Zero trust for teams without a security department

Most breaches we are called in after did not involve exotic exploits. They involved a valid credential doing something nobody was watching.

Remove standing access Nobody holds permanent production credentials. Access is requested, time-boxed, logged and expires automatically. This single change eliminates a large class of incidents.

Identity is the perimeter - Phishing-resistant MFA on every admin account, no SMS - Short-lived tokens for services, no long-lived keys in environment files - Device posture checks before granting access to production

Assume the credential leaks Design so a stolen token is low value: scoped permissions, per-environment isolation, anomaly alerts on unusual data volume or geography.

Practice the response A thirty-minute tabletop exercise once a quarter finds more gaps than a policy document nobody reads. Write down who revokes access, who talks to customers, and where the runbook lives.