Zero Trust: Autentikasi Tiap Klik, Bukan Sekali Seumur Hidup

🔀 Read in English 🇬🇧

Selamat Datang di Hajriah Fajar: Hidup Sehat & Cerdas di Era Digital

Zero Trust: Autentikasi Tiap Klik, Bukan Sekali Seumur Hidup

Ada satu masa dalam hidup saya ketika saya percaya sama semua orang di kantor. Ya, termasuk si Dani yang password-nya "123456" dan suka ninggalin laptop kebuka pas ke pantry. "Ah, kan kita satu tim," katanya. Tapi ya itu... sampai suatu hari ada invoice misterius dikirim dari email dia, dan berujung audit kecil-kecilan. Makasih, Dani.

Sejak saat itu saya mulai paham satu hal: kepercayaan itu overrated. Apalagi di jaringan internet. Apalagi kalau kerja remote. Apalagi kalau Dani masih kerja bareng.

Makanya muncul istilah yang sekarang mulai naik daun: Zero Trust. Kalau diterjemahin secara brutal: jangan percaya siapa pun, bahkan rekan sendiri. Bahkan diri sendiri, kadang.

Tapi jangan bayangin Zero Trust itu kayak jadi paranoid atau main tuduh-tuduhan. Justru dia ngajarin kita untuk berhati-hati, bukan parno. Kayak lo punya pacar yang nggak lo kasih password HP-nya, bukan karena nggak cinta, tapi karena cinta sehat itu nggak posesif.

Zero Trust: Apa Sih Itu Sebenernya?

Coba bayangin kamu punya rumah. Biasanya, kalau udah masuk rumah, lo bisa ngelakuin apa aja tanpa ditanya. Mau buka kulkas, nyalain TV, atau nyolong biskuit sisa Lebaran. Nah, sistem lama IT juga begitu: begitu lo login sekali (biasanya pagi), semuanya dibuka. Tapi dengan Zero Trust, setiap pintu di rumah itu punya kunci terpisah, dan lo harus buktiin siapa lo lagi... dan lagi... dan lagi.

Iya, kayak hidup. Kita terus diuji. 😌

Zero Trust ini prinsipnya sederhana tapi ngeselin: never trust, always verify. Setiap akses ke data, sistem, atau layanan harus diverifikasi. Mau buka dokumen HRD? Verifikasi. Mau kirim email ke klien? Verifikasi. Mau masuk toilet kantor? (Oke, ini belum sejauh itu... tapi who knows.)

Dan biasanya diimplementasikan dengan kombinasi hal-hal kayak MFA (Multi-Factor Authentication), kontrol akses berbasis role, segmentasi jaringan, sampai monitoring yang nggak tidur.

Refleksi: Gimana Kalau Kita Terapin ke Hidup Sehari-hari?

Kadang saya mikir, kalau hidup kita dikasih sistem Zero Trust, mungkin nggak akan ada lagi cerita pacaran 7 tahun putusnya pas tunangan. Atau nggak bakal ada drama "gue kira dia sahabat, ternyata pinjam duit gak balik." 😩

Atau... mungkin WiFi publik nggak akan jadi ladang pembantaian data pribadi. Karena jujur, saya juga pernah nekat pakai WiFi bandara buat transfer file HRD. Bodohnya, saya kira pakai VPN yang gratisan itu cukup. Ternyata malah ngasih jalan tol buat orang asing ngintip isinya.

Zero Trust bikin kita sadar: yang bahaya itu bukan "hacker di luar sana", tapi kadang justru mereka yang udah "di dalam". Termasuk kita sendiri.

Tips Praktis Menerapkan Zero Trust di Kantor atau Tim Kecil

1. Wajibkan MFA, walau bikin ribet dikit
Setiap login harus lewat verifikasi dua langkah. Bisa pakai OTP, aplikasi autentikator, atau biometrik. Emang agak ganggu, tapi lebih ganggu lagi kalau data dicuri.

2. Batasi akses berdasarkan kebutuhan, bukan jabatan
Cuma karena dia CEO bukan berarti harus bisa akses semua file. Terapkan prinsip least privilege. Bahkan admin pun nggak boleh punya semua kunci tanpa alasan.

3. Gunakan segmentasi jaringan
Pisahkan jaringan antara tim HR, developer, dan tamu. Jadi kalau satu jaringan kena, nggak langsung nyebar kayak virus gosip di grup WhatsApp RT.

4. Audit dan monitoring secara rutin
Gunakan log dan alert buat ngelacak aktivitas aneh. Nggak perlu paranoid, tapi harus siap kalau suatu hari si Dani buka file yang seharusnya bukan urusannya.

5. Edukasi tim pakai cerita, bukan aturan
Orang lebih gampang inget cerita daripada prosedur 10 halaman. Ceritain kasus nyata, atau minimal kasih meme biar nggak bosan.

Penutup: Nggak Semua Harus Dipercaya, Tapi Semua Bisa Dijaga

Zero Trust bukan berarti kita hidup penuh kecurigaan. Tapi ini tentang membangun sistem yang sadar bahwa manusia (dan sistem) bisa salah. Bisa lupa. Bisa nekat buka link giveaway iPhone jam 3 pagi.

Dan itu bukan salah siapa-siapa. Tapi kita bisa bikin cara agar kalaupun ada yang salah, dampaknya nggak nyeret semua tim.

Jadi... apakah kamu udah cukup percaya sama sistemmu? Atau kamu baru sadar kamu terlalu percaya sama Dani?

Welcome to Hajriah Fajar: Living Smart & Healthy in the Digital Age

Zero Trust: Authenticate Every Click, Not Once in a Lifetime

There was a time in my life when I trusted everyone at work. Yes, even Dani — whose password was literally "123456" and who'd leave his laptop open while getting coffee. "We're a team, right?" he said. That was… until a mystery invoice was sent from his email and we ended up with a mini audit. Thanks, Dani.

From that day, I learned something: trust is overrated. Especially on networks. Especially when working remotely. Especially if Dani is still employed.

Hence the rise of this fun little term: Zero Trust. Roughly translated: trust no one — not even yourself sometimes.

But don’t get me wrong, Zero Trust isn’t about being paranoid. It’s about being careful. Like how you don’t share your phone password with your partner—not because you don’t love them, but because healthy love isn’t controlling.

Zero Trust Explained, Absurdly

Imagine your home. Normally, once you're inside, you can do whatever you want. Open the fridge, watch TV, steal leftover cookies. Old IT systems were like that: one login in the morning, and you're free to roam. Zero Trust changes that. Every room in your house has a different key. And you need to prove who you are again… and again… and again.

Yes, like life. We’re always being tested. 😌

Zero Trust is based on a painfully simple rule: never trust, always verify. Every access to data, systems, or services requires verification. Want to open an HR doc? Verify. Email a client? Verify. Use the office toilet? (Okay, not yet… but who knows.)

It usually involves MFA, role-based access, network segmentation, and obsessive monitoring.

Real-Life Reflections

Sometimes I wonder: if life had a Zero Trust policy, we wouldn’t have those stories like “we dated for 7 years, then broke up at the engagement.” Or “I thought she was my best friend—turns out she just wanted a loan.” 😩

And maybe public WiFi wouldn’t be a data disaster zone. Honestly, I once transferred HR files via airport WiFi. I thought free VPNs would protect me. Instead, they rolled out the red carpet for strangers to peek in.

Zero Trust reminds us: threats aren’t just “hackers out there.” Sometimes it’s the ones already inside. Including… us.

Practical Tips to Start Zero Trust in Your Team

1. Enforce MFA, even if it’s annoying
Every login should have two-factor authentication. OTPs, apps, biometrics — all better than cleaning up a breach.

2. Limit access by role, not title
Being the CEO doesn’t mean you need access to everything. Use least privilege. Even admins shouldn’t have all keys without reason.

3. Segment the network
HR, developers, and guests should be on separate networks. If one gets hit, it won’t spread like a gossip chain in the neighborhood WhatsApp group.

4. Audit and monitor often
Use logs and alerts to spot weird activity. Don’t panic, but be ready when Dani opens something he shouldn’t.

5. Educate with stories, not manuals
People remember stories more than 10-page protocols. Share real cases, or at least use memes to keep it engaging.

Final Thoughts: Trust Less, Protect More

Zero Trust isn’t about living in fear. It’s about building a system that assumes mistakes are human. We forget. We slip. We click suspicious links at 3am.

It’s no one’s fault. But we can design things so when someone messes up, it doesn’t wreck the whole ship.

So… are you trusting your systems too much? Or did you just remember Dani still has access to payroll?