Zero Trust for an SMB: where to start without rebuilding everything

Zero Trust fits in one sentence: never trust by default, always verify. Not a user because they are in the office, not a device because it is on the internal network, not an application because it worked yesterday. The term tends to worry SMB owners, because it is often sold as a large transformation programme. In practice it is delivered through five successive workstreams, without replacing what you have, and largely with tools the business already owns. Here is the order we follow, what each workstream changes, and the mistakes that waste time.

Why the perimeter no longer protects

The classic model, a firewall at the entrance and full trust inside, dates from a time when everything lived within the walls. Today email and files sit in Microsoft 365, staff work from home or at client sites, providers connect remotely, and a single password stolen through phishing opens everything. Almost every ransomware attack we describe in ransomware: 7 measures for an SMB exploits that implicit trust: once inside, the attacker moves freely to the servers and the backups.

Zero Trust does not remove the firewall. It adds checks at every step: who is connecting, from which device, to which resource, and with what rights.

The three principles to remember

• Verify explicitly: every connection is assessed on identity, device state, location and how sensitive the resource is.
• Grant least privilege: users reach what they need to work, not the whole network.
• Assume breach: the system is organised so that one infected laptop or one stolen account is not enough to bring everything down.

These principles translate into five workstreams, to be run in order, because each builds on the previous one.

Workstream 1. Identity, with MFA everywhere

Identity is the new perimeter. Two-factor authentication on every account, with no exception for leadership, blocks the large majority of account compromises on its own. Priority goes to administrator accounts, email, the VPN and management consoles (firewall, backup, hosting). We detail the rollout in our enterprise MFA guide.

Three essential additions:

• a business password manager, so every account has a unique password;
• removing shared accounts (“accounts@”, “reception@” used with a password everyone knows), replaced by shared mailboxes or named access;
• disabling legacy email protocols that bypass MFA.

Workstream 2. Compliant devices, or no access

A device without current protection, disk encryption or the latest patches should not reach company data. An EDR replaces classic antivirus: it detects suspicious behaviour and reports each machine’s state (see EDR or antivirus for an SMB).

With Microsoft Intune, included in Business Premium, every device is enrolled, configured the same way and flagged “compliant” or not against simple rules: encrypted disk, up-to-date system, local firewall on, EDR present. That compliance becomes the access condition in the next workstream. Phones that read business email are in scope too, at minimum with app protection policies.

Workstream 3. Conditional access

Once identity and devices are under control, Microsoft 365 conditional access rules decide case by case. A few rules we set almost every time:

• sign-in from a country where the business has no activity: blocked;
• unmanaged device: read-only access in the browser, no downloads;
• tenant administration: MFA on every sign-in, from a compliant device only;
• legacy authentication protocols: blocked for everyone.

These rules come with Business Premium, compared with the other plans in our Microsoft 365 licensing article. They are first rolled out in “report-only” mode to measure their effect, then switched on with no surprises for users.

Workstream 4. Segment the network

The internal network no longer has to be a single trust zone. On a FortiGate or WatchGuard firewall, separating endpoints, servers, telephony, printers, cameras and guest WiFi into distinct networks, with explicit rules between them, stops ransomware on one laptop from reaching the servers and backups. Cameras and printers, rarely updated, have no reason to talk to the file server, for instance.

It is the most technical workstream, and the one that limits damage the most on the day it matters. It starts with a map of flows: who needs to talk to whom, on which ports. The baseline firewall settings to check are covered in 10 FortiGate security settings after install.

Workstream 5. Remote access without an open VPN

A traditional VPN grants access to the whole network once connected. ZTNA (Zero Trust Network Access), available on FortiGate and offered by WatchGuard, opens only the requested application, after checking identity and device state. A provider maintaining a business application reaches that one server, and only for the agreed window. This workstream removes a classic entry point for attackers: the VPN portal exposed to the internet.

In what order, and with what effort

Workstream	What it blocks	Prerequisite	User effort
MFA and password manager	Stolen or reused password	Account inventory	Low
EDR and device compliance	Infected or unpatched device	Device inventory	None
Conditional access	Abnormal sign-in, unmanaged device	Workstreams 1 and 2	Low
Network segmentation	Spread from a laptop to the servers	Flow mapping	None
ZTNA	Overly broad remote access	Workstreams 1 and 2	Low

Total duration depends on the number of devices, sites and business applications, and on where the estate starts from. None of these workstreams requires stopping the business: they roll out by user group, starting with a pilot.

The most common mistakes

• Buying a “Zero Trust” product before MFA is on everywhere.
• Exempting leadership from MFA or conditional access “so as not to bother them”, when their accounts are the most targeted.
• Switching conditional access straight to block, with no report-only period, and locking out legitimate users.
• Forgetting a protected emergency administrator account excluded from the rules, in case of a configuration error.
• Segmenting the network without mapping flows, then adding “allow all” rules to fix issues.
• Keeping the VPN open to everyone after ZTNA is in place.

How we deliver it

We start with an assessment: accounts and rights, Microsoft 365 licences, device state, firewall configuration, remote access. The initial audit is free. From it we build a roadmap per workstream, with prerequisites and decision points for management.

Rollout happens in waves: a pilot group, then the rest of the business, with a short message to staff at each step. Once in place, 24/7 monitoring follows EDR alerts, blocked sign-ins and abnormal attempts, and a critical incident is handled in under 15 minutes. Examples of our projects are on our case studies page.

Checklist to get started

• Is the list of all accounts, including administrators and service accounts, up to date?
• Is MFA active on email, VPN and every administrator account?
• Are there still shared accounts with a password known to several people?
• Is every device encrypted, patched and covered by an EDR whose alerts someone reads?
• Do your Microsoft 365 licences include conditional access and Intune?
• Does the network separate endpoints, servers, cameras, telephony and guest WiFi?
• Do providers reach the whole network, or only what they need?

Taking action

Zero Trust is not a product, it is a method: verify every access and limit every right. We fold these five workstreams into our business cybersecurity offer, with our partners’ firewalls and Microsoft 365 administration. To find out which workstream to start with in your business, contact us: we reply within 24 business hours.