Zero Trust for Mid-Sized Businesses: Access Security Without Overreliance on VPNs

For years, office network security was simple: a wall around the perimeter, and anyone inside the wall was trusted. Employees joined the office network or connected by VPN and could reach many systems. That model began to crack when applications moved to the cloud, employees worked from home and cafés, vendors needed temporary access, and personal devices joined in. The once-clear wall has almost disappeared, while an attacker needs only one stolen password to walk freely inside.

Zero trust rejects that old assumption: no user, device, or network is automatically trusted. Every access request is verified based on identity, device health, and context, and is granted only the access it needs. This article explains the concept in practical terms for mid-sized businesses, without requiring expensive products, along with a realistic staged approach.

Summary

• Zero trust is not a single product but a set of principles: verify explicitly, grant least privilege, and assume breach can happen
• User identity with multi-factor authentication becomes the main fence, replacing network location
• Device health and login context also decide whether access is granted
• Segmentation and least privilege limit the impact if one account is compromised
• Start with the most critical accounts, devices, and applications, rather than replacing everything at once

Why the castle-and-moat model no longer suffices

Several changes make the old model hard to sustain.

• **Cloud applications.** Data no longer lives only on office servers. SaaS applications are accessed over the internet from anywhere.
• **Remote and hybrid work.** Employees spend most of their time outside the office network.
• **Vendors and contractors.** Outsiders need limited access for a limited time.
• **Personal devices.** Personal phones and laptops are often used to open email and work applications.
• **Attacks that target credentials.** Phishing and password theft are more common than sophisticated network intrusions. See [phishing, ransomware, and cybersecurity for SMEs](/blog/phishing-ransomware-dan-keamanan-siber-untuk-umkm).

In the old model, a VPN that grants full access to the internal network becomes a weak point: once VPN credentials are stolen, an attacker can move to other systems that are unprotected because they sit on a trusted network.

Three core principles of zero trust

1. Verify explicitly

Every access request is assessed on many signals: who the user is, whether multi-factor authentication is satisfied, what device is used, where it is located, and whether the behavior is normal. One login in the morning does not mean everything afterward is automatically safe.

2. Least privilege

Users and applications get only the access required for their tasks, and only for the time needed. Sales staff do not need payroll data, and admin access does not need to be active all day. Good role design is covered in designing user access rights.

3. Assume breach

Design systems as if one account or device has already been compromised. The question is not only how to keep intruders out, but how far an attacker can move and how fast we find out. This drives segmentation, logging, and a clear response plan, as discussed in cybersecurity incident response plan for business.

Pillars you can apply

Identity: the most important foundation

User identity becomes the new perimeter. Practical steps:

• One central identity system for work applications so granting and removing access is consistent
• Multi-factor authentication for all accounts, strictest for admin accounts and remote access
• Single sign-on to reduce scattered passwords; see [SSO and identity management for business applications](/blog/sso-dan-manajemen-identitas-untuk-aplikasi-bisnis)
• A gradual move to phishing-resistant methods such as passkeys; see [passkeys and passwordless login](/blog/passkey-dan-login-tanpa-kata-sandi-untuk-bisnis)
• An offboarding process that revokes access when an employee or vendor leaves

Devices: is this device worth trusting

Access to sensitive data can require devices that meet minimum standards: updated operating system, encrypted storage, an active screen lock, and malware protection. For personal devices, consider limited browser-based access rather than full access to company data. The policy must be realistic; too strict and staff look for shortcuts.

Network: segmentation and per-application access

Instead of granting access to the entire internal network, grant access per application. A database server should not be reachable directly from the internet or from every laptop. Separate networks for critical systems, point-of-sale devices, cameras, and guests. Many businesses can reduce reliance on a full VPN by using application-based access, or keep a VPN but with strict segmentation and MFA.

Applications and data

At the application level, apply authorization that checks permissions on every request, not just at login. Classify data by sensitivity, and encrypt sensitive data at rest and in transit. Secrets such as API keys must not be embedded in code; see managing secrets and API keys in business applications. Other basics are in basic security for business applications.

Visibility: logs and detection

You cannot protect what you cannot see. Collect logs of logins, permission changes, and access to sensitive data, then set alerts for unusual patterns such as logins from unusual locations or large data downloads. The principle aligns with observability, logs, and error handling and audit trails in ERP systems.

Vendor and contractor access

Vendors are often an attack entry point because their access is loose and rarely reviewed. Helpful practices:

• Separate accounts per vendor individual, not shared accounts
• Access limited to specific systems and a time window, then expiring automatically
• Approval by an internal owner before access is activated
• Session recording for access to critical systems
• Periodic review of the list of active vendor access

Similar considerations appear in dependency security and the software supply chain and vendor selection in the checklist for choosing a software house.

A realistic staged plan

You do not need to overhaul everything. A sensible order for a mid-sized business:

1. **Inventory.** List applications, admin accounts, devices, and who accesses what. Many first findings are old accounts that are still active.

2. **MFA everywhere.** Start with email, finance applications, ERP, hosting panels, and admin accounts.

3. **Tidy permissions.** Apply roles, revoke excess access, and separate admin accounts from daily accounts.

4. **Device hygiene basics.** Automatic updates, disk encryption, and the ability to wipe data remotely if a device is lost.

5. **Network segmentation.** Isolate critical systems and restrict direct access to databases.

6. **Monitoring and alerts.** Enable logs and notifications for high-risk events.

7. **Incident drills.** Test the response plan and backup restoration regularly.

Once these basics run, consider more advanced conditional access, automated device posture checks, or application-based access services. Verification through penetration testing and security audits helps find gaps that are invisible from the inside.

Impact on user experience

Security that frustrates people will be bypassed. Good zero trust aims to reduce friction for legitimate access and add friction only when risk rises. For example, SSO and passkeys make daily login faster, while extra verification appears only on login from a new device or unfamiliar location. Involve users in the pilot, listen to complaints, and provide a quick help path when access is locked.

An illustrative scenario: a sales employee's email account is stolen

A sales employee is fooled by a fake login page and their password is stolen. In the old model, an attacker holding that password could go straight into email, shared files, and possibly other systems, then send scam emails to customers in that employee's name.

Under a zero trust approach, several layers work at once. Multi-factor authentication or a passkey stops the login because the attacker does not hold the second factor. If it gets through anyway, a login from an unfamiliar device and location triggers extra verification or a block. Least privilege means the sales account can reach only sales data, not finance or payroll. Logs record unusual patterns, such as a large download of the customer list, so an alert appears and the account can be locked at once. Finally, a rehearsed response plan decides who rotates credentials, assesses the impact, and notifies the parties concerned.

The result is that an incident which in the old model could end in a major leak becomes a detected and contained event. No layer is perfect, but a combination of several layers makes an attacker far less likely to succeed.

Common mistakes

• Treating zero trust as a product you buy once
• Enabling MFA for only some accounts so admin accounts are left behind
• Using admin accounts for daily work
• Not revoking access of departed employees or vendors
• Ignoring personal devices and applications installed by teams themselves
• Collecting logs but having no one review them
• Making policies so strict that teams take shortcuts

Frequently asked questions

Does zero trust mean not using a VPN?

Not necessarily. A VPN is still useful in some cases. What changes is the assumption: being on the VPN does not automatically grant access to everything. Access is still verified and limited per system.

Does a small business need zero trust?

The principles apply at every size, but implementation can be simple: MFA, least privilege, device updates, and disciplined access revocation already deliver a big leap.

How much does it cost?

Many early steps are cheap or use features already in the email and identity services you use. The biggest cost is usually the time to organize permissions and get the team used to it.

Where should we start?

Start with MFA for email and admin accounts, then inventory accounts and access. These two steps reduce the most risk with relatively little effort.

Conclusion

Zero trust shifts the focus of security from guarding the wall to verifying every access. With strong identity, least privilege, well-kept devices, segmentation, and visibility, one compromised account does not automatically mean the whole business is exposed. Apply it in stages, starting with the most critical accounts and applications, and measure progress through an access inventory that grows tidier.