Allowing access only via static passwords

Least Privilege access

Assume the network is already breached

Never trust, always verify

Disabling all corporate firewalls

Trusting all devices within the internal VPN