Tutorials · Security Operations
How to Start Zero Trust Networking Step by Step
Zero trust means never trusting a device just because it is inside the network. A practical path for small and mid-size companies: identity, device checks, segmentation and least-privilege access.
Before you start
- An inventory of users, devices and applications
- An identity provider with MFA (Microsoft Entra ID, Google Workspace, Okta or similar)
- Managed switches, Wi-Fi and a firewall that support VLANs and 802.1X
Step by step
Know what you protect
List your critical applications and data (finance, customer data, CCTV, production systems) and who really needs access to each.
Make identity the front door
Enforce MFA for every user, phishing-resistant MFA for admins, and single sign-on for applications so access is controlled in one place.
Check devices before access
Only managed, encrypted and patched devices get access to company apps. Use device compliance in your identity provider and 802.1X on wired and Wi-Fi networks.
Segment the network
Put users, servers, management, CCTV, IoT and guests in separate VLANs, and allow only the traffic each group needs between them.
Replace broad VPN access
Give remote users access to specific applications instead of the whole network: per-application rules on the VPN, or an identity-aware access proxy.
Least privilege for admins
Separate admin accounts, just-in-time elevation and access to management interfaces only from the management VLAN or a jump host.
Monitor and adjust
Send identity, firewall and network logs to a SIEM. Review denied traffic and unusual logins every week and tighten rules step by step.
Pro tips
- Zero trust is a journey, not a product: start with MFA and segmentation, which give the biggest risk reduction.
- Write down allowed flows between segments; it becomes your firewall rule base.
FAQ
Frequently asked questions
Do we need to replace our network?
Usually not. Managed switches with VLANs and 802.1X, a good firewall and your identity provider cover most of the first steps.
Keep learning
Related guides
Segment IoT and CCTV
Read more →802.1X port authentication
Read more →Phishing-resistant MFA with passkeys
Read more →How to Set Up a WireGuard VPN Server for Remote Access
WireGuard is a fast, modern VPN with a small, auditable code base. Build a WireGuard server on Linux, add users with their own keys and route them only to the networks they need.
Read more →How to Scan Your Network for Vulnerabilities With Nmap and OpenVAS
Find open ports, outdated services and known vulnerabilities before attackers do. Discover hosts with Nmap, then run authenticated vulnerability scans with Greenbone OpenVAS and fix what matters first.
Read more →How to Build a Free SIEM With Wazuh for Network and Server Logs
A SIEM collects logs from servers, firewalls and switches in one place and alerts on attacks. Install Wazuh, add agents and syslog sources, and tune the first alerts.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.