Zero Trust
Zero trust treats every request as untrusted until authenticated and authorized, replacing implicit network trust with identity, policy, and continuous verification.
Definition
Zero trust is a security model in which no network location is inherently trusted. Every request is authenticated, authorized, and evaluated against policy, whether it comes from the internet, a VPN, or another service inside the data center. Identity, device posture, least privilege, and continuous verification replace the assumption of a trusted internal network.
Context and scope
Zero trust is used in cloud, hybrid, and remote-work environments where the perimeter is no longer a reliable boundary. It is especially relevant to service-to-service calls, administrative access, and third-party integrations.
Common misconceptions
- Zero trust means no trust at all — it means trust is explicit, scoped, and continuously evaluated
- A VPN provides zero trust — a VPN extends the network, but it does not authorize each request or limit lateral movement
- Zero trust is only an identity product — it requires policy, segmentation, logging, and application-level authorization
Anti-patterns
- Treating internal service calls as automatically authorized
- Granting broad network access and relying only on login at the edge
- Logging authentication but not authorization decisions
Related concepts
Related examples
Authoritative source
The network is not a credential
A traditional perimeter assumes that anything inside the network is trustworthy. Once an attacker gains a foothold, lateral movement is easy because internal services accept unauthenticated calls. Zero trust removes that assumption. Every call carries an identity, and every service checks whether that identity may perform the operation.
client -> identity token -> policy decision -> service
service A -> workload identity -> policy decision -> service B
admin -> SSO + MFA + device posture -> short-lived credential -> targetThe diagram is conceptual. The implementation may use mTLS, OIDC, cloud IAM, or a service mesh, but the invariant is the same: identity and policy at each boundary, not just at the edge.
Verify continuously
Authentication at login is not enough. Tokens expire, devices change posture, and permissions are revoked. Use short-lived credentials, check authorization on every sensitive request, and log the decision. A stolen token should have a bounded lifetime and a revocation path. Administrative access should require stronger authentication and just-in-time elevation.
Segment and observe
Zero trust reduces lateral movement through segmentation and least privilege. Network policy, service identity, and application-level authorization work together. Log both allows and denies; a denial spike may indicate a misconfigured policy or an attacker probing. Review access regularly and remove unused paths.
When to use it
Use zero trust when the network perimeter is weak or when internal lateral movement would be catastrophic. The advantage is explicit, auditable access control; the drawback is operational complexity and the need for identity, policy, and logging across every service. Compared to a VPN-only model, zero trust is more granular but requires application and platform changes.