Zero Trust — Glossary

Zero Trust is a security model built on a single, uncomfortable assumption: no user, device, or network segment is trusted simply because of where it sits. Trust is never a property of location — it must be earned, verified, and re-verified for every request.

The old model and why it broke

For decades networks were designed around a hard perimeter. Everything inside the firewall was "us" and considered safe; everything outside was untrusted. Remote workers, cloud services, mobile devices and third-party integrations dissolved that boundary. An attacker who phished one laptop or compromised one contractor account was effectively inside the trusted zone — free to move laterally.

The core principles (NIST SP 800-207)

All resources are accessed securely, regardless of location. Being on the office network grants nothing extra.
Access is granted per session. Not "you logged in this morning", but "this specific request against this resource, from this device, right now".
Access is determined dynamically. Identity, device health, time, location and behaviour all feed the decision.
Every connection is authenticated and authorised. Typically mutual TLS plus a short-lived token.
The network is treated as hostile. Both internal traffic and external traffic are inspected and encrypted.
Policy is central, enforcement is distributed. Rules live in one place; the gateway closest to the resource applies them.

What it looks like in practice

Instead of:   VPN in, then everything is reachable

You get:      Identity provider authenticates the user (MFA)
              Device posture is checked (encrypted disk, patched, EDR)
              Policy engine evaluates the request
              A short-lived token is issued for THIS service only
              The gateway in front of the service verifies that token
              Every action is logged with the identity attached
              Re-evaluation happens continuously, not once per day

Typical building blocks:
  Identity provider      Entra ID, Okta, Keycloak
  MFA / FIDO2            hardware keys, passkeys
  Device management      Intune, Jamf
  Identity-aware proxy   Cloudflare Access, Teleport, Pomerium
  Service mesh           mTLS between workloads (Istio, Linkerd)
  Policy as code         Rego/OPA, Cedar
  Secrets management     Vault, SOPS, cloud KMS

Where to start — realistically

Nobody moves to Zero Trust in one project. A workable sequence:

Inventory first. You cannot protect what you do not know about — applications, data stores, admin paths, service accounts.
Strong identity. MFA everywhere, no exceptions for "internal" logins. This single step removes the majority of real-world attack paths.
Kill standing privileges. Admin rights issued for hours, not permanently. Just-in-time access with an approval trail.
Segment the network. Even coarse segmentation (servers / clients / management / IoT) breaks lateral movement.
Move exposed services behind an identity-aware proxy. Then close the broad VPN route to them.
Encrypt internal traffic. mTLS between services — no plain-text assumptions.
Log everything with identity attached. Without usable logs, detection and forensics are impossible.

Common pitfalls

Zero Trust as a product. Vendors sell "Zero Trust platforms". It is an architecture, not a box — the identity, policy and logging layers have to actually work together.
Breaking the experience. If users must authenticate five times an hour, they will invent workarounds. Single sign-on with sensible session lifetimes matters.
No exception process. Legacy applications will not support modern authentication. Plan a documented path for them instead of quietly leaving a hole.
Ignoring the machine side. Human identity is often done well; service accounts, CI runners and automation keys are forgotten and hold broad rights.
No rollback plan. A policy engine misconfiguration can lock out every administrator at once. Keep a tested break-glass path.
Verification by assumption. "We have MFA" is not the same as "we measured that 100 % of logins require MFA". Measure it.

Minimum viable Zero Trust: MFA on every human login, no permanent admin rights, segmented network, and logs that actually record who did what. That combination defeats most real attacks — and it can be reached without a large budget.