Zero Trust

Zero Trust is not a product — it’s a security philosophy that eliminates implicit trust in any user, device, or network. Alchemilla Ventures helps organisations implement Zero Trust architectures, guiding enterprises through this fundamental security transformation.

The Case for Zero Trust

Traditional perimeter-based security assumes everything inside the corporate network is safe. This model crumbled as enterprises adopted cloud, remote work, and BYOD. Zero Trust’s “Never Trust, Always Verify” principle — verify every access request, regardless of source — is now mandated by for banks and recommended by for all critical infrastructure organisations.

Our Zero Trust Implementation Services

• Zero Trust Strategy & Roadmap: We begin with a maturity assessment against NIST SP 800-207 (Zero Trust Architecture) and CISA’s Zero Trust Maturity Model. Our consultants create a phased roadmap — identity-first, then devices, then networks, then applications and data — aligned to your business priorities and risk tolerance.

• Identity-Centric Security: The foundation of Zero Trust is robust identity and access management. We implement:

• Multi-Factor Authentication (MFA) across all access points using Okta, Azure AD, or PingIdentity. Phishing-resistant MFA (FIDO2/WebAuthn) for privileged users.

• Single Sign-On (SSO) with conditional access policies that evaluate user risk, device health, and location before granting access.

• Privileged Access Management (PAM) with just-in-time access, session recording, and password vaulting using CyberArk, BeyondTrust, or HashiCorp Vault.

• Identity Governance: Automated provisioning/de-provisioning, access reviews, and segregation of duties for the countryn regulatory compliance.

• Device Trust & Endpoint Security: Verify device health before granting access:

• Device compliance policies (patch level, encryption, firewall status) enforced via Microsoft Intune, Jamf, or Workspace ONE

• Certificate-based device authentication

• Integration between endpoint security (CrowdStrike, Defender) and access decisions — automatically block compromised devices

• BYOD segmentation using MAM (Mobile Application Management) without full MDM enrolment

• Network Micro-Segmentation: Replace flat networks with granular, identity-based segmentation:

• Software-Defined Perimeter (SDP) solutions like Zscaler Private Access or AppGate SDP

• Cloud-native segmentation using security groups, NSGs, and Kubernetes network policies

• Micro-segmentation with Illumio or Guardicore for east-west traffic control in data centres

• Network access that follows the user — no more VPN-based access to broad network ranges

• Application & Data Protection: Extend Zero Trust to the application and data layers:

• API security gateways with OAuth 2.0/OIDC enforcement

• Data classification and labelling with Microsoft Purview or Varonis

• Data Loss Prevention (DLP) policies that follow data regardless of location

• Encryption everywhere — at rest, in transit, and in use (confidential computing for highly sensitive workloads)

• Continuous Monitoring & Verification: Zero Trust doesn’t end at authentication — it continuously verifies:

• User and Entity Behaviour Analytics (UEBA) to detect anomalous activity

• Session risk re-evaluation — terminate sessions that become risky

• Automated response — force re-authentication or block access based on real-time signals

Zero Trust Maturity Journey

Pillar	Traditional	Initial	Advanced	Optimal
Identity	Username + password	MFA for admins	MFA everywhere, conditional access	Phishing-resistant MFA, continuous auth
Device	Unmanaged	MDM for corporate devices	Compliance-enforced access	Real-time device risk scoring
Network	Flat network, VPN	Basic segmentation	Micro-segmentation, SDP	Fully software-defined perimeter
Applications	Direct access	SSO, basic API auth	OAuth 2.0/OIDC, API gateways	Continuous API security monitoring
Data	Unclassified	Basic DLP	Automated classification	Dynamic data protection policies

the country Regulatory Alignment

• Guidelines on IT Governance (2023): Mandates Zero Trust principles for banks, including network segmentation, MFA, and continuous monitoring.
• Security Guidelines: Recommends Zero Trust for critical information infrastructure.
• Cyber Resilience Framework: Requires identity-centric security and network segmentation for market infrastructure institutions.
• DPDP Act 2023: Zero Trust data protection controls support compliance with purpose limitation, storage limitation, and security safeguard requirements.

Implementing Zero Trust is a journey, not a project. Let our Zero Trust architects build your roadmap and guide your transformation. Contact us for a Zero Trust maturity assessment.