Zero Trust is a security model based on the principle “never trust, always verify”: no user, device or network connection is trusted automatically, and every access request is checked.
How Zero Trust works
The traditional “castle and moat” model trusted everything inside the corporate network. Zero Trust, a term popularized by Forrester analyst John Kindervag in 2010, assumes the network is already compromised. Google’s BeyondCorp project put it into practice, and NIST described it in SP 800-207 (2020). Core principles:
- verify explicitly – every request is authenticated and authorized using identity, device health, location and risk;
- least privilege – users and services get only the access they need, for as long as they need it;
- assume breach – segment resources, encrypt traffic and monitor continuously to limit damage.
Typical building blocks: single sign-on with strong MFA, device management, micro-segmentation, and Zero Trust Network Access (ZTNA), which gives access to individual applications instead of the whole network like a classic VPN.
Why Zero Trust matters for security
With cloud services, remote work and personal devices, there is no clear network perimeter anymore. Attackers who get one account or one device should not be able to reach everything through lateral movement. US Executive Order 14028 (2021) required federal agencies to move to Zero Trust, and many companies follow. Zero Trust is not a product you buy but a long-term architecture change; vendors often use the label for marketing.
How to start
- Inventory users, devices, applications and data flows.
- Consolidate identities, enforce phishing-resistant MFA and check device compliance.
- Replace broad VPN access with per-application access and segment critical systems.
- Log and review every access decision.
