Zero trust
Security that checks every request, instead of trusting whatever is inside the network.
For decades, company security followed the castle and moat model: a strong wall around the office network (the firewall), a gate to get in from outside (the VPN), and once inside, almost everything was reachable and trusted. That breaks down when one phishing email gives an attacker a foothold inside, when people work from home and cafés, and when the apps live in the cloud rather than in the office.
Zero trust drops the idea that being on the right network means anything. Every request, to every app, is checked on its own: who is asking (a strong login, usually with two-factor authentication), from what device (is it the company laptop, is it up to date?), and whether this person should have access to this specific thing right now. The rule behind it is least privilege: each person and each service gets only the access they need, nothing more.
In practice it means an identity provider with SSO in front of every app, device checks, short-lived credentials, fine-grained permissions like the ones IAM gives on AWS, and logs of every access. Google popularized it internally after a major breach in 2009, and the US government's NIST published a reference architecture for it. It is not a product you buy but a direction: every step that removes implicit trust makes a stolen password or an infected laptop do less damage.
Keep in mind
- Network location grants nothing: being inside is not a reason to be trusted.
- Every request is checked for identity, device and permission.
- Least privilege: each person and service gets only the access they need.
- It limits the damage of stolen passwords and infected devices instead of assuming they will not happen.
