Zero Trust

What it is

Zero Trust is a security model built on one idea: being inside the network does not make you trustworthy. Every access request, whether it comes from the office, from home or from another system, is verified before it is granted, and it is granted only for what is needed.

Its motto is “never trust, always verify”. The term was popularized by John Kindervag, then a Forrester analyst, in 2010. NIST formalized it in publication SP 800-207 (2020).

The problem it solves

The traditional model is a castle and moat: a strong firewall outside and full trust inside. It worked when everyone was in the office and systems lived in one data center. Today there is remote work, cloud, SaaS and connected vendors, and the perimeter no longer exists. And if an attacker gets in with a stolen account, in the castle model they can move freely.

Principles

Principle	In practice
Verify explicitly	Identity (with MFA), device health, location and risk on every access
Least privilege	Each person or service reaches only what it needs, and ideally only for as long as needed
Assume breach	Design as if the attacker is already inside: segment, encrypt and log everything

CISA’s maturity model (version 2.0, 2023) organizes it into five pillars: identity, devices, networks, applications and workloads, and data.

What it looks like in a company

• Access to applications by identity, not by being on the VPN.
• Segmentation: the accounting team cannot “see” development servers.
• Service accounts with minimal permissions and rotating secrets.
• Logging and monitoring of every access, to spot unusual behavior.

Demo example: a vendor needs to check a test server. Instead of VPN access to the whole network, they get access to that server only, with MFA, for two weeks, with every session logged.

Common misconceptions

❌ “Zero Trust is a product you buy” → It is a strategy. Products help, but it is implemented in stages, starting with identity and critical access.

❌ “It means distrusting employees” → It means giving no one implicit access. It also protects employees when their account is stolen.

Related terms

• MFA - Strong identity verification, the foundation of the model
• Phishing - With Zero Trust, a stolen account reaches much less
• Ransomware - Segmentation limits how much an attack can encrypt
• Microservices - Each service authenticates to the others; internal trust is not assumed

---

Official resources:

• NIST SP 800-207 - Zero Trust Architecture
• CISA - Zero Trust Maturity Model