Zero Trust: what it really means, beyond the slogan

The slogan, and what it really means

“Never trust, always verify” has become a conference slogan, repeated so often that it has lost its meaning. The principle behind it, however, is concrete: no access is considered trustworthy simply because it comes from a certain place. Not from the internal network, not from a company device, not from a user who signed in an hour ago. Every request to access a resource is verified, based on who is making it, from which device and under what conditions.

The model it replaces

For years network security worked like a castle with a moat: a well-defended perimeter of firewalls and VPNs and, once inside, almost complete trust between systems. It worked when "inside" meant one office, one network, a set of servers under direct control.

Today that perimeter has dissolved: remote working, cloud applications, personal devices connecting to company systems, suppliers with access to internal environments. The moat has all but gone, and an attacker who gets past a single weak point can often move freely inside, because everything else trusts them. Many serious incidents do not stem from a sophisticated technical breach, but from stolen credentials that then met no further checks along the way.

The practical pillars

Zero Trust is not a product you install: it is a set of practices built up over time, often on top of what is already there.

• Strong identity: multi-factor authentication on all the access that matters, not just email.
• Device verification: access from an unpatched or unmanaged device is a warning sign, not a detail.
• Least-privilege access: every person and every system can reach only what they need to do their job, not the whole network.
• Segmentation: the network is divided into zones, so that a compromised system does not become a springboard to all the others.
• Temporary privileged access: admin permissions are granted when needed, for as long as needed, not permanently.
• Continuous monitoring: access is not only checked at the door but observed over time, to spot unusual behaviour.

What it is not

It is worth being clear about what Zero Trust is not, because that is the part suppliers tend to skip.

• It is not a product you buy that solves the problem. It is an architecture, built from several tools (identity, network, endpoint) that have to work together.
• It is not done in a weekend: it is an incremental process, often taking months, that starts with the most critical areas.
• It does not replace firewalls and antivirus: it adds to them, changing where and how trust is placed.
• It does not eliminate risk: it reduces it and, above all, limits the damage when something goes wrong anyway.

Where to start, without throwing anything away

1. Multi-factor authentication wherever it matters: email, VPN, admin access, critical applications. It is the step that cuts the most risk for the least effort.
2. Map who has access to what: you often find permissions that have built up over time and were never reviewed, held by people who no longer need them.
3. Cut permissions to the minimum needed, starting with admin access and the most critical systems.
4. Segment the network to separate critical environments from the rest, so that a problem in one area does not spread automatically.
5. Set up monitoring that flags unusual access and behaviour, not just whether up-to-date antivirus is installed.

Quick checklist

• multi-factor authentication is enabled on all remote and admin access;
• I know who has access to what, and permissions are reviewed regularly;
• admin access is not permanent, but granted when needed;
• the network is segmented, and a compromised system cannot automatically reach others;
• there is monitoring that flags unusual behaviour, not just the presence of security tools;
• suppliers with access to my systems are subject to the same rules as employees.

In short