During this week’s Rubrik and Microsoft Zero Trust Summit, zero trust and identity security experts emphasized the significance of implementing specific granular policy rules, validation techniques, and baseline establishment to ensure that authorized individuals access designated resources at the appropriate times.

John Kindervag, who authored a research paper that defined a zero-trust architecture in 2010, noted "[what] we can do at the highest level [is] to have a lot of validation that is the right user accessing the right resource, viewing the right application at the right time, so that we can have confidence, and then ultimately what we're measuring is the maturity of that system over a period of time,” he said during the panel discussion at the event.

Kindervag stated organizations should reduce data access to only those who need it. “We get too much access to too much data to too many people for no reason other than we've always done it that way … I realized that about 80% of the data that was held by any organization was what we defined as stale, meaning no one had looked at it in the past year."

Rubrik Co-founder and CTO Arvind Nithrakashyap concurred the zero-trust focus should be on sensitive data. "There's tons of data, but if you focus on sensitive data, and give insights into our customers about who has access, who was accessing them, and things like that, I think that actually makes it much easier to go and solve that."

On the other hand, Kindervag noted zero trust protection is beyond data security. “It was originally designed to stop and prevent data breaches.” And he defines a data breach as “the exfiltration of sensitive or regulated data from our networks and systems into the hands of a malicious actor.”

“Now, data is still primary in zero trust, but there are other things we want to protect,” including applications, assets, supervisory control and data acquisition (SCADA) systems, and services, he said.

The tactical first step for this zero-trust strategy is to capture everything in logs for a few months without applying any policy to establish a baseline for policies based on normal user activity, recommended Alex Weinert, VP director of identity security at Microsoft.

Weinert noted Microsoft internally used this technique for its zero-trust rollout. “You get through for us a quarterly reporting cycle,” he said. “You can actually see with a lot of integrity who's accessing what data in their day-to-day job.”

“That's actually a really good starting point for establishing your policies. Start off by saying: Okay, what's normal? Let's go to my normal and then you can go and start doing takebacks,” Weinert noted. That way, “at least you have an initial position where if somebody goes rogue or somebody's account is hacked, they're at least constrained to what their job function really requires them to do. ”