Zero Trust is a security model that eliminates implicit trust from network architecture. No user, device, or service is trusted by default, regardless of network location. Within the Empty Fortress doctrine, Zero Trust is the access architecture principle: even inside the fortress walls, every door requires authentication and authorization.
The traditional argument that Zero Trust is too complex for small businesses is backwards. SMBs are more vulnerable to lateral movement because they typically have flat networks, shared credentials, and over-privileged accounts. Zero Trust actually simplifies security for SMBs by replacing complex perimeter defenses with consistent, identity-based access controls.
Phase 1 covers identity foundation: deploy SSO with a modern identity provider, enforce MFA everywhere with no exceptions, eliminate shared accounts and local admin rights. Phase 2 covers device trust: implement device compliance checks, use MDM or endpoint management, require device health attestation. Phase 3 covers application access: move to identity-aware proxies or ZTNA solutions, eliminate VPN where possible, implement just-in-time access for admin tasks. Phase 4 covers micro-segmentation: segment critical systems, implement least-privilege network policies, monitor east-west traffic.
Buying a Zero Trust product instead of implementing Zero Trust principles. Exempting executives or IT staff from MFA. Implementing Zero Trust for external access but maintaining flat internal networks. Treating Zero Trust as a project rather than an operating model.
Zero Trust and Empty Fortress are complementary. Empty Fortress says minimize what is in the fortress. Zero Trust says verify everyone at every door. Together they create an architecture where there is little to steal and every attempt to reach it is authenticated, authorized, and logged.
Zero Trust is more achievable for SMBs than traditional perimeter security. Start with identity, then layer device trust, application access, and segmentation.