Zero Trust Without the Enterprise Budget

Zero trust sounds like an enterprise program with a seven-figure line item. For a small team it can be a weekend of work and almost no new spend. The idea is simple: stop trusting the network, and make every request prove who is asking.

Start with what is exposed

List every internal tool that is reachable from outside: dashboards, admin consoles, file servers, self-hosted apps. Most small teams find a few that were opened for convenience and never closed. Each one is a login page facing the whole internet.

Put identity in front, not a port

Instead of forwarding a port, run an outbound-only tunnel from the tool to an identity-aware proxy. Nothing listens publicly. Visitors sign in with the identity provider you already use, and a policy decides who gets through. The tool itself never sees an anonymous request.

Write the policy as a short list

Name the people, require MFA, and deny everything else. A policy that fits on one screen is a policy people actually review. Add groups later, when you have more than a handful of users.

Keep the sensitive things off the internet entirely

Not everything needs remote access. Hypervisor consoles, storage admin, and registries are better reachable only from the local network or a private overlay. The safest exposure is none.

Treat DNS as part of the design

If devices resolve the same name differently at home and away, you will chase confusing failures. Plan split DNS on purpose, and check that IPv6 records are not quietly routing around your controls. I have found exactly that leak, and it is easy to miss.

Document it so it survives you

Script the setup, back up what each script changes, and keep a runbook next to it. Rotating a token should be a procedure you follow, not a project you remember.

The bottom line

You do not need a big budget to stop trusting the network. You need an inventory, an identity provider, a tunnel, and the discipline to leave the sensitive things off the internet.