What is Zero Trust?
Definition
Zero Trust is a security model based on the principle that no user, device, or network should be inherently trusted, regardless of location. Every access request must be continuously verified based on identity, device posture, and context before granting access.
In Depth
Zero Trust represents a fundamental shift from the traditional castle-and-moat security model, which assumed that everything inside the corporate network could be trusted. In a Zero Trust architecture, identity becomes the new perimeter, and every access request is evaluated based on multiple signals: user identity and authentication strength, device health and compliance status, network location and context, resource sensitivity, and behavioral anomalies. Key technical components include strong identity verification (MFA, passwordless authentication), micro-segmentation (limiting lateral movement between network zones), least-privilege access, continuous monitoring and validation (re-evaluating trust throughout a session), and comprehensive logging for security analytics. While no compliance framework explicitly mandates Zero Trust by name, the model aligns closely with requirements across SOC 2, ISO 27001, HIPAA, and GDPR. NIST Special Publication 800-207 provides the definitive architecture guide. Organizations typically adopt Zero Trust incrementally, starting with identity and access management before extending to network segmentation and workload protection.
Related Terms
Multi-Factor Authentication
Multi-factor authentication (MFA) is a security mechanism that requires users to provide two or more independent verification factors to access a system. Factors include something you know (password), something you have (security token), and something you are (biometric).
Least Privilege
The principle of least privilege dictates that users, systems, and processes should be granted only the minimum level of access necessary to perform their legitimate functions. Access rights should be regularly reviewed and promptly revoked when no longer needed.
Network Security
Network security encompasses the technologies, policies, and practices designed to protect the integrity, confidentiality, and availability of network infrastructure and data in transit. It includes firewalls, intrusion detection, network segmentation, and monitoring.
Role-Based Access Control
Role-Based Access Control (RBAC) is an access management model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job functions. This simplifies administration and ensures consistent access provisioning.
Generate compliance docs with PoliWriter
Stop reading about compliance and start achieving it. PoliWriter generates audit-ready policies customized to your organization in hours.
Get Started Free