Zero trust

In short: Zero trust means: “Never trust blindly, always verify.” Neither a device nor a user counts as trustworthy just because they are in the company network. Every access is checked individually.

In more detail: The classic castle-and-moat model trusts everything inside the network. Once an attacker gets in, they move freely. In zero trust identity, device state and context are checked on every access, and rights are minimal.

In Depth

• Principles: Verify explicitly, least privilege, assume breach.
• Identity at the centre: Strong authentication (MFA, passkeys), single sign-on.
• Device state: Managed, current, encrypted devices.
• Micro-segmentation: Small network zones, lateral movement is harder.
• Mutual TLS: Both sides identify themselves by certificate (service mesh).
• Continuous checking: Access can change when risk changes.
• Logging and detection: Everything is recorded and evaluated.
• Instead of VPN: Access to single applications instead of the whole network.

See also: Threat modelling with STRIDE, TLS handshake in detail