Zero Trust Architecture: "Never Trust, Always Verify" Enterprise Security

For years, enterprise security rested on a single assumption. The inside of the corporate network was safe and the outside was dangerous. The firewall was imagined as a castle wall, and the VPN as the bridge across the moat. Once you were inside, the systems trusted you. This is the "castle and moat" model, and as of 2026 it is officially dead.

Remote work, cloud migration, BYOD, the SaaS explosion, and increasingly advanced threats have shattered this model. The moment an attacker compromises a single set of credentials, they walk straight into the castle and move laterally for weeks without being noticed. That is the common thread behind the major incidents Turkey has experienced. For the full picture, see our reference Turkey cyber threat report.

The answer is Zero Trust architecture. In this article we explain what Zero Trust is, NIST's official definition, CISA's five-pillar model, the history of BeyondCorp, Microsoft integration, and a 90-day roadmap for SMEs.

What Is Zero Trust?

Zero Trust is not a product, it is an architectural approach. Its core premise fits in a single sentence: "Never trust, always verify."

It makes no difference whether you are inside or outside the network. Every access request is verified as if it came from the public internet. User identity, device health, location, behavior, and the sensitivity of the requested resource are all re-evaluated every single time. Trust is not static, it is dynamic, and it has to be re-earned in every session.

The official reference framework is NIST SP 800-207 Zero Trust Architecture. This is the document accepted as the standard worldwide, including across the U.S. federal government.

NIST SP 800-207: The 7 Core Principles

NIST builds Zero Trust on seven rules.

1. All data sources and computing services are treated as "resources." Not just servers, but IoT devices, SaaS applications, and personal devices fall within the scope of protection.

2. All communication is secured regardless of network location. The internal corporate network is not treated as a "safe zone." LAN traffic is also encrypted and authenticated.

3. Access is granted on a per-session basis. You are not verified once and then given open-ended access. Every session is checked again.

4. Access to resources is determined by dynamic policy. User identity, device posture, behavior, and the sensitivity of the request are evaluated together.

5. The organization monitors the integrity and security posture of all owned and associated assets. Device compliance, patch level, and the presence of EDR are continuously monitored.

6. All resource authentication and authorization are dynamic and strictly enforced. MFA is the standard, and continuous re-authentication is expected.

7. The organization collects as much information as possible about assets, network infrastructure, and communications, and uses it to improve its security posture. Telemetry and analytics are the fuel of Zero Trust.

CISA's 5 Pillars: The Maturity Model

The CISA Zero Trust Maturity Model assesses Zero Trust across five pillars.

Pillar 1: Identity

You cannot access anything without proving who you are. Identity is now the new security perimeter. MFA, passwordless authentication (FIDO2, Windows Hello), conditional access policies, privileged access management (PAM), and identity threat detection are the components of this pillar.

Pillar 2: Devices

The identity and health status of the device are verified. Is it patched? Is the disk encrypted? Is EDR active? Is it jailbroken or rooted? No access is granted unless device compliance policies are met. In our EDR vs antivirus article we covered device-level protection in detail.

Pillar 3: Networks

Instead of the flat "the internal network is safe" assumption, microsegmentation. The network is divided into small zones, and movement between zones is authorized separately. Even if an attacker lands in one zone, they cannot move laterally.

Pillar 4: Applications and Workloads

Access to SaaS, IaaS, and PaaS applications is managed by user, device, and session context. In-application behavior is monitored (UEBA), and the development process is kept secure (DevSecOps).

Pillar 5: Data

Data classification, labeling, encryption (at rest, in transit, and in use), DLP (Data Loss Prevention), and rights management (Microsoft Purview / IRM). Data is treated as "gold," and access to it is managed at the strictest level.

CISA defines four maturity levels for each pillar: Traditional, Initial, Advanced, Optimal. This lets you see where you stand on the Zero Trust journey.

History: Google BeyondCorp

The first major real-world implementation of the Zero Trust concept was Google's BeyondCorp project. In the wake of the 2009 Operation Aurora attack, Google abandoned the classic VPN approach. Within ten years it moved 100,000+ employees onto an architecture that accesses corporate applications directly from the internet, without a VPN.

BeyondCorp's rules are simple:

  • Network location provides no trust
  • Access depends on device and user identity
  • Access to all applications is authenticated, authorized, and encrypted

Today BeyondCorp Enterprise is offered as a commercial product through Google Cloud. Forrester's Zero Trust eXtended (ZTX) framework and John Kindervag's original 2010 research form the academic foundation of this evolution.

Microsoft Zero Trust: Entra ID + Defender + Intune

The Microsoft Zero Trust approach is the enterprise-product counterpart of BeyondCorp. Three pillars:

Microsoft Entra ID (formerly Azure AD): The identity pillar. MFA, Conditional Access, Privileged Identity Management (PIM), and Identity Protection (risk-based access).

Microsoft Defender (the XDR family): Threat visibility across endpoint, Office 365, Cloud Apps, and Identity in a single pane. EDR plus email security plus CASB plus ITDR (Identity Threat Detection and Response).

Microsoft Intune: Device management. Compliance policies, app protection, BYOD separation, and conditional access device health signals.

These three come together in the Microsoft 365 E5 or Business Premium license. The critical point for SMEs is this: Business Premium delivers the cornerstones of Zero Trust for roughly 22 USD per user per month. That is far more economical than buying CrowdStrike, Okta, and Cloudflare Access separately.

The SASE and SSE Framework

The modern packaging of the network side of Zero Trust is SASE (Secure Access Service Edge) and its security subset, SSE (Security Service Edge).

SASE consolidates the following components into a single cloud:

  • ZTNA (Zero Trust Network Access): Identity-based access that replaces the VPN
  • SWG (Secure Web Gateway): Web traffic filtering
  • CASB (Cloud Access Security Broker): SaaS security
  • FWaaS (Firewall as a Service): Firewall in the cloud
  • DLP: Data loss prevention

Leading vendors: Zscaler, Netskope, Palo Alto Prisma Access, Cloudflare One, and Cisco Umbrella + Duo. For SMEs, Cloudflare One offers a way to get started at a free tier.

"Never Trust, Always Verify" in Practice

The slogan sounds good, but what does it mean in practice? Five concrete applications:

1. MFA everywhere. Not SMS, but an authenticator app or a FIDO2 key. Mandatory for administrator accounts and, where possible, passwordless.

2. Conditional Access policies. "A sign-in from outside Turkey + a new device + an administrator role = block or step-up MFA." Microsoft Entra Conditional Access delivers this.

3. Microsegmentation. The production server should not be reachable from the marketing VLAN. The database should be reachable only from the application server, over specific ports. The attacker should not be able to move laterally into the finance system.

4. JIT and JEA (Just-in-Time, Just-Enough-Access). Administrator roles are not granted permanently. They are granted when needed, with approval and for a limited time. Microsoft PIM is the standard tool for this.

5. Encryption everywhere. TLS 1.2+ on all traffic (including the LAN), disk encryption on all endpoints (BitLocker), and column-level encryption at the data layer (Always Encrypted, TDE).

Practical Zero Trust for SMEs

Zero Trust is not only for enterprise giants. It is accessible to SMEs too. The minimum package:

  • Microsoft 365 Business Premium (includes Entra ID P1, Defender for Business, and Intune)
  • Conditional Access policies (3-4 basic rules are enough)
  • Mandatory MFA for all users
  • BitLocker on all laptops
  • Intune compliance policies (patching, antivirus, screen lock)
  • Cloudflare One free tier as a ZTNA starting point
  • Defender for Business as the EDR

This package aligns closely with the baseline package in our SME cybersecurity guide. Add employee training (our phishing guide) and an incident response plan (the first 24 hours after ransomware) and the picture is complete.

The Link to ISO/IEC 27001

The Annex A controls of ISO 27001 certification overlap heavily with Zero Trust:

  • A.5.15-18: Access control, privileged access, authentication
  • A.8.1-3: Endpoint, privileged utility programs, access restriction
  • A.8.12: DLP
  • A.8.20-23: Network security, segmentation, web filtering

Zero Trust architecture makes the ISO 27001 certification journey easier, because the control framework is already aligned with Zero Trust principles.

The Maturity Model: Seeing Where You Stand

A rough classification based on the CISA levels:

Traditional: Static policies, perimeter firewall, VPN, local AD, and no MFA or only limited MFA. The majority of SMEs in Turkey sit here.

Initial: Some cloud identity (Entra ID), partial MFA, basic EDR, and log collection underway. The more security-aware mid-sized organizations are here.

Advanced: Conditional Access, microsegmentation, XDR correlation, a ZTNA pilot, and DLP in operation. Mature enterprise.

Optimal: Behavioral analytics (UEBA), fully passwordless, automated response (SOAR), and continuous adaptive risk assessment. Leading edge.

The goal is to reach at least "Advanced" in every pillar. "Optimal" requires a multi-year investment and is not mandatory for every organization.

A 90-Day Zero Trust Roadmap

Days 1-30: Core identity and devices

  • Plan the Microsoft 365 Business Premium or E5 license
  • Mandatory MFA for all users
  • Three core Conditional Access policies: block legacy auth, require MFA for admins, require a compliant device
  • BitLocker on all endpoints
  • Defender for Business active

Days 31-60: Device compliance and data

  • Intune compliance policies (patching, antivirus, password)
  • Conditional Access "require compliant device" for all applications
  • Begin data classification (Sensitivity Labels)
  • Basic DLP rules (block leakage of credit card numbers and Turkish national ID numbers)
  • Privileged Identity Management (PIM) for administrators

Days 61-90: Network and applications

  • Microsegmentation plan and pilot
  • ZTNA pilot (Cloudflare Access or Entra Private Access)
  • Roadmap to reduce VPN dependency
  • Vendor and external access via ZTNA
  • SOC integration (Defender XDR + SIEM)
  • Zero Trust maturity assessment (against the CISA model)

By the end of the 90 days, concrete progress from "Initial" toward "Advanced" becomes visible in every pillar of the CISA model.

Telemetry and Continuous Monitoring

NIST's seventh principle is no accident. Without continuous monitoring, Zero Trust does not work. Policies need signals in order to make dynamic decisions.

The telemetry sources you need to collect:

  • Entra ID sign-in logs: Who, from where, which device, MFA status, risk score
  • Defender XDR alerts: Endpoint, email, identity, and cloud app signals in one correlation
  • Intune compliance state: Real-time compliance status of devices
  • DNS and proxy logs: Hunting command-and-control traffic
  • DLP events: Data exfiltration attempts
  • PIM activation logs: Use of privileged access

This data is gathered in a SIEM (Microsoft Sentinel, Splunk, Elastic). Sentinel offers the fastest integration in the Microsoft ecosystem. For SMEs, the built-in correlation of Defender XDR often provides sufficient visibility without a SIEM investment.

The Cultural Dimension: Zero Trust Is Not Just Technology

The most common obstacle in a Zero Trust transition is not technical, it is cultural. Users ask, "why am I logging in again?" Managers complain, "why can't I access this folder?" The IT team resists with "we don't want to turn off the VPN."

The solution has three legs:

  • Communication: Explain in plain language why Zero Trust is necessary and which threat it protects against
  • Phased rollout: Don't do it overnight; spread it across a 90 to 180 day plan
  • User experience: Implement passwordless (Windows Hello, FIDO2) to reduce friction

Without executive sponsorship, a Zero Trust project stalls halfway. Ownership at the CEO or general manager level is essential.

Common Mistakes

  1. Treating Zero Trust as done once you buy a single product. Zero Trust is a journey, not a product.
  2. Trying to shut off the VPN overnight. The ZTNA migration must be phased.
  3. Ignoring the user experience. Overly strict policies kill productivity and trigger shadow IT.
  4. Focusing only on the identity pillar and forgetting the data pillar. All five pillars must progress in balance.
  5. Failing to update the incident response plan. A Zero Trust architecture also changes the IR workflow.

Frequently Asked Questions (FAQ)

Does Zero Trust eliminate the VPN entirely? In the long run, yes. ZTNA solutions (Entra Private Access, Cloudflare Access, Zscaler Private Access) replace the VPN. The transition takes between 6 and 18 months.

We have MFA, can we say we are doing Zero Trust? No. MFA is one of the cornerstones of Zero Trust, but it is not enough on its own. Device compliance, microsegmentation, conditional access, and data protection are also required.

How much does Zero Trust cost for an SME? Microsoft 365 Business Premium is roughly 22 USD per user per month. For a 50-person company that is about 1,100 USD per month, around 13,000 USD per year. That is one-tenth the cost of a single ransomware incident.

Is Zero Trust mandatory for remote work? In the modern remote-work model it is effectively mandatory. The shortcomings of VPNs became clear in the post-pandemic period.

Is microsegmentation difficult? At the start, yes; it requires a deep inventory and traffic analysis. Tools like Illumio, Akamai Guardicore, Microsoft Azure NSG/ASG, and Cisco ACI speed up the process. Full segmentation takes 6 to 12 months.

My company is cloud-only, do I need Zero Trust? Yes, even more so. In a cloud-only environment, identity is the only perimeter. Without Zero Trust, your Entra ID alone does not provide adequate protection.

I have ISO 27001 certification, do I still need Zero Trust? ISO 27001 is a governance framework, Zero Trust is a technical architecture. They are different layers and are strong together. ISO 27001 does not require Zero Trust, but Zero Trust largely satisfies the 27001 controls.

Is Zero Trust widespread in Turkey? It is at an advanced level in the banking and large telecom sectors. Among SMEs and mid-sized organizations it is still in the early stages. KVKK (Turkey's personal data protection law) and sector-specific regulations are accelerating adoption.

Zero Trust Migration with DSET

DSET, based at Hacettepe Teknokent in Ankara and operating since 2003, provides Zero Trust migration consulting for SMEs and mid-sized organizations. Our service scope:

  • Current-state assessment (CISA maturity scoring)
  • A prioritized 90-day roadmap
  • Microsoft 365 / Entra ID / Intune / Defender integration setup
  • Conditional Access policy design
  • ZTNA pilot and VPN migration plan
  • Microsegmentation architecture
  • ISO 27001 alignment

Starting the Zero Trust journey with the right architecture, rather than by buying a product, is what makes the difference. For a demo and a free preliminary assessment, reach our team at +90 536 662 38 09.

Sources: