Zero Trust explained: principles and getting started
Zero Trust means: do not trust any device or user simply because of its location in the network. The model fits work in the office, at home and in the cloud.
Classic networks behave like a castle: whoever is inside is considered trustworthy. With home working, cloud services and mobile devices, that "inside" hardly exists any more. Zero Trust therefore checks each request individually, regardless of the network.
The basic principles
Verify explicitly: consider identity, device state, location and risk on every access.
Least privilege: access only to what is needed, preferably time-limited.
Secure identities: MFA and conditional access for all accounts.
Manage devices: only maintained, encrypted devices get access.
Access to applications instead of the whole network: mesh VPN or access services that release individual resources.
Segment the network: separate guests, devices, servers and administration.
Monitor: review sign-ins and access.
An approach, not a product
Zero Trust cannot be bought. It emerges step by step from the building blocks identity, device, network and data. With MFA, device management and a segmented network, essential parts are already in place.
Zero Trustzero trust architecturenever trust always verifyconditional accessmicrosegmentation
Frequently asked questions
What does Zero Trust mean?
Zero Trust means not trusting any user or device solely because of its network location. Every access is verified.
Is Zero Trust a product?
No. It is a security approach made up of measures for identity, devices, network and data.
How do you start with Zero Trust?
With MFA for all accounts, managed devices, a segmented network and access to individual applications rather than the entire network.