Never trust
Location is not a credential. Being on the office Wi-Fi, on a VPN, or “the usual laptop” is not enough. Access starts at zero.
Approach
Zero Trust is a method, not a verdict on my character.
I do not trust the internet, and neither should you. The old model assumed the office was safe and the internet was not. That perimeter never really existed here — and it doesn’t exist on a laptop in a pickup on the Glenn either. Access is earned, then checked again.
Always verify
Identity, device health, and the specific job to be done are checked continuously — not once at login and forgotten until next year.
Least privilege
People get the access the work requires, not a shared admin password taped under a keyboard. When the role ends, so does the access.
In practice
What this looks like for a small team.
Identity first
Staff sign in as themselves. Shared mailboxes and ‘front desk’ passwords get retired. Vendors get their own access, with an end date.
Devices that can be trusted — or can’t
A personal laptop on café Wi-Fi should not have the same reach as a managed workstation. We draw that line where the business actually needs it.
Backups that restore
A green checkmark is not a restore. We test. Especially when the only copy lives in a closet that floods, or on a drive that flew home with someone.
A map, not a myth
You get a plain-language picture of who can reach what. When someone leaves, the map tells you what to cut — the same day.
What I will not do
- Scare you into a stack you don’t need.
- Hide behind a portal when a phone call would finish the job.
- Pretend a firewall is a strategy.
- Take on more work than I can stand behind.