• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

My TechDecisions

  • Best of Tech Decisions
  • Topics
    • Video
    • Audio
    • Mobility
    • Unified Communications
    • IT Infrastructure
    • Network Security
    • Physical Security
    • Facility
    • Compliance
  • RFP Resources
  • Resources
  • Podcasts
  • Project of the Week
  • About Us
    SEARCH
IT Infrastructure, Network Security, News

First Steps to Take for Zero Trust Implementation

Implementing zero trust policies can seem like a daunting task, but IT leaders should begin with these first steps.

May 23, 2023 Zachary Comeau Leave a Comment

Zero Trust
stock.adobe.com/Olivier Le Moal

Zero trust has emerged as a key IT security policy that is designed to help organizations be more secure by essentially assuming a breach has already occurred and requiring a user, device, application and transaction to be authenticated and verified each time they access an application, not just at the network perimeter.

However, implementing zero trust can seem like a daunting task given how zero trust is a policy and not a tool or solution that can achieve that level of security all at once. An organization’s zero trust strategy should be constantly evolving and becoming more secure over time. There are a variety of different technologies and solutions that are designed to address zero trust principles, but there is not one solution that achieves them all.

That’s why we spoke to Chalan Aras, managing director of Deloitte’s Cyber and Strategic Risk unit, about where organizations should begin on their zero-trust journey. The interview comes after Deloitte released the results of a survey on challenges of zero trust adoption, which found that compatibility issues with legacy systems is the greatest challenge to zero trust adoption.

Solving those complex issues and implementing zero trust can seem challenging, but IT leaders can begin their organization’s zero trust journey and take first steps in a few key areas, Aras says.

Assess the current infrastructure

According to Aras, organizations should begin by assessing their current IT infrastructure, which has undoubtedly changed and become more complex over the last few years as organizations adopted cloud solutions in response to the pandemic and remote work.

In addition, changes to company structure such as mergers, growth or divestitures can make IT environments even more complex. This mix of legacy systems and cloud technologies makes visibility so much more important, Aras says.

“Not every IT leader has a full picture of what they have,” Aras says. “I think it’s a good investment of time and resources to get a basic landscape of where you are.”

In addition to zero trust considerations, assessing the current IT environment can give IT leaders a better sense of where security gaps exist, which can be addressed before embarking on a zero-trust journey.

Identity and access management

After developing an overview of the current IT infrastructure, a good place to start implementing zero trust policies is identity and access management. According to Aras, zero trust is heavily driven by securing identities, but IT’s first step should be defining those users and assign them profiles and groups based on level of access.

Aras calls that work a “foundational element” of zero trust architecture. Deloitte’s survey also found that identity and access management was the second most important priority when implementing zero trust. First was data security, but Aras calls data insecurity the consequence of insecure identities.

Controlling and securing identities allows for better data security to control access to that data.

“Before the pandemic, you didn’t know who was doing what, and people could be copying and downloading valuable enterprise data,” Aras says. “Data security is the outcome, but to get there, you need identity and access management.”

Identity profiling, role definitions and application mapping should then be implemented on a modern identity system, Aras says.

VPN elimination

Virtual private networks (VPNs) were once thought to be a viable secure remote access solution for enterprises, but they can’t scale or provide sufficient security for distributed workforces, experts say. That’s why Aras says eliminating VPNs in favor of zero trust-based access is a common first step in implementing zero trust.

According to Palo Alto Networks, VPNs were designed to grant complete access to a LAN via a private, encrypted tunnel for remote employees to connect to the corporate network. However, this then gives a user access to anything on the network, leading to security gaps and policy enforcement issues, as well as a lack of visibility into a user’s access.

IT analyst firm Gartner, for example, says Zero Trust Network Access (ZTNA) is quickly eliminating the need for VPNs for secure access, with the analyst firm predicting that by 2025, 70% of new remote access deployments will be served by ZTNA compared to VPN services.

“VPN elimination to zero trust-based access tends to be a very high-value first change,” Aras says. “At that moment you gain better visibility and you can apply things like continuous authorization and reviews, and you can apply fine-grained policies.”

Where SASE fits in

Much has been made of secure access service edge (SASE) deployments in recent headlines as tech vendors begin to release all-in-one, single-vendor SASE solutions designed to take the complexity out of the equation.

While zero trust is a strategy or policy designed to eliminate automatic trust from a network by scrutinizing access at a granular level, SASE is the technical framework with which organizations can move closer to zero trust network access (ZTNA), Aras says.

According to Gartner, SASE delivers converged network and security as a service capabilities, including SD-WAN, SWG< CASB, NGFW, and of course, ZTNA.

“SASE is primarily delivered as a service and enables zero trust access based on the identity of the device or entity, combined with real-time context and security and compliance policies,” Gartner says.

From there, organizations can begin to think about application segmentation and other more advanced actions.

Zero trust is a journey

With threat landscapes and IT environments constantly changing, organizations should not be complacent in their current stage of zero trust implementation. However, before they take thier first steps in implementing zero trust, IT leaders need to understand they can’t make these sweeping changes overnight.

“It is a multi-part journey,” Aras says, adding that IT leaders must also consider the end-user impact of zero trust implementations.

Alongside end users, IT leaders must also consider their organizations’ business needs as the organization grows.

For example, a business could begin working with more third parties, service providers or vendors that need some level of access, thus requiring zero trust to be applied to that growing complexity.

“Part of the journey is understanding how your business operates within this next context and applying zero trust to your current needs,” Aras says.

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!

Tagged With: Cybersecurity, Zero Trust

Related Content:

  • Cloud, SASE, Aryaka How the Cloud is Redefining Media Production and…
  • Singlewire Software mass notification interview Singlewire Software on Mass Notification Solutions
  • URI catchbox 1 Catchbox Plus: The Mic Solution That Finally Gave…
  • Engaging virtual meeting with diverse participants discussing creative ideas in a bright office space during daylight hours Diversified Survey: Workplace AV Tech is Falling Short,…

Free downloadable guide you may like:

  • Practical Design Guide for Office SpacesPractical Design Guide for Office Spaces

    Recent Gartner research shows that workers prefer to return to the office for in-person meetings for relevant milestones, as well as for face-to-face time with co-workers. When designing the office spaces — and meeting spaces in particular — enabling that connection between co-workers is crucial. But introducing the right collaboration technology in meeting spaces can […]

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Latest Downloads

Practical Design Guide for Office Spaces
Practical Design Guide for Office Spaces

Recent Gartner research shows that workers prefer to return to the office for in-person meetings for relevant milestones, as well as for face-to-fa...

New Camera Can Transform Your Live Production Workflow
New Camera System Can Transform Your Live Production Workflow

Sony's HXC-FZ90 studio camera system combines flexibility and exceptional image quality with entry-level pricing.

Creating Great User Experience and Ultimate Flexibility with Clickshare

Working and collaborating in any office environment today should be meaningful, as workers today go to office for very specific reasons. When desig...

View All Downloads

Would you like your latest project featured on TechDecisions as Project of the Week?

Apply Today!

More from Our Sister Publications

Get the latest news about AV integrators and Security installers from our sister publications:

Commercial IntegratorSecurity Sales

AV-iQ

Footer

TechDecisions

  • Home
  • Welcome to TechDecisions
  • Contact Us
  • Comment Guidelines
  • RSS Feeds
  • Twitter
  • Facebook
  • Linkedin

Free Technology Guides

FREE Downloadable resources from TechDecisions provide timely insight into the issues that IT, A/V, and Security end-users, managers, and decision makers are facing in commercial, corporate, education, institutional, and other vertical markets

View all Guides
TD Project of the Week

Get your latest project featured on TechDecisions Project of the Week. Submit your work once and it will be eligible for all upcoming weeks.

Enter Today!
Emerald Logo
ABOUTCAREERSAUTHORIZED SERVICE PROVIDERSYour Privacy ChoicesTERMS OF USEPRIVACY POLICY

© 2025 Emerald X, LLC. All rights reserved.