Classic security concepts followed the image of a castle: a firewall protects the perimeter, and anyone inside the corporate network is considered trustworthy. This model fits poorly with cloud services, home offices, and mobile devices. It also helps little when attackers are already in the network with stolen credentials or via an infected device and can move around freely there.
Zero Trust reverses the basic assumption: trust is not presumed but established anew for every access. The term became popular around 2010. The US National Institute of Standards and Technology (NIST) describes a zero trust architecture in publication SP 800-207. Zero Trust is not a single product but a security model that is implemented step by step.
How does Zero Trust work?
Three principles shape the approach:
- Verify explicitly: Every access is evaluated based on the available signals, such as identity, device health, location, application, and detected risk.
- Least privilege: Accounts and applications receive only the permissions they need for their task, time-limited where possible, see Least Privilege.
- Assume breach: Systems are designed so that a compromised account or device causes as little damage as possible, for example through network segmentation, encryption, and continuous monitoring.
Technically, a central component makes the access decision according to defined policies. It is enforced at sign-in, in the application, or in the network. The evaluation does not take place only once but is repeated when conditions change.
Typical examples
- Access to Microsoft 365 is only possible with multi-factor authentication and from a managed, up-to-date device, implemented for example with Conditional Access.
- Instead of a VPN that opens the entire corporate network, employees only get access to individual approved applications. This approach is called zero trust network access (ZTNA).
- Server, office, and production networks are separated from one another so that malware cannot spread unhindered.
- Administrative rights are only enabled for the duration of a task.
What companies should keep in mind
- Start with identities: Multi-factor authentication for all accounts is often an effective first step.
- Know your inventory: Which users, devices, applications, and data exist, and which of them are particularly worth protecting?
- Proceed step by step: Test policies first and log their effects, then enforce them.
- Take legacy systems into account: Systems that do not support modern authentication methods need compensating measures such as strict isolation.
- Keep usability in mind: Use additional checks selectively based on risk instead of for every action.
How it differs
Zero Trust does not mean distrusting employees. The term refers to technical trust assumptions. Firewalls also remain useful, but they are no longer the only protective boundary.
Explore cyber security expertise