Zero Trust

What is Zero Trust?

Zero trust is a security model built on a single principle: never trust, always verify. No identity, device, or network connection is trusted by default, regardless of where the request originates. Whether a request comes from inside the corporate network or from a coffee shop in another country, it faces the same verification requirement. Trust is not assumed. It is continuously earned and continuously re-evaluated.

That's the shift from traditional perimeter-based security. The old model assumed everything inside the network perimeter was trustworthy. Zero trust assumes it isn't.

How zero trust works

Zero trust replaces implicit trust with explicit, continuous verification across three dimensions.

Identity verification: Every access request must be tied to a verified identity, human or non-human. Multi-factor authentication is the baseline. But zero trust goes further: the identity's current context matters. What time is it? Where is the request coming from? Has this identity made this type of request before? Does the access pattern match the identity's normal behaviour? A verified identity with an anomalous access pattern triggers additional scrutiny or denial, not automatic approval.

Device trust: A verified identity on an unmanaged or compromised device isn't a trusted access request. Zero trust evaluates device health at the time of each request: is the device enrolled in the corporate device management programme? Are its security controls current? Does it have known vulnerabilities? A clean identity on a compromised device still fails the trust evaluation.

Least privilege access: Access is granted for specific resources, specific actions, and specific time windows. Not broad access to network segments. Not persistent permissions that remain even after the task is complete. A data analyst gets read access to the dataset they need for their current project. Not write access. Not access to adjacent datasets. Not access after the project ends.

These three dimensions work together. Any gap in one weakens the whole model.

Zero trust vs VPN

The practical difference is blast radius. A compromised VPN credential gives an attacker everything on the network segment that user can reach. That often means significantly more than the legitimate user actually needed. A compromised identity in a zero trust architecture gives an attacker access to the specific resources that identity was granted: limited scope, visible in access logs, and constrained by least privilege enforcement.

That's why zero trust became a serious architectural direction after large-scale perimeter breaches demonstrated the consequence of trusting everything inside the network.

The components of a zero trust architecture

Zero trust is a framework, not a single product. Implementing it means assembling several capabilities that enforce the verify-continuously, least-privilege model across an enterprise.

Identity and Access Management (IAM): The foundation. Every access request is tied to a verified identity. IAM governs who exists in the system, what roles they hold, what permissions those roles carry, and how authentication is enforced.

Multi-Factor Authentication (MFA): Required for all access. Password alone doesn't establish identity under zero trust. MFA adds a second factor: something you have, something you are.

Device management and endpoint trust: MDM and endpoint detection tools establish whether a device meets the security standards required for access. Unmanaged devices fail trust evaluation.

Zero Trust Network Access (ZTNA): Application-level access control that replaces VPN. Users get access to the applications they need, not the network those applications run on. Each application request is individually evaluated.

Microsegmentation: Network-level division of environments into small segments with independent access controls. If one segment is compromised, lateral movement to other segments requires separate authentication. This limits blast radius even if an identity is compromised.

Data access governance: The component most zero trust implementations underinvest in. Identity verification tells you who is accessing systems. Data access governance tells you what data those identities are accessing within those systems, whether that access is appropriate given the data's sensitivity, and whether access patterns indicate misuse. An authenticated identity with legitimate system access can still exfiltrate sensitive data. Zero trust without a data layer can't detect that.

The data gap in most zero trust programmes

Zero trust implementations typically invest heavily in network access and identity. The data layer gets less attention. That's where most programmes have material gaps.

Why does this matter? Because the threat model zero trust is designed to address, specifically the insider threat and the compromised credential, operates at the data level, not the network level. An attacker with a valid credential and legitimate system access doesn't need to compromise network controls. They're already in. They access the data they're after through the same channels and interfaces that legitimate users use.

Zero trust's "always verify" principle, applied to data access, means evaluating not just whether an identity can access a system but whether their data access patterns within that system are consistent with legitimate use. A sales analyst with CRM access who suddenly queries the full customer database and exports it is using legitimate credentials and authorised system access. That's not a network access problem. It's a data access problem that requires behavioural context to detect.

That's the connection between zero trust as an architectural principle and data security as an operational capability. Zero trust defines the trust model. Data security with classification, access governance, and behavioural monitoring enforces it at the layer where most real-world threats actually operate.

Use cases for zero trust

Remote workforce security: Employees accessing corporate resources from home, coffee shops, and co-working spaces create access patterns that perimeter security can't evaluate. Zero trust evaluates each request on its own merits: is the identity verified? Is the device trusted? Is the access pattern consistent with this identity's normal behaviour?

Lateral movement prevention: A ransomware group compromises a single endpoint. In a perimeter-based model, that endpoint's network access enables lateral movement across the organisation. In a microsegmented zero trust environment, that endpoint's compromised credential has access only to the specific resources it was authorised to reach, limiting propagation.

Third-party and contractor access: External parties need access to specific systems for specific purposes. Zero trust enables scoped, time-limited access to exactly the resources they need, with full visibility into what they access and when.