Zero trust for a 30-person company: VPN, reverse proxies and a patch that reached production

Zero trust sounds like a topic for a bank with a security department. This week Forrester, Red Hat and Docker wrote about it, and between the lines each of them has the same question: what should a company do about it when there is no security department, only one person responsible for the server. I am that person at several companies, and below is what I have settled on.

What came out

On October 23, Forrester returned to “Zero Trust on a beer budget” and called the post “minimum viable zero trust.” The intended reader is clear from the intro: someone who has read the reference architectures and BeyondCorp, tried to find themselves in one of the maturity models and couldn't figure out where to start. I won't retell Forrester's recipe; I'll give my own.

On October 22, Red Hat published the fourth part of its series on zero trust in OpenShift. Their wording is exact: zero trust is easy to describe in one phrase, “never trust, always verify,” and hard to make repeatable. The phrase doesn't say what to deploy on Monday morning or how to show an auditor that the control works. OpenShift is not the right scale for a 30-person company, but the Monday question is the right one.

Three days earlier, on October 19, Red Hat wrote about patches, and to me it is the most important post of the week. The patch was ready in days and took months to reach production. In conversations with customers the answer is almost never “we didn't know,” almost always “we knew, but getting it to production took longer than the exploitation window.” They call this delay one of the most underrated risk metrics: AI compresses time-to-exploit to hours, while many organizations still spend 40 to 90 days on rebuilding and validation.

On October 21, Docker described the Secure Software Factory, a reference architecture for teams where AI agents change code, run tests and hand the result to a person. It grew out of the Agent Baseline that Docker, Snyk and Keycard published in July. Teams, they say, get speed and along with it agents that delete databases and push to production without approval. The central idea: the more autonomy an agent has, the less it can be relied on, and control must live in the environment where it runs. It is the same idea as zero trust, only about a program instead of an employee.

On October 22, Manufacturing Today listed eight cybersecurity practices for manufacturers: connected machines and the industrial internet of things bring productivity and new vulnerabilities at the same time. The list itself isn't in the announcement; mine is below.

A factory where the contractor sees everything

Take a manufacturing company. There is a network on the shop floor, and on it the machines, the 1C server, the network folders with drawings, and the laptop of a contractor who came to set up the laser. He connected to the Wi-Fi, and now everything inside is open to him: the SMB folders, the database, the printers. The network is built on the principle “inside means one of us.”

The conclusion: “inside the network” stops being an access right. A specific person or program gets access to a specific service, and whoever is responsible for that service grants it.

How I set it up

At the hydroponic farm in the US, which I have worked with since 2023, there are 25 controllers across 2 sites, and the site networks have private IPs with no public address. For the server on Debian in Google Cloud to see the controllers, I set up reverse proxies, NAT, a firewall and a VPN. Together it is one network where the server has access to every controller and nobody can reach them from outside. I don't disclose the addresses or the network products; it is the client's private infrastructure.

At the PDR company in the US, which now has more than 30 people, security questions come to me. The system has several layers of protection and backups. I maintain the server, the VPN, the network equipment and the telephony myself, and when there is a major breach somewhere in the world I check whether it affects us. Since 2022, when the company got its own server, there have been no serious failures requiring recovery.

At the manufacturing company where I built the parts calculation from Excel specifications, the web version of the program opens only inside the company network and is restricted by ACL, and the program reaches the SMB network folders through a VPN. The calculation logic itself lives on the server, and without access to it the client side calculates nothing: the client wanted a program that couldn't be carried off.

That is zero trust at my size: no platform and no department, on a VPN, reverse proxies and permissions granted for a specific service.

What I would do at a 30-person company

Make a list of everything open to the internet: the website, the API, telephony, remote access, cameras, printers. Everything that isn't for customers goes behind a VPN or a reverse proxy.

For each service, write down who connects to it and why, and give access to exactly those people and programs. A contractor gets access to one service for the duration of the job.

Measure one number, as Red Hat suggests: how many days pass from a patch's release until it is running in production. If it is weeks, work out where it gets stuck: approval, the build, or nobody to do it.

Rehearse a restore from backup.

If you use AI assistants in development, give them the same rights as a contractor: a limited environment and no access to production.

On the server as the shared center that holds state and checks permissions: the article The server: data, access and process execution. Infrastructure that can be released and restored: DevOps and infrastructure. The networks from this text are described in the hydroponic farm and technical partner to a PDR company cases. From neighboring reviews: PHP2Shell and checking your own servers, a business logic flaw and why a small business is fine with Docker Compose; earlier I wrote about a closed loop and working without the internet. If your access list isn't written down, tell me how everything is set up now, and I'll suggest where to start. Discuss your task.