What is zero trust security?

Think of an old office block with one gate and one guard. The guard checks your face at the gate. After that you are free. You can walk into the accounts room, the store room and the server room, and nobody asks again.

Now think of a hotel. Your key card opens your room and nothing else. It is checked at the lift, at the pool and at your door. It stops working the morning you check out.

Zero trust is the hotel. The old office block is how most computer networks were built. Being inside the building was proof enough. Zero trust removes that idea completely.

What zero trust security means

Zero trust is a way of building security. It grants no trust because of where a request comes from. Every request must prove itself, every time.

The short rule is this. Never trust, always verify.

Note the word “zero”. It does not mean nobody is trusted. It means no trust is free. Trust must be earned by proof at the moment of asking, and it expires quickly.

The name became common in the 2010s. Government security bodies now publish guidance on it, and most large cloud tools are built around it. It is a design idea, so no single product can sell it to you in a box.

Why the old way stopped working

The old model is often called the castle and moat. You build a hard wall around the office network. Inside the wall, life is easy.

Why did that break? Because the wall stopped matching real life. Staff work from home. Files sit in the cloud. People use their own phones. Suppliers and contractors need a way in. There is no single edge to defend any more.

It also failed for a second reason. One stolen password put an attacker inside the wall. From there they could move sideways from machine to machine. Security teams call that lateral movement. It is how a small break becomes a company-wide disaster, and it is how ransomware spreads so fast.

How zero trust works, step by step

A request under zero trust goes through the same gate every time.

1. Prove who you are, with a strong sign-in rather than a password alone.
2. Prove what device you are on. Is it known? Is it up to date? Is the disk encrypted?
3. Show what you are asking for and why you need it.
4. Get the smallest access that does the job, and nothing more.
5. Get it for a short time only, then prove yourself again.
6. Every step is written to a log, so odd behaviour stands out later.

Steps four and five carry most of the weight. Security people call step four least privilege. In plain words, you get the key to one room. You do not get the key ring for the whole floor.

What gets checked at every door

Five signals do most of the work.

• Identity. Who is asking, checked with a second step or a passkey.
• Device. Is this laptop or phone known and healthy?
• Place and time. A login from a new country at three in the morning is worth a question.
• Data. How sensitive is the thing being asked for?
• Behaviour. Does this match how the person normally works?

The system weighs these together. Low risk means you pass without noticing. High risk means an extra check, a smaller level of access, or a plain refusal.

Assume the attacker is already inside

Zero trust starts from an uncomfortable idea. Assume somebody is already in. Then ask a better question. How much damage can that person do before we notice?

The answer is to build small rooms. Split the network into zones so a break in one zone stops at the wall of the next. This is called micro-segmentation. A ship with sealed compartments stays afloat when one is holed.

ASSUME BREACH IS THE WHOLE POINT. Everything else follows from it.

Where you already meet it

You have used zero trust without hearing the name. Your work email asks you to approve a sign-in when you travel. Your laptop is refused until you install an update. A banking app asks for your fingerprint again before a large transfer.

You meet it in shops too. A cashier can take payment but cannot open the safe. A supervisor can open the safe but only with a second person present. That is least privilege in a shop, and it is old and sensible.

Zero trust also changes how staff reach work systems from home. The old answer was one company-wide tunnel. The new answer gives access to one application at a time.

What it is good at, and what it is bad at

It is good at limiting damage. A stolen login opens one door instead of the building. It suits remote work, cloud tools and contractors, and it gives clear records of who touched what.

However, it is hard work. Old machines, such as factory kit or a hospital scanner, often cannot prove identity at all. They need to be walled off instead. The project can take years and it costs money up front.

There is also a human cost. Set the checks too tight and staff will find ways around them, which leaves you worse off. Good design means the honest path stays easy.

One more warning. Zero trust leans heavily on your identity system. That system becomes the crown jewels. Protect it with the strongest sign-in you have, because phishing aims straight at it.

How to start

You do not need a big budget to begin. Start with the same three moves used by large firms.

1. Turn on a second sign-in step for every account, starting with email and admin accounts.
2. Take away access nobody uses. Old staff accounts and old shared logins are the usual way in.
3. Separate your most valuable data from the everyday network.

For the wider picture of how these pieces fit together, read our guide to what cybersecurity is.

Then check one thing this week. Open the admin list for your main work tool. Count how many people can change settings or add users. If the number surprises you, cut it today.

Just Out Tech explains new research in plain language. This article was drafted with AI assistance and checked by a human against the original source.