Assume breach
Building our processes and systems assuming that a breach has already happened or soon will.
This means using redundant security mechanisms, collecting system telemetry, using it to detect anomalies, and wherever possible, connecting that insight to automation to allow you to prevent, respond and remediate in near-real-time.
Verify explicitly
To verify explicitly means we should examine all pertinent aspects of access requests instead of assuming trust based on a weak assurance like network location.
Examine the identity, endpoint, network, and resource then apply threat intelligence and analytics to assess the context of each access request.