Give each person only the access they need

There is a VPN at the office that a vendor once set up. A handful of people use it to reach the file server from home, and the rest log in through a program nobody knows exactly who installed. The accountant has an account, and the previous system administrator probably still does too. As long as it works, nobody looks at it. Only when someone leaves or the insurer asks questions does it turn out you cannot explain who can all get in.

Why a VPN alone is not enough

A VPN does exactly one thing: it pulls an encrypted tunnel from a laptop to your network. That is useful, but it is also all. Whoever is through that tunnel stands in the network as if sitting at a desk in the office. They see the file server, the printers, the camera recorder, and the accounting package, even when they have no business there.

That was workable when everyone sat at the office and two people worked from home. Now your colleagues work on their own laptops, a technician from your machine vendor looks along remotely, and an accounting firm logs in to a single package. A password that opens the whole door is then a cruder instrument than you want. And as soon as a laptop gets infected, that infection comes into your network through the same tunnel.

What zero trust means in practice

Zero trust sounds like a product, but it is mostly a different habit: the network trusts nobody on the basis of where they come from. Every request is assessed separately. Who are you, which device are you working on, and may your role access this one system? The technician gets the machine and nothing more. The bookkeeper gets the accounting package and not the folder with personnel files.

In practice that means two-step verification on every connection from outside, access rules tied to a role instead of a device, and logging in which you can see who was where and when. Removing someone who left then becomes a half-minute action instead of a search across five systems. You do not have to rebuild everything at once for that: we put the new layer next to what is there and move group by group.

From inventory to working access

We start with the dull step that is usually skipped: finding out who actually comes in now. Which accounts exist, which suppliers have an entrance, which devices are open to the outside. That list is almost always longer than expected, and it delivers the first gain with almost no work, because it contains accounts that have belonged to nobody for years.

Then we set up the access and test with a small group that really works with it daily. Only when it runs for a week without hassle for them does the rest switch over and do we close the old route. If the network itself is not in good shape yet, we do that first through Network design and installation, because access rules on top of an unclear network are false security. Wireless access for guests and personal devices belongs to Business Wi-Fi and site survey, and we take it along in the same round.

Where it runs and who manages it

The components we set up run on your own equipment or in our managed environments within the EU, and which choice it becomes we agree with you in advance. Your data and your log files stay within the EU, and you are the owner of the configuration.

You can do the management yourself. You get the accounts, the settings, and a short guide in plain language, so you can add or remove someone yourself. If you would rather outsource it, we do that, but the insight stays with you: you can see at any time who has access and revoke that access yourself. If, in our view, a wish delivers little or turns out too expensive for what it solves, we tell you right away.