Zero Trust has been marketed hard enough that some buyers have stopped listening, even though the underlying idea is simple and sound. It is worth separating the principle from the product category, because they are easily confused.
What model does Zero Trust security replace?
Traditional network security was built on a castle-and-moat design. A hardened perimeter separated a trusted inside from an untrusted outside. Get past the firewall and you were, broadly, trusted. Internal traffic was largely unrestricted, internal systems trusted each other, and the security investment concentrated on the boundary.
This worked when the assumptions held. Staff were in offices, on the corporate network, using corporate devices. Applications ran in a data centre you owned. Data stayed inside.
Each of those assumptions has weakened. People work from home, from clients’ offices and from airports. Applications run in SaaS platforms and public cloud. Data sits in Microsoft 365, in a supplier’s system, on someone’s phone. Third parties have credentials into your environment, which is why third-party risk management has become part of the same conversation.
The result is that the perimeter now encloses a shrinking fraction of what matters, and the “inside” it protects is, in practice, reachable by anyone who obtains a valid credential, which is a common route for attackers.
What does Zero Trust actually mean?
Zero Trust means never granting trust on the basis of network location. Verify every request explicitly, grant the minimum access required, and assume the environment is already compromised. The US National Institute of Standards and Technology (NIST) sets this out in SP 800-207, Zero Trust Architecture, and the UK’s National Cyber Security Centre (NCSC) publishes zero trust architecture design principles that describe the network as hostile and every request as something to verify against policy.
Three sub-principles follow.
Verify explicitly. Every access request is authenticated and authorised on the basis of everything known at that moment: who the user is, whether they have proved it strongly, what device they are on, whether that device is healthy, where they are, what they are asking for, and whether any of that is anomalous.
Least privilege. Access is scoped as narrowly as the task allows, granted for as long as needed and no longer. Standing broad privilege is one of the things Zero Trust is most directly designed to remove.
Assume breach. Design as though an attacker is already inside. That means segmentation so lateral movement is hard, encryption so intercepted data is useless, and monitoring so unusual behaviour is visible.
“The framing I find useful is this,” says AJ Thompson, CCO at Northdoor. “In the old model, a stolen password gave an attacker the network. In a Zero Trust model, a stolen password gives them one authentication attempt that then has to survive device checks, context checks and least-privilege scoping. It doesn’t make you invulnerable. It makes a credential worth far less.”
What Zero Trust is not
A product. No single purchase delivers Zero Trust. Identity providers, conditional access, device management, network segmentation, privileged access management and monitoring all contribute. The architecture is the goal; the products are components.
“No trust”. Trust is granted continually. It is simply granted on the basis of verified identity, device and context rather than on the basis of an IP address.
A reason to remove your firewalls. Perimeter controls remain useful. They are simply no longer sufficient on their own.
A project with an end date. It is a design principle you apply to decisions as they arise.
How do you implement Zero Trust in practice?
Organisations that make progress usually do it in stages, in roughly this order.
Stage one: identity. This is where much of the benefit sits, and it is usually best completed before anything else is attempted.
- Single, authoritative identity provider for as many applications as possible
- Phishing-resistant multi-factor authentication (MFA) everywhere, with no exemptions for executives or service accounts
- Conditional access policies based on risk, device and location
- Privileged access that is elevated on request and time-bound rather than standing
- Regular access reviews against actual use, removing what has never been exercised
Stage two: device posture. Access decisions start taking device health into account: is it managed, patched, encrypted, running endpoint detection and response? An unmanaged device gets a narrower slice of access than a compliant corporate one.
Stage three: segmentation and application access. Replace broad network access, particularly legacy VPN access that drops users onto a flat network, with per-application access. Segment the internal network so that a compromised workstation cannot reach the database estate directly.
Stage four: data-centric controls. Classification driving access decisions, encryption, and monitoring at the data layer through database activity monitoring so that unusual access to sensitive stores is visible even when the credential is valid.
Stage five: continuous monitoring and response. Behavioural analytics, automated response to risk signals, and a working feedback loop into the policies.
What makes Zero Trust difficult?
Legacy applications. Older systems that cannot integrate with a modern identity provider are a common blocker. They usually need wrapping in an access proxy or isolating in a segment, neither of which is elegant.
User experience. Done badly, Zero Trust produces authentication fatigue and users looking for ways around it. Done well, risk-based policies mean most access is frictionless and only unusual requests attract additional checks.
Third parties. Supplier and contractor access is frequently the least controlled part of an estate and the hardest politically to tighten.
Organisational reach. This is not a single team’s programme. It touches identity, endpoint, network, application and procurement.
Where to start tomorrow
If you do only one thing: audit your privileged accounts, then remove standing privilege and require time-bound elevation. It is one of the highest-value single changes available under this model, and it does not require a programme, a budget cycle or a new product.
What this means for your organisation
Everything else in a Zero Trust programme, device posture, segmentation and data controls, builds on identity and privilege, so that is where the work usually starts. Northdoor’s Zero Trust work begins in the same place, alongside cloud security for the services that now sit outside the perimeter. Compare notes with us.