Core Concepts of Zero Trust
Sam works from home on Mondays and logs into the shop's cloud drive and admin pages. The old idea was simple: inside the shop network means trusted, outside means not. But Sam is outside and legitimate, and a laptop inside the shop can be infected. Location has stopped being a good test of trust.
The rule
Never trust by location. Verify every request, every time.
Zero trust is an approach, not a product. Its core ideas:
- Verify explicitly — each request is checked using who the user is (strong login with MFA), which device it comes from (updated, managed, encrypted) and what is being asked for.
- Least privilege — access is granted to one app or resource, not "the whole network", and only for as long as needed.
- Assume breach — act as if an attacker may already be inside, so segment, log and watch, and limit how far any one account can reach.
Compare the two models:
| Old "castle" model | Zero trust |
|---|---|
| Inside the network means trusted | Nothing is trusted by location |
| Log in once, reach everything | Every app checks access itself |
| Check at the edge only | Check at every request |
Zero trust builds on ideas from this section: least privilege, segmentation and defence in depth, applied to every connection.
The shortcut
For every access request, ask three questions: Who is it? Is the device healthy? Do they need this, right now? All three yes means allow; any doubt means deny or ask for more proof.
Who is it?
Sam signs in with his password and an MFA prompt on his phone. Identity confirmed.
A frequent misunderstanding is that zero trust means "trust nobody, so nobody can work". It means trust is earned per request, based on evidence, instead of assumed from where you sit.
Drills
Answer fast — trust the rule.
What does zero trust stop relying on?
Which is one of the core ideas of zero trust?
Sam has a valid login and a healthy laptop, but asks for a file his role does not cover. Under zero trust, what happens?
Which statement best describes zero trust?
Remember
- Never trust by location. Verify every request, every time.
- Ask: who is it, is the device healthy, do they need this now?
- Trap: thinking zero trust is a product, or that it means nobody can work.