The traditional security model was simple: build a strong perimeter, place a firewall at the edge, and trust users and devices once they entered the internal network.
That model is no longer enough.
Employees work remotely. Applications run across AWS, Azure, GCP, private data centres, and SaaS platforms. Third-party vendors need temporary access. APIs connect business systems. AI tools process sensitive information. A stolen password can give an attacker a starting point inside the organisation.
This is why Zero Trust Architecture is becoming the new security standard.
Zero Trust follows one clear principle:
Never trust, always verify.
It does not mean that every employee or device is treated as malicious. It means that access is never granted automatically based only on a user’s location, network, device ownership, or previous login.
According to the NIST Zero Trust Architecture guidance, security decisions should focus on protecting users, devices, applications, services, and data: not simply protecting a network perimeter.
What is Zero Trust Architecture?
Zero Trust Architecture is a security approach in which every access request is evaluated before access is granted. The decision can consider:
- Who is requesting access?
- What device is being used?
- Is the device patched and compliant?
- What application or service is making the request?
- Where is the request coming from?
- Is the activity normal for that user?
- What level of risk is associated with the request?
- What resource is being accessed?
Authentication is only the first step. A user may successfully log in but still be denied access to a sensitive database if the device is unsafe, the location is unusual, or the request does not match the user’s role.
Microsoft describes the model through three practical principles: verify explicitly, use least-privilege access, and assume breach. These principles are explained in its Zero Trust security overview.
Identity-first security: the new control plane
In a Zero Trust environment, identity becomes the centre of security.
Identity does not only mean an employee’s username. It can include:
- Employees and administrators
- Service accounts
- Applications and APIs
- Virtual machines and containers
- Devices and endpoints
- Vendors and contractors
- AI agents and automated workflows
Every identity should have a clear purpose and a defined level of access.
Strong identity controls typically include:
- Multi-factor authentication
- Single sign-on with central identity management
- Device certificates or strong device identity
- Role-based or attribute-based access control
- Privileged access management
- Just-in-time administrator access
- Regular access reviews
- Immediate removal of access when a person changes roles or leaves
The goal is to answer a simple question: who or what is requesting access, and is that access necessary right now?
This approach is especially important for financial services, where administrators, developers, vendors, and operations teams may need access to critical systems but should not receive unlimited permissions.
Least privilege: give only the access that is needed
Least privilege means that users, applications, and devices receive only the permissions required to complete a specific task.
For example, a database administrator may need permission to maintain a database but should not automatically have access to payment files. A developer may need access to a test environment but not to production customer data. A vendor may need access for two hours to troubleshoot a device, but not permanent VPN access.
Good least-privilege controls include:
- Define access by role and business requirement.
- Remove unused and dormant accounts.
- Separate administrator accounts from everyday user accounts.
- Use time-limited privileged access.
- Review access rights regularly.
- Log and monitor privileged activity.
- Re-authorise access when the user requests a new system or sensitive resource.
Least privilege reduces the impact of stolen credentials and insider threats. Even if an attacker compromises one account, the account should not provide a path to the entire environment.
Micro-segmentation limits lateral movement
In a traditional network, an attacker who compromises one workstation may be able to scan the internal network and move toward servers, databases, or other high-value systems.
Micro-segmentation reduces this risk by dividing the environment into smaller security zones. Access between zones is controlled according to identity, application, device posture, and business purpose.
Possible segments include:
- Employee network
- Guest and unmanaged device network
- Payment cardholder data environment
- Core banking systems
- Database and backup networks
- VMware and virtualisation management networks
- Production and development environments
- Cloud workloads
- Internet-facing applications
- Data centre monitoring and management systems
Micro-segmentation is not simply creating VLANs. It also requires clear policies for east-west traffic: the traffic moving between internal systems.
For example, an application server may be allowed to communicate with a specific database port, while all other connections are denied. A backup server may communicate with storage systems but not with employee laptops. A vendor workstation may reach a maintenance gateway but not the core banking environment.
This helps reduce the “blast radius” of a security incident.
The role of a NextGen Firewall to protect business
A NextGen Firewall to protect business is an important part of a Zero Trust strategy, but it is not the entire strategy.
A modern next-generation firewall can provide:
- Application-aware traffic control
- User and identity-aware policies
- Intrusion prevention
- Malware and threat detection
- Web and URL filtering
- Encrypted traffic inspection where appropriate
- Network segmentation
- VPN and secure remote access
- Detailed traffic logging
- Integration with identity providers and SIEM platforms
The firewall should enforce business policies rather than only relying on IP addresses and ports.
For instance, a policy might allow the finance application to connect to a payment database only when:
- The application identity is valid.
- The workload is running on an approved host.
- The connection uses an approved protocol.
- The request comes from an authorised segment.
- The activity is logged and monitored.
Zero Trust does not make firewalls irrelevant. Instead, it moves the firewall from being only a perimeter defence to becoming one of several policy enforcement points across the enterprise.
How network audits support Zero Trust
A network audit is one of the best starting points for Zero Trust adoption.
Before an organisation can control access, it must understand what it owns and how everything communicates. A network audit should examine:
- Current network diagrams
- Data flows and application dependencies
- Firewall and router configurations
- VLANs and security zones
- Internet-facing services
- Remote access paths
- Cloud connections
- Third-party connectivity
- Unused firewall rules
- Open ports and unnecessary services
- Privileged access
- Logging and monitoring coverage
- Backup and disaster recovery connectivity
- Shadow IT and unknown devices
The audit should compare the documented design with the actual environment. Many organisations discover that old firewall rules, temporary vendor access, unmanaged devices, and undocumented cloud services have created hidden pathways.
A network audit also provides evidence for future improvements. It can help IT leaders identify which applications should be segmented first and which access rules create the greatest business risk.
IT security audit checklist for Zero Trust readiness
Use this practical IT security audit checklist as a starting point:
Identity and access
- Is multi-factor authentication enabled for remote and privileged access?
- Does every user have a unique account?
- Are service accounts documented and reviewed?
- Are dormant and terminated accounts disabled quickly?
- Are administrator permissions limited and monitored?
- Is privileged access time-bound?
Devices and workloads
- Is there an accurate inventory of laptops, servers, virtual machines, containers, and network devices?
- Are patch levels and endpoint security status monitored?
- Are unmanaged or non-compliant devices blocked or restricted?
- Are cloud workloads included in asset management?
Network security
- Are critical systems separated from general user networks?
- Are firewall rules documented and reviewed?
- Are inbound and outbound connections restricted to business needs?
- Is east-west traffic monitored?
- Are remote access routes approved and regularly reviewed?
Monitoring and response
- Are authentication, firewall, administrator, and data access events logged?
- Are logs protected from unauthorised modification?
- Are alerts integrated with a SIEM or monitoring platform?
- Is unusual behaviour investigated?
- Are incident response procedures tested?
Governance and audit
- Are security policies approved by leadership?
- Are exceptions documented with owners and expiry dates?
- Are third-party connections reviewed?
- Are penetration tests and vulnerability assessments performed?
- Is there a process to track audit findings to closure?
Zero Trust and compliance: RBI, UAE Central Bank, and PCI DSS
Zero Trust does not automatically make an organisation compliant. Compliance depends on the applicable regulation, scope, evidence, implementation quality, and audit findings.
However, Zero Trust supports many common control objectives.
RBI cybersecurity expectations
The RBI Cyber Security Framework for Banks includes areas such as network management and security, user access control, and maintenance and analysis of audit logs.
A Zero Trust programme can support these areas through:
- Strong identity and access controls
- Least-privilege permissions
- Segmentation of critical banking systems
- Continuous monitoring
- Centralised logging
- Privileged-user monitoring
- Regular network and cyber security audits
UAE Central Bank requirements
The CBUAE Rulebook chapter on information security addresses information security policies, vulnerability assessments, penetration testing, security controls, and incident reporting.
Zero Trust can help financial institutions create a more structured approach to access decisions, network protection, monitoring, and incident containment. Organisations should always map their controls to the latest applicable CBUAE requirements and obtain qualified compliance advice.
PCI DSS
PCI DSS requires organisations to protect cardholder data through network security controls, restricted access, authentication, logging, monitoring, and testing.
The PCI Security Standards Council guidance on scoping and network segmentation explains why segmentation must be properly designed and validated when it is used to reduce the cardholder data environment scope.
Micro-segmentation, strong authentication, tightly controlled firewall rules, protected logs, and regular testing can make PCI DSS evidence more consistent and reduce unnecessary exposure.
How to begin your Zero Trust journey
Zero Trust is not a single product purchase. It is a gradual business and technology transformation.
A practical starting sequence is:
- Identify critical business services and sensitive data.
- Build an inventory of identities, devices, applications, and workloads.
- Conduct a network and IT security audit.
- Enforce MFA for privileged and remote access.
- Remove unnecessary access and outdated firewall rules.
- Segment high-value environments.
- Centralise logging and monitoring.
- Pilot Zero Trust controls with one important business application.
- Measure blocked access, incident response time, exceptions, and user impact.
- Expand the model in stages.
The most successful programmes balance security with usability. Policies should protect the business without creating unnecessary interruptions for employees and customers.
Final thoughts
The question is no longer whether an organisation has a firewall. The better question is whether every user, device, application, and connection is continuously verified and limited to what it genuinely needs.
Zero Trust helps organisations reduce lateral movement, control privileged access, improve visibility, and prepare stronger evidence for network audits, cyber security audits, RBI assessments, UAE Central Bank reviews, and PCI DSS evaluations.
For guidance on Zero Trust, IT security audits, career growth, or technology planning, Contact Shelesh.
Further reading
