoming more complex, larger, and therefore more vulnerable. According to the CBS, in 2024, already 71% of Dutch companies with more than 10 employees used cloud services. Among larger companies, the percentages are even higher: 75% for companies with more than 50 employees and even 91% for companies with more than 250 employees.

For securing these environments, traditional network security no longer suffices. Attention must increasingly shift to controlling every individual link in the service chain. Nearly every cyberattack today consists of multiple steps that together form the 'kill chain'. The most recent data breach report by the Dutch Data Protection Authority shows, for example, that 42% of all cyberattacks start with an account takeover. This happens in increasingly inventive ways, including through smart phishing tricks and software vulnerabilities. Once inside, a compromised account then serves as a springboard for other criminal activities, such as deploying ransomware to connected systems.

Only by controlling and monitoring all interactions can you prevent lateral attacks or limit their impact. That is why Zero Trust as a guiding principle is so important today.

Why Zero Trust Matters in Every Sector

This makes Zero Trust essential for every industry or sector. At the same time, each industry has its own focus areas.

Healthcare

In healthcare, Zero Trust is crucial because you handle sensitive patient and client data. This data must be immediately available to caregivers when needed, yet must be protected against misuse as much as possible. This takes place in a hectic environment where a wide range of caregivers are active, from permanent staff to temporary workers and interns, and where intensive collaboration between different healthcare institutions is also underway. Zero Trust aligns with this by explicitly verifying every access attempt based on identity, role, and context. As a result, healthcare professionals receive access only to the data they need at that moment to treat their patients or clients. Moreover, Zero Trust supports better logging and auditing, which is essential for compliance with standards such as NEN 7510 and HIPAA.

Government

In government organizations, traditional security models increasingly fail to fit the complex, fragmented digital environment in which employees must do their work. Public sector agencies handle large volumes of sensitive citizen and business data, while access is spread across ministries, municipalities, executive agencies, and external chain partners. This creates risks such as unauthorized access, outdated entitlements, and insufficient insight into who consults which data and why. Zero Trust helps reduce these risks by assuming continuous verification of users, devices, and access rights, regardless of where someone is located or which organization they work for. Moreover, Zero Trust meets the stringent requirements for compliance, auditing, and accountability in government.

Education

In education, the traditional security approach has also become too limited. Educational institutions are dynamic. Students progress periodically to the next year, semester, or a different program. Teachers and support staff also frequently change roles, often combining multiple functions, and institutions regularly use guest lecturers and substitutes. This pace increases the risk of outdated accounts, excessive authorizations, and uncontrolled access to personal data or research data. Zero Trust helps reduce these risks by not automatically trusting network access, but by continuously verifying every user, session, and device. This is especially relevant in an environment where faculties and programs operate relatively autonomously and often adopt new cloud applications on an ad hoc basis.

The Most Important Benefits of Zero Trust

With a Zero Trust approach, organizations are better prepared for continued digitization, with the intensive use of cloud applications accessible everywhere and on all kinds of devices. Zero Trust delivers several important benefits:

1. We improve authentication and access security. We do this with methods such as Multifactor Authentication, passkeys, and digital certificates, supported by context information such as the device used, the access network, and other user context. Access becomes more secure without sacrificing usability.

2. We will operate increasingly in an adaptive way. When traffic, access, and behavior are continuously monitored and analyzed, anomalies are detected faster, allowing us to respond in time. We can even interrupt activities during a user session or trigger an extra verification step.

3. We limit the impact of cyber incidents. If people have access only to strictly necessary functionality and data, it becomes more difficult to exfiltrate large volumes of data unnoticed, for example. Or to spread ransomware from one compromised system to adjacent systems.

4. We advance our identity governance. Every access attempt and policy decision is recorded. This helps with audits and compliance with frameworks such as ISO 27001, NIS2, GDPR, or DORA. We can also continuously improve information security based on the latest data.

Implementation Challenges

It is important to recognize that Zero Trust is not the rollout of a single product. It is a security strategy in which access is continuously checked based on identity, context, and the principle of least privilege. Its implementation spans multiple domains, but our focus is on identity and access management. For that, we collected several practical tips:

• Organize your identity lifecycle management. Zero Trust requires that users have the correct entitlements at all times, depending on the role they are performing at that moment. Your access management must therefore be updated as roles change. With user provisioning, you can automate the lifecycle from onboarding to termination.

• Apply the 'Principle of Least Privilege' when creating business rules to automate user provisioning. With tools such as role mining, you can design a role model so that everyone has exactly the right privileges throughout the entire lifecycle. This prevents users from becoming overprivileged.

• Apply Segregation of Duties (SoD). At the organizational level, you use this mechanism to prevent individuals from having excessive rights or to ensure sufficient control over their activities. With toxic policy management, you can similarly prevent the issuance of conflicting access rights within your role model.

• Manage exceptions carefully. Not all access rights can be granted automatically based on business rules. With service automation, you ensure that individual change requests are also managed properly. This includes not only the request and fulfillment of rights, but also their periodic recertification.

• Periodically clean up your access rights management. Even with well-organized rights management, clutter can arise. Sometimes, that is legacy from the time account and rights management were not yet streamlined. It can also simply be a forgotten test account. With tools such as reconciliation, you also work toward a 'Zero Trash' policy. 😉