The Security Model That Assumes You’re Already Compromised
Traditional network security was built on a perimeter model: protect the network boundary, and everything inside the boundary is trusted. Employees inside the corporate network, on corporate devices, connecting to corporate resources were assumed to be legitimate users accessing legitimate systems. This model was reasonable when all employees worked in the office on corporate hardware within a well-defined physical network.
Zero trust is the security architecture that replaces the ‘everything inside the network is trusted’ assumption with ‘trust nothing, verify everything.’ In a zero trust model, being on the corporate network doesn’t grant access to corporate resources; being on a corporate device doesn’t grant access to applications; having authenticated once doesn’t maintain trust indefinitely. Every access request is verified based on identity, device health, location, and the specific resource being requested, regardless of where the request originates.
Why the Perimeter Model Failed
The perimeter model’s failure has three causes that accumulated over the 2010s and became undeniable by 2020. First, the perimeter dissolved: remote work, cloud services, and BYOD policies moved applications and users outside the traditional network boundary that the perimeter was designed to protect. Second, attackers learned to compromise systems inside the perimeter: phishing attacks, supply chain compromises, and insider threats all produce attackers with legitimate-appearing access inside the network boundary, where the perimeter model doesn’t restrict their movement.
Third, lateral movement became the primary attack pattern: sophisticated attackers who gain initial access to one system inside the network don’t need to fight the perimeter again — they move laterally through the network using legitimate credentials and trust relationships between internal systems. The SolarWinds attack that compromised thousands of organisations followed this pattern: initial access through the software update mechanism, then lateral movement through the trusted internal network to reach high-value targets.
The Core Principles of Zero Trust
Verify explicitly: every access request is authenticated and authorised based on all available signals — user identity, device health (is the device compliant with security policy?), location, and the specific resource requested. This is more than username and password; it’s continuous assessment of whether the access context is consistent with legitimate use.
Use least privilege access: users, services, and devices receive only the minimum access necessary for their specific role and current task. The administrator who needs to make one change to one system doesn’t need access to all systems. The application that reads from one database doesn’t need write access to all databases. Limiting what each identity can do limits the damage when any identity is compromised.
What Zero Trust Implementation Actually Looks Like
Zero trust is an architecture rather than a product — it’s implemented through a combination of existing and new security tools configured and integrated to implement the principles. The key components: strong identity verification (MFA as a baseline, ideally phishing-resistant MFA), device health management (endpoint detection and response, device compliance checking before granting access), network micro-segmentation (dividing the network so that compromise of one segment doesn’t grant access to others), and application-level access control (accessing applications requires authorisation for that specific application regardless of network position).
Microsoft Azure Active Directory, Okta, and Google BeyondCorp Enterprise are examples of identity platforms that implement zero trust principles for cloud and hybrid environments. Cloudflare Zero Trust and Zscaler provide network-level zero trust implementations that replace traditional VPN with per-request access verification. The practical implementation timeline for an organisation is months to years depending on the complexity of the existing environment and the scope of change required.
What Zero Trust Means for Individuals
Zero trust as an enterprise security architecture is primarily relevant to organisational security decisions. The individual user experiences zero trust as more authentication prompts (because continuous verification replaces assumed trust), more granular access controls (requesting access to a specific resource requires justification rather than automatic network membership granting it), and sometimes slower access to resources while access decisions are made.
The individual security practices that mirror zero trust principles: treating every access request sceptically (verifying that the application or website requesting credentials is what it claims to be), using unique credentials per application (limiting the blast radius of any single credential compromise), and not assuming that being on a specific network (home, corporate, coffee shop) grants trust in the resources accessible from it. These practices represent the individual-level application of zero trust thinking that the enterprise architecture implements systematically.