What zero trust means
Zero trust is a security model in which no user, device or network location is trusted by default. Each request to a resource is checked on its own, using who is asking, from what device and in what context, and gets only the access it needs. Being on the office network or VPN grants nothing by itself.
It is often summed up as 'never trust, always verify'. NIST's zero trust architecture guidance, Special Publication 800-207, describes it as moving defenses from static network perimeters to users, assets and resources.
Why the network perimeter stopped being enough
The older castle-and-moat model trusted anything inside the corporate network. Once attackers got in, through a phished laptop or a compromised server, they could move from system to system because internal traffic was rarely checked.
Work has also moved outside that wall. Staff use cloud applications from home networks and personal devices, and services call each other across providers, so there is no single trusted inside left to defend.
The three principles of zero trust
Most descriptions of zero trust come down to three principles.
- Verify explicitly. Authenticate and authorize each session or request using every signal available: user identity, device health, location, the resource requested and unusual behavior.
- Use least privilege. Grant the minimum access needed for the shortest useful time, and prefer time-limited elevation to standing admin rights.
- Assume breach. Design as if an attacker is already inside. Segment systems so one compromise doesn't reach everything, encrypt traffic between internal services, and log enough to spot misuse.
Identity and device replace network location
In a zero trust setup, the identity provider and device management do the job the network perimeter used to do. A user signs in through single sign-on with multi-factor authentication, and each application checks that identity and the device's state before granting access.
An identity-aware proxy or access gateway in front of internal applications makes this decision per application. A traditional VPN typically places the user on a network segment, while the gateway exposes only the applications that user is allowed to reach.
Services need identities too. Workloads authenticate to each other with short-lived credentials or mutual TLS, where both sides present certificates, instead of trusting any request from an internal IP address.
Practical starting points
Zero trust is adopted in stages. Identity is a sensible first step, because every later control depends on knowing who is asking.
- Inventory users, devices, applications and data, and who needs to reach what. You can't write access rules for systems you don't know about.
- Put every application behind one identity provider with single sign-on, and require phishing-resistant multi-factor authentication such as passkeys or security keys, starting with administrators.
- Remove standing admin rights and shared accounts, and replace long-lived API keys with short-lived, narrowly scoped tokens.
- Check device posture, such as management status, disk encryption and current patches, before granting access to sensitive applications.
- Move the most sensitive internal applications from VPN access to per-application access, then segment the networks behind them.
- Encrypt internal traffic with TLS and collect logs from the identity provider, gateways and applications in one place.
What zero trust does not mean
Zero trust is a set of design decisions, and no single product delivers it. Vendors sell parts, such as identity providers, access proxies and device management, but the model is how you configure and connect them.
It also doesn't mean trusting nobody or locking things down until people can't work. Trust is still granted, only explicitly, per request and with limits.
Breaches remain possible. A stolen session, a compromised device or an over-broad policy can still be abused, and zero trust aims to make each failure smaller and easier to detect. Firewalls and network controls stay as one layer among several instead of the thing that decides trust.