Zero trust architecture

Zero trust replaces the old “castle and moat” model, in which anything inside the corporate network was trusted. In a zero trust architecture, network location grants nothing. Every request, from inside or outside, must prove who is making it, from what device, and that it’s allowed, before access is granted to a specific resource.

The approach is described in NIST Special Publication 800-207 and has become the reference model for modern enterprise security.

Diagram

flowchart LR
    user[User and device] --> pep[Policy enforcement point]
    pep -- access request --> pdp[Policy decision point]
    idp[Identity provider] --> pdp
    posture[Device posture] --> pdp
    signals[Threat and risk signals] --> pdp
    pdp -- allow or deny --> pep
    pep -- per-session access --> res[Specific resource]

How it works

• Verify explicitly. Authenticate and authorize every request using identity, device health, location and risk signals.
• Least-privilege access. Grant only the access needed, for only as long as needed.
• Assume breach. Design as if attackers are already inside: segment networks, encrypt traffic internally and monitor continuously.
• Policy decision and enforcement. A policy decision point evaluates each request; a policy enforcement point (a gateway, proxy or agent) allows or blocks it.
• Per-resource access. Users reach a specific application, not a whole network segment as with a traditional VPN.

Pros

• Limits damage from breaches: stolen credentials or a compromised device reach far less.
• Fits remote work and cloud, where there’s no single network perimeter.
• Better visibility: every access decision is logged.

Cons

• A long journey: it’s a program across identity, devices, networks and applications, not a product purchase.
• Legacy systems often can’t support modern authentication without proxies or wrappers.
• Friction for users if policies are designed poorly.

When to use it

• Organizations with remote staff, cloud services and partners connecting from outside.
• Any environment handling sensitive or regulated data.
• As the target model for modernizing network and identity security.

When to avoid it

Zero trust is broadly applicable. The question is how to phase it, not whether to adopt it. Start with identity and the most sensitive resources.

Common pitfalls

• Buying a “zero trust product” and assuming the work is done.
• Strong authentication only at the edge, with service-to-service traffic still implicitly trusted.
• Ignoring device health and verifying only the user.

Related patterns

• Identity and access management
• Micro-segmentation
• Service mesh with mutual TLS
• Well-architected frameworks

Glossary: zero trust

Further reading

• NIST SP 800-207, Zero Trust Architecture
• CISA, Zero Trust Maturity Model