The Comprehensive Playbook For Implementing Zero Trust Security

The Comprehensive Playbook for Implementing Zero Trust Security The Comprehensive Playbook for Implementing Zero Trust Security 2 IT and business leaders looking to secure their IT environments using a Zero Trust framework. This guide presents a comprehensive explanation of the Microsoft Zero Trust framework, along with specific steps to take in any or all of the six key areas of organisational security strategy. Contents

Making Zero Trust a reality with help from Microsoft Zero Trust fundamentals Identity Network Infrastructure Data Applications Endpoints Who this is for 3The Comprehensive Playbook for Implementing Zero Trust Security Why Zero Trust? Proliferating data and devices, growth in hybrid work and increasingly sophisticated attacks reduce the effectiveness of perimeter-based IT security. IT professionals manage an enormous variety of technologies. Businesses commonly use a mix of cloud and on-premises infrastructure, platforms and software. They may have multiple cloud providers and systems. Employees work on personal devices and can easily access cloud apps and services. Data exists in more places than ever before, which makes it more valuable, but also more vulnerable. In response, many organisations, including Microsoft, are adopting a Zero Trust security framework. Zero Trust is a proactive, integrated approach to security across all layers of the digital estate that explicitly and continuously verifies every transaction, asserts least privilege and relies on intelligence, advanced detection and real-time response to threats: • Verify explicitly: Always authenticate and authorise based on all available data points, including user identity, location, device health, service or workload, data classification and anomalies. • Use least-privileged access: Limit user access with just-in-time and just-enough-access (JIT/ JEA), risk-based adaptive polices and data protection to help secure both data and productivity. • Assume breach: Minimise blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection and improve defences. Modern threat protection is a critical component of all three areas, enabling organisations to detect attacks and anomalies, automatically block and flag risky behaviour, take protective actions and manage the growing influx of threat data. How easily an organisation can adopt these principles varies depending on its individual security challenges, needs and capabilities. In other words, the journey to Zero Trust is unique to your business. 4The Comprehensive Playbook for Implementing Zero Trust Security To help you get there faster, Microsoft has developed a flexible Zero Trust framework to guide adoption. It provides comprehensive guidance covering the six key risk areas addressed by Zero Trust: Automate risk detection and remediation and secure access to resources with strong authentication across the entire digital estate. Identity Reduce perimeter-based security vulnerabilities, including the need for VPNs, and improve scalability of security solutions for environments where the cloud is increasingly the centre of IT services. Network Defend the larger attack surface created by the growing number and diversity of endpoints using a flexible, integrated approach to management. Endpoints Protect hybrid infrastructure, including on-premises IT and cloud environments, with more efficient and automated management. Infrastructure Classify, label and protect data across cloud and on-premises environments to help prevent inappropriate sharing and reduce insider risks. Data Maintain highly secure employee access to cloud and mobile apps, as well as remote access to on-premises enterprise apps. Applications By adopting a Zero Trust framework in one or all of these areas, you can effectively modernise your security technology and processes, and start to maximise protection in the face of modern threats. However, each organisation will have different priorities depending on its current capabilities and the level of risk represented by a given security area. This guide makes it easy for you to get a broad overview of Zero Trust, as well as detailed information and actionable steps for your areas of focus.