Zero Trust Security
What is Zero Trust Security?
Zero trust is the principle that being inside the network grants nothing. Every request is authenticated and authorised on its own merits, whether it comes from a laptop in the office or a server in someone else's data centre.
It replaced an older model where a firewall divided the world into trusted inside and untrusted outside. That model failed for an obvious reason: once an attacker is inside — through a phished credential, a compromised supplier, a stolen VPN token — the perimeter is doing nothing, and they can move sideways freely.
Three decisions underneath it
The model is often presented as a long list of components. In practice it reduces to three decisions:
- Verify explicitly. Every request carries its own proof — identity, device posture, context. Nothing is inferred from the network it arrived on.
- Grant the least privilege that works. Access is scoped to the resource and the moment, and expires. A credential that opens everything forever is the thing that makes a breach expensive.
- Assume breach. Design for the attacker already being present: segment, log, and make lateral movement visible rather than impossible.
Everything else — identity providers, device attestation, microsegmentation, continuous evaluation — is plumbing in service of those three.
Unauthenticated endpoints are the gap
Zero trust is built around authenticated principals: a user, a service, a device with a certificate. It works well there, and it has almost nothing to say about the traffic that arrives before anyone is authenticated.
That is a real gap, because the endpoints an attacker wants are usually the unauthenticated ones. A login form has to accept requests from strangers in order to function. So does a sign-up page, a password reset, a public API, a checkout. Zero trust cannot verify explicitly at that point, because there is no identity yet to verify.
What you can establish before authentication is narrower but still useful: whether a person is present at all. That is what human verification does, and it is the layer that makes "verify explicitly" meaningful on an anonymous endpoint — credential stuffing against a login form is defeated by establishing that nobody is there, long before any credential is checked.
Implementing it without boiling the ocean
Zero trust programmes fail by trying to start everywhere. The order that works:
- Get identity right first — single sign-on, strong multi-factor authentication, and no shared accounts. Nothing else works without it.
- Put the unauthenticated edge behind something that can tell a person from a script, since that is where the attacks land.
- Segment the highest-value systems and shorten credential lifetimes.
- Only then take on microsegmentation of everything else, which is the expensive part and the one most often abandoned half-done.