How to go from MFA to Zero Trust: A five phase plan for securing user and device access to applications