# Zero trust

> Security that checks every request, instead of trusting whatever is inside the network.

- Level: Advanced
- Topics: Security
- URL: https://tidbit.legios.com.ar/zero-trust/
- In Spanish: [Zero trust](https://tidbit.legios.com.ar/es/zero-trust/)

For decades, company security followed the **castle and moat** model: a strong wall around the office network (the firewall), a gate to get in from outside (the VPN), and once inside, almost everything was reachable and trusted. That breaks down when one phishing email gives an attacker a foothold inside, when people work from home and cafés, and when the apps live in the cloud rather than in the office.

**Zero trust** drops the idea that being on the right network means anything. Every request, to every app, is checked on its own: who is asking (a strong login, usually with two-factor authentication), from what device (is it the company laptop, is it up to date?), and whether this person should have access to this specific thing right now. The rule behind it is **least privilege**: each person and each service gets only the access they need, nothing more.

In practice it means an identity provider with SSO in front of every app, device checks, short-lived credentials, fine-grained permissions like the ones IAM gives on AWS, and logs of every access. Google popularized it internally after a major breach in 2009, and the US government's NIST published a reference architecture for it. It is not a product you buy but a direction: every step that removes implicit trust makes a stolen password or an infected laptop do less damage.

## An analogy

An office building where your badge is checked at every door, not only at the main entrance. Getting into the lobby no longer means you can walk into the server room; each door asks again whether you, today, should go through.

## Keep in mind

- Network location grants nothing: being inside is not a reason to be trusted.
- Every request is checked for identity, device and permission.
- Least privilege: each person and service gets only the access they need.
- It limits the damage of stolen passwords and infected devices instead of assuming they will not happen.

## Go deeper

- [NIST SP 800-207, Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
- [Zero Trust on AWS](https://aws.amazon.com/security/zero-trust/)
- [Zero trust architecture on Wikipedia](https://en.wikipedia.org/wiki/Zero_trust_architecture)

## Related terms

- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [VPN](https://tidbit.legios.com.ar/vpn/): An encrypted tunnel that sends all your traffic through another network first.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.
- [OAuth and SSO](https://tidbit.legios.com.ar/oauth-and-sso/): Log in once with an account you trust, and let it vouch for you in other apps.
- [IAM](https://tidbit.legios.com.ar/iam/): The rulebook that says who can do what in your AWS account.
- [Google](https://tidbit.legios.com.ar/google/): The search company that gives most products away and makes its money on ads.