Cyber Security
Zero Trust for small businesses: a practical start without a big budget
Zero Trust is a principle, not a product: check every access, grant only what is needed and plan for incidents. Here is how small businesses can start with tools they often already have.
Q-entra editorial teamPublished on 6 min read
Contents
Key takeaways
- Zero Trust means no access is trusted automatically, not even from inside the office network. Every sign-in is checked against identity, device and context.
- Small businesses can start with tools they often already have: MFA, separate admin accounts, up-to-date devices and, depending on the licence, conditional access in their cloud services.
- Segment the network and replace a VPN that opens the whole company network with access to only the systems each group actually needs.
- Work in stages: inventory and MFA first, then admin rights and devices, then network and remote access, and finally logging and regular reviews.
- Zero Trust is not a product you buy once but a principle you apply step by step.
What Zero Trust means for a small business
Zero Trust is a security principle, not a product: no user, device or connection is trusted simply because it is inside the office network. Every attempt to access email, files or business applications is checked: who is signing in, from which device and in what context. A small business can get started without a big budget: MFA for every account, separate admin accounts, up-to-date devices and a segmented network can often be implemented with existing licences and network equipment.
The traditional model works like a castle with a moat: whoever gets past the firewall or connects via VPN can reach almost everything. That worked while staff, servers and data were all in one building. Today many people work from home, data sits in cloud services, and a single stolen password can be enough to get in. The US standards body NIST describes the approach in detail in its publication SP 800-207.
The three core principles of Zero Trust
Verify explicitly
Every sign-in is checked using several signals: identity, a second factor, the state of the device and, where possible, location or time. Someone signing in at three in the morning from an unknown laptop abroad should face stricter checks than a colleague at their usual desk.
Least privilege
People and systems receive only the access they need for their work, and only for as long as necessary. The accounts team needs the finance software, not the camera system.
Assume breach
Plan as if an attacker were already on the network. The question then becomes: how far could they get, and how quickly would you notice? Segmentation, logging and tested backups limit the damage if something does go wrong.
Six building blocks that work on a small budget
1. Multi-factor authentication for every account
MFA offers strong protection for little effort: a stolen password alone is no longer enough to sign in. Start with email, cloud services, remote access and all administrator accounts, then extend it to every user. Authenticator apps or hardware security keys are preferable to SMS codes. Our guide to introducing multi-factor authentication explains the rollout in detail.
2. Check device health
Only devices that meet a minimum standard should access company data: a current operating system, active disk encryption, endpoint protection and a screen lock. In Microsoft 365, for example, conditional access and device management (Intune) can enforce such rules automatically if your licence plan includes them. Personal devices can then be limited to browser-only access.
3. Segment the network
In a flat network where office PCs, servers, printers, cameras and guest Wi-Fi share one segment, an attacker who gets in can move around largely unhindered. Separate these groups into their own VLANs and use firewall rules to allow only the connections that are actually needed. This requires managed switches and a firewall that filters traffic between the segments.
4. Remote access without opening the whole network
A classic VPN often places the remote device directly on the company network, with access to almost everything. Better options are VPN profiles per user group that reach only the required servers, or application-based access (often called ZTNA, Zero Trust Network Access), which makes individual applications available instead of the whole network. Cloud services such as email need no VPN if they are protected by MFA and device checks.
5. Separate and limit admin rights
Administrators use a dedicated account for admin tasks and a normal account for email and browsing. Everyday users rarely need local administrator rights. Unique local admin passwords per device, managed for example with Windows LAPS, prevent a single leaked password from opening every machine.
6. Log and review
Sign-ins, admin changes and firewall events should be logged centrally and kept for a defined period. Set up alerts for unusual events, such as sign-ins from unexpected countries or newly created admin accounts, and decide who reviews them. Align scope and retention period with data protection requirements and, if you have one, agree them with your works council. Logs nobody looks at do not protect you.
Classic network model and Zero Trust compared
The difference lies less in technology than in the basic assumption:
| Topic | Classic model | Zero Trust |
|---|---|---|
| Basis of trust | Anything inside the network is trusted | Every access is checked |
| Sign-in | Password | MFA and device status |
| Remote access | VPN into the whole network | Access only to required applications |
| Admin rights | Permanent, often in everyday accounts | Separate accounts, only where needed |
| Network | One flat segment | Segments with firewall rules |
| Monitoring | Usually only after an incident | Logged and reviewed regularly |
A four-stage roadmap for introducing Zero Trust
Zero Trust does not need one large project. The four stages build on each other, and each delivers a benefit on its own:
- Stage 1: Take stock and secure identities. List users, devices, applications and where important data is stored. Introduce MFA for all accounts, starting with administrators and email, and remove shared and orphaned user accounts.
- Stage 2: Admin rights and devices. Create separate admin accounts, remove local administrator rights from everyday users and define a minimum standard for devices: updates, encryption, endpoint protection.
- Stage 3: Network and remote access. Divide the network into segments for office, servers, guests and devices such as cameras or printers. Restrict VPN access to what each group needs, or move to application-based access.
- Stage 4: Visibility and routine. Collect logs centrally, set up alerts, review permissions every quarter and regularly test restoring your backups.
Many small businesses can complete the first stage within a few weeks. The later stages depend on the existing network and are often easiest to tackle when hardware is replaced anyway or the office moves.
Common misconceptions about Zero Trust
- "Zero Trust is a product." No single firewall, licence or software makes a business Zero Trust. Products help with implementation, but the decisions about access, rights and processes remain yours.
- "It means we distrust our staff." The principle is aimed at automatic trust in networks and devices, not at people. It also protects employees, because a stolen password alone no longer gives anyone access.
- "It is only for large corporations." The key building blocks are affordable for small businesses and can often be implemented with existing licences and equipment.
- "Once it is set up, we are done." New staff, devices and applications change the picture constantly. Regular reviews of permissions and logs are part of the concept.
- "We will no longer need a firewall or VPN." Both remain useful. They are simply no longer the only line of defence.
Conclusion: start small, but start
For small businesses, Zero Trust is mainly a matter of consistent decisions: verify every access, grant only the rights that are needed and limit the impact of an incident. MFA and separate admin accounts deliver quick results; segmentation and controlled remote access follow step by step. For support with the assessment or implementation, Q-entra can help with cyber security and a cleanly segmented network and Wi-Fi infrastructure.
