# Zero Trust - Link: https://www.agilicus.com/blog/zero-trust-blog/ - Published: 2020-12-25T21:25:33+00:00 - Author: Don Bowman ![zero trust security](https://www.agilicus.com/www/413ff24e-connected-world.svg) # Zero Trust --- ## Overview [Zero-Trust security](https://www.agilicus.com/zero-trust-principles/). Switch from a perimeter-based (firewall and VPN) model of access to a user to resource model. Implement strong, simple identity. Identity for both a person, but also a system. Decouple the identity from the corporation: make it affinitive to the user, a single identity. Enforce entitlements and authorisation in the network. This micro-segmentation is simpler to use, more accessible, and, more secure. It reduces the lateral-traversal, it empowers the users, it increases the audit capability. And, its more economical, more scalable. Everybody wins. --- ## Articles * [⌊The Epitome of Absolute Trust: Why Legacy Virtual Private Networks Are a Liability⌉⌊ The Epitome of Absolute Trust: Why Legacy Virtual Private Networks Are a Liability⌉[ * ## 󠀁[The Epitome of Absolute Trust: Why Legacy Virtual Private Networks Are a Liability](https://www.agilicus.com/the-epitome-of-absolute-trust-why-legacy-virtual-private-networks-are-a-liability/)󠁿 * Legacy virtual private networks are a liability, acting as an ethernet cable into your deep infrastructure. With active exploitation of obsolete protocols on the rise, organisations must abandon absolute trust. Discover why modernising access through an Identity-Aware Proxy is the only pragmatic defence against perimeter zero-day vulnerabilities. * [⌊Defence in Depth: Zero Trust is a Critical Layer, Not a Panacea⌉⌊Defence in Depth: Zero Trust is a Critical Layer, Not a Panacea⌉[ * ## 󠀁[Defence in Depth: Zero Trust is a Critical Layer, Not a Panacea](https://www.agilicus.com/defence-in-depth-zero-trust-is-a-critical-layer-not-a-panacea/)󠁿 * “Defence in Depth” strategy, explaining why zero trust is a critical layer in protecting critical infrastructure. From the medieval castle analogy to the “ lizard brain” risks of AI-amplified human engineering, learn why layered security and strong authentication are more important than ever in 2026. * [⌊Securing the Flow: GAO Highlights Persistent Cyber Threats to Water and Wastewater Systems⌉⌊Securing the Flow: GAO Highlights Persistent Cyber Threats to Water and Wastewater Systems⌉[ * ## 󠀁[Securing the Flow: GAO Highlights Persistent Cyber Threats to Water and Wastewater Systems](https://www.agilicus.com/securing-the-flow-gao-highlights-persistent-cyber-threats-to-water-and-wastewater-systems/)󠁿 * A recent Government Accountability Office report reveals that nearly 170,000 water systems are increasingly vulnerable to sophisticated cyberattacks. Because the air gap is dead, traditional virtual private networks no longer provide adequate protection. Agilicus AnyX secures critical infrastructure by implementing Zero Trust Architecture, replacing perimeter-based defences with precise, identity- based access and mandatory Multi-Factor Authentication. * [⌊NERC CIP Compliance for Small Independent Power Producers: A Pragmatic Approach⌉⌊ NERC CIP Compliance for Small Independent Power Producers: A Pragmatic Approach⌉[ * ## 󠀁[NERC CIP Compliance for Small Independent Power Producers: A Pragmatic Approach](https://www.agilicus.com/nerc-cip-compliance-for-small-independent-power-producers-a-pragmatic-approach/)󠁿 * With the April 1, 2026 enforcement date for NERC CIP-003-9 past, small Independent Power Producers (IPPs) face unique regulatory pressures. This post explores a pragmatic approach to securing low-impact assets, replacing legacy VPNs with a zero trust architecture that automates vendor access controls and simplifies audit evidence retention. * [⌊Cyber Security Is Physical Safety: Lessons From a Thermal Runaway⌉⌊Cyber Security Is Physical Safety: Lessons From a Thermal Runaway⌉[ * ## 󠀁[Cyber Security Is Physical Safety: Lessons From a Thermal Runaway](https://www.agilicus.com/cyber-security-is-physical-safety-lessons-from-a-thermal-runaway/)󠁿 * A report on a recent B.C. EV charger fire reveals the danger of relying on software for physical safety. Learn why hardware interlocks and zero trust are non-negotiable for remote maintenance. * [⌊Water utility cybersecurity: The nearly £1 million lesson from South Staffordshire Water⌉⌊Water utility cybersecurity: The nearly £1 million lesson from South Staffordshire Water⌉[ * ## 󠀁[Water utility cybersecurity: The nearly £1 million lesson from South Staffordshire Water](https://www.agilicus.com/water-utility-cybersecurity-the-nearly-1-million-lesson-from-south-staffordshire-water/)󠁿 * The £963,900 ICO fine against South Staffordshire Water highlights the fatal flaw in perimeter-based security. Learn how Agilicus Zero Trust architecture addresses identity failures and the ‘legacy headache’ in critical infrastructure. * [⌊Fortifying Critical Infrastructure: The Shift from Defensible to Isolated⌉⌊ Fortifying Critical Infrastructure: The Shift from Defensible to Isolated⌉[ * ## 󠀁[Fortifying Critical Infrastructure: The Shift from Defensible to Isolated](https://www.agilicus.com/fortifying-critical-infrastructure-the-shift-from-defensible-to-isolated/)󠁿 * CISA’s Critical Infrastructure Fortify initiative demands a fundamental shift in how we secure our most vital assets. By assuming connectivity is unreliable and networks are already compromised, we must move toward proactive isolation. Discover how Agilicus AnyX enables a ‘disconnected yet connected’ Zero Trust architecture that replaces the vulnerable VPN perimeter with secure, identity- based access. * [⌊Securing Canada’s Critical Energy Infrastructure: Navigating New Cybersecurity Regulations with Zero-Trust Architecture⌉⌊Securing Canada’s Critical Energy Infrastructure: Navigating New Cybersecurity Regulations with Zero-Trust Architecture⌉[ * ## 󠀁[Securing Canada’s Critical Energy Infrastructure: Navigating New Cybersecurity Regulations with Zero-Trust Architecture](https://www.agilicus.com/securing-canadas-critical-energy-infrastructure-navigating-new-cybersecurity-regulations-with-zero-trust-architecture/)󠁿 * For Canadian energy and utility operators, complying with stringent new cybersecurity mandates like the Canadian Standards Association Z246.1:21, Alberta Regulation 84/2024, and British Columbia Utilities Commission guidelines is no longer optional. Discover how Agilicus AnyX enables operators to seamlessly implement multi-factor authentication, strict network segmentation, and zero-trust remote access for legacy industrial control systems—without ripping and replacing existing infrastructure or relying on vulnerable virtual private networks. * [⌊The Fragility of Interdependence: Securing the Industrial Mesh⌉⌊The Fragility of Interdependence: Securing the Industrial Mesh⌉[ * ## 󠀁[The Fragility of Interdependence: Securing the Industrial Mesh](https://www.agilicus.com/the-fragility-of-interdependence-securing-the-industrial-mesh/)󠁿 * The £1.9bn JLR breach exposed supply chain fragility. Download the Agilicus whitepaper to learn how Zero Trust secures the industrial mesh against cyber threats. * [⌊Digital Disenfranchisement: Stop Treating Your Frontline Like Second-Class Citizens⌉⌊Digital Disenfranchisement: Stop Treating Your Frontline Like Second- Class Citizens⌉[ * ## 󠀁[Digital Disenfranchisement: Stop Treating Your Frontline Like Second-Class Citizens](https://www.agilicus.com/digital-disenfranchisement-stop-treating-your-frontline-like-second-class-citizens/)󠁿 * Are your bus drivers and contractors stuck using paper because IT can’t secure their devices? It’s time to stop the ‘Digital Disenfranchisement’ and use Zero Trust to safely connect everyone, everywhere. * [⌊The 4-Day Warning: New SEC Cyber Rules Hit the Factory Floor⌉⌊The 4-Day Warning: New SEC Cyber Rules Hit the Factory Floor⌉[ * ## 󠀁[The 4-Day Warning: New SEC Cyber Rules Hit the Factory Floor](https://www.agilicus.com/the-4-day-warning-new-sec-cyber-rules-hit-the-factory-floor/)󠁿 * Consequently, trying to scope an attack in a sprawling operatioanl tech network is like trying to find a needle in a haystack, except the haystack is currently on fire, and you are not allowed to use water because it might short-circuit the only machine that is still running. * [⌊Cleaning Up the Mess: How One Disgruntled Contractor Trashed a Network (And How to Stop It)⌉⌊Cleaning Up the Mess: How One Disgruntled Contractor Trashed a Network (And How to Stop It)⌉[ * ## 󠀁[Cleaning Up the Mess: How One Disgruntled Contractor Trashed a Network (And How to Stop It)](https://www.agilicus.com/cleaning-up-the-mess-how-one-disgruntled-contractor-trashed-a-network-and-how-to-stop-it/)󠁿 * An ex-contractor’s revenge cost a firm $862K. This cybersecurity story reveals a critical flaw in vendor access and how to prevent it. * [⌊Ditch the Digital Ostrich: How Zero Trust is Saving Municipalities (and Their Wallets) from Cyber Chaos⌉⌊Ditch the Digital Ostrich: How Zero Trust is Saving Municipalities (and Their Wallets) from Cyber Chaos⌉[ * ## 󠀁[Ditch the Digital Ostrich: How Zero Trust is Saving Municipalities (and Their Wallets) from Cyber Chaos](https://www.agilicus.com/ditch-the-digital-ostrich-how-zero-trust-is-saving-municipalities-and-their-wallets-from-cyber-chaos/)󠁿 * Facing rising cyber insurance costs? For municipalities, risky VPNs are a major hurdle. Learn how Zero Trust secures systems and lowers insurance risk. * [⌊Your Air Gap is a Lie, and Other Inconvenient Truths About Industry 4.0⌉⌊Your Air Gap is a Lie, and Other Inconvenient Truths About Industry 4.0⌉[ * ## 󠀁[Your Air Gap is a Lie, and Other Inconvenient Truths About Industry 4.0](https://www.agilicus.com/your-air-gap-is-a-lie-and-other-inconvenient-truths-about-industry-4-0/)󠁿 * For years, the security model for water systems has been the air gap—a mythical wall where everything inside is trusted and everything outside is not. The problem? That air gap already has a bunch of holes in it, and Industry 4.0 is making more. * [⌊You Have a Login, But You Shall Not Pass: The Magic of Fine-Grained Authorisation⌉⌊ You Have a Login, But You Shall Not Pass: The Magic of Fine-Grained Authorisation⌉[ * ## 󠀁[You Have a Login, But You Shall Not Pass: The Magic of Fine-Grained Authorisation](https://www.agilicus.com/you-have-a-login-but-you-shall-not-pass-the-magic-of-fine-grained-authorisation/)󠁿 * Authentication gets you in the door, but fine-grained authorisation decides which rooms you can enter. This principle ensures users access only the specific resources they need, making your systems more secure by rendering everything else invisible to them. * [⌊AI-Powered Cyber Threats: Protecting Your Critical Infrastructure⌉⌊AI-Powered Cyber Threats: Protecting Your Critical Infrastructure⌉[ * ## 󠀁[AI-Powered Cyber Threats: Protecting Your Critical Infrastructure](https://www.agilicus.com/ai-powered-cyber-threats-protecting-your-critical-infrastructure/)󠁿 * AI amplifies cyber risks for critical infrastructure, making attackers more effective. CISA’s FY23 report shows 80% of successful attacks exploit identity weaknesses like valid accounts and spearphishing. AI isn’t creating new vulnerabilities, but leveraging existing ones. Implementing Zero Trust and universal Single Sign- On significantly reduces these risks, making organizations a harder target. * [⌊CityWorks CVE Breaches IIS⌉⌊CityWorks CVE Breaches IIS⌉[ * ## 󠀁[CityWorks CVE Breaches IIS](https://www.agilicus.com/cityworks-cve-breaches-iis/)󠁿 * CityWorks breach leads to lateral traversal through IIS and onwards into your network. Protect it with Agilicus AnyX while you work on upgrading. * [⌊Krooked Kriminals Krack Krispy Kreme⌉⌊Krooked Kriminals Krack Krispy Kreme⌉[ * ## 󠀁[Krooked Kriminals Krack Krispy Kreme](https://www.agilicus.com/krooked-kriminals-krack-krispy-kreme/)󠁿 * Krispy Kreme materially impacted by cyber security issue, files SEC-8K disclosure. * [⌊CityNews The Mike Farwell Show Interview⌉⌊CityNews The Mike Farwell Show Interview⌉[ * ## 󠀁[CityNews The Mike Farwell Show Interview](https://www.agilicus.com/citynews-the-mike-farwell-show-interview/)󠁿 * This morning I was interviewed on the Mike Farwell Show (CityNews). You can check the interview here @ 54:50. * [⌊SolarWinds Gives Federal Agencies Labour Day Present⌉⌊SolarWinds Gives Federal Agencies Labour Day Present⌉[ * ## 󠀁[SolarWinds Gives Federal Agencies Labour Day Present](https://www.agilicus.com/solarwinds-gives-federal-agencies-labour-day-present/)󠁿 * SolarWinds Web Help Desk CVE-2024-28986 (rated 9.8 our of 10) is now included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog, indicating its active use in cyber attacks, giving affected agencies until September 5, 2024 to fix the flaw under Binding Operational Directive 22-01. How fun. * [⌊10 Billion Reasons Shared Passwords Are Bad: RockYou2024⌉⌊10 Billion Reasons Shared Passwords Are Bad: RockYou2024⌉[ * ## 󠀁[10 Billion Reasons Shared Passwords Are Bad: RockYou2024](https://www.agilicus.com/10-billion-reasons-shared-passwords-are-bad-rockyou2024/)󠁿 * Shared password bad. 10 billion passwords leaked. Your team installed some shadow IT remote access solution with a shared password. * [⌊Get Thee From BGP Rockwell: Ethernet/IP Is not Internet⌉⌊Get Thee From BGP Rockwell: Ethernet/IP Is not Internet⌉[ * ## 󠀁[Get Thee From BGP Rockwell: Ethernet/IP Is not Internet](https://www.agilicus.com/get-thee-from-bgp-rockwell-ethernet-ip-is-not-internet/)󠁿 * You wouldn’t download a PLC, would you? Rockwell Automation alert on public access to PLC, and a Shodan search to fact check it. * [⌊Begone Ivanti Industrial VPN Sayeth CISA⌉⌊Begone Ivanti Industrial VPN Sayeth CISA⌉[ * ## 󠀁[Begone Ivanti Industrial VPN Sayeth CISA](https://www.agilicus.com/begone-ivanti-industrial-vpn-sayeth-cisa/)󠁿 * ED 24-01 directs agencies to instantly remove Ivanti Industrial VPN from industrial operations. Defence In Depth, Zero Trust give you more time to react. * [⌊Using Zero Trust to Enable Secure Remote Access to SCADA for Water Systems⌉⌊ Using Zero Trust to Enable Secure Remote Access to SCADA for Water Systems⌉[ * ## 󠀁[Using Zero Trust to Enable Secure Remote Access to SCADA for Water Systems](https://www.agilicus.com/using-zero-trust-to-enable-secure-remote-access-to-scada-for-water-systems/)󠁿 * This blog post explores the challenges of securing remote access to SCADA systems and how Zero Trust can act as a solution. * [⌊Zero Trust vs. VPN: A Comprehensive Comparison for Secure Remote Access⌉⌊Zero Trust vs. VPN: A Comprehensive Comparison for Secure Remote Access⌉[ * ## 󠀁[Zero Trust vs. VPN: A Comprehensive Comparison for Secure Remote Access](https://www.agilicus.com/zero-trust-vs-vpn-a-comprehensive-comparison-for-secure-remote-access/)󠁿 * In this blog post, we’ll dive into the Zero Trust vs. VPN security model differences and why the former is ultimately the far superior choice for secure, seamless remote access.  * [⌊SSH for Remote Access: Every User, Every Device, Every Application⌉⌊SSH for Remote Access: Every User, Every Device, Every Application⌉[ * ## 󠀁[SSH for Remote Access: Every User, Every Device, Every Application](https://www.agilicus.com/ssh-for-remote-access-every-user-every-device-every-application/)󠁿 * In this blog post, we’ll delve into the challenges of enabling SSH for remote access and how you can do so without compromising security through Zero Trust. * [⌊Simplifying Secure Access: Enabling Rockwell Automation Remote PLC Access Without a VPN⌉⌊Simplifying Secure Access: Enabling Rockwell Automation Remote PLC Access Without a VPN⌉[ * ## 󠀁[Simplifying Secure Access: Enabling Rockwell Automation Remote PLC Access Without a VPN](https://www.agilicus.com/simplifying-secure-access-enabling-rockwell-automation-remote-plc-access-without-a-vpn/)󠁿 * In this post, we’ll explore the limitations of VPNs and delve into how to enable Rockwell Automation remote PLC access. * [⌊Split Horizon VPN: Unsafe At Any Speed⌉⌊Split Horizon VPN: Unsafe At Any Speed⌉[ * ## 󠀁[Split Horizon VPN: Unsafe At Any Speed](https://www.agilicus.com/split-horizon-vpn-unsafe-at-any-speed/)󠁿 * Split Horizon VPN’s are used to avoid breaking video conferencing. They are unsafe. See paper for route injection issues. * [⌊NIST sp 800-63A: Introduce Yourself⌉⌊NIST sp 800-63A: Introduce Yourself⌉[ * ## 󠀁[NIST sp 800-63A: Introduce Yourself](https://www.agilicus.com/nist-sp-800-63a-introduce-yourself-2/)󠁿 * Who are you? Identity involves knowing who you are, and then later proving it. NIST sp 800-63A enrollment is the first step, let’s talk about that! * [⌊The Security Risks of Using VPNs in Water and Wastewater Facilities⌉⌊The Security Risks of Using VPNs in Water and Wastewater Facilities⌉[ * ## 󠀁[The Security Risks of Using VPNs in Water and Wastewater Facilities](https://www.agilicus.com/the-security-risks-of-using-vpns-in-water-and-wastewater-facilities/)󠁿 * What are the risks of using VPNs in water and wastewater facilities? We’ll help you answer that question and understand what to do instead. [Next Page](https://www.agilicus.com/blog/zero-trust-blog/?output_format=markdown&query-20-page=2) ---