Zero Trust

Zero Trust is a strategy, not a product. NIST describes it as a move away from defending network perimeters toward protecting resources such as data, services and accounts, with access decided per request. Microsoft summarises it as three principles: verify explicitly, use least privilege access and assume breach.

In practice the same idea appears on every platform:

• Microsoft 365 and Entra: Conditional Access evaluates who is signing in, from which device and with what risk, then requires multi-factor authentication, a compliant device or blocks the sign-in.
• Azure: role-based access control limits what an identity can do on each resource, and private connectivity keeps services off the public internet.
• Google Cloud: Identity-Aware Proxy puts an identity check in front of applications instead of relying on a VPN.
• AWS: AWS Verified Access gives users access to applications based on identity and device posture, and IAM policy conditions narrow when a permission applies.

The common pattern is a policy decision made on every request, using several signals, with the smallest permission that does the job. The "assume breach" principle adds a second habit: design as if an account or device is already compromised, so that segmentation, short-lived access and logging limit how far an intruder can get and make their movement visible.

NIST's model also names the parts that make this work. A policy engine decides whether a request is allowed, a policy enforcement point sits in front of the resource and applies that decision, and inputs such as identity, device health and activity logs feed the decision. You do not need to buy these as separate products; your identity provider, endpoint management and cloud access controls often already play these roles.

A perimeter model assumes that anyone inside is trusted. Once an attacker holds one stolen password or one compromised laptop, that assumption lets them move freely. CISA's Zero Trust Maturity Model exists to help organisations reduce this risk step by step, and it organises the work into five pillars: identity, devices, networks, applications and workloads, and data.

For an IT admin the useful consequence is that the work is incremental. You do not need to rebuild everything. Each improvement, such as requiring MFA for administrators or blocking sign-ins from unmanaged devices, shrinks what a single stolen credential can reach.

It also changes how you measure security. Instead of asking whether the firewall is up, you ask which identities can reach which data, from which devices, and whether that access is still justified. That question is answerable in every major cloud, and it is the one an attacker who has stolen a login will test first.

Vendors sometimes sell "Zero Trust" as a single product. NIST is clear that it is an architecture built from many parts, so no single purchase delivers it.

1. Start with identity: require multi-factor authentication for everyone, and phishing-resistant methods for administrators where you can.
2. Reduce standing administrator access. Move to time-limited elevation and review who holds privileged roles.
3. Define what a healthy device is, then require it for access to sensitive applications.
4. Replace broad network trust with per-application access where you can, for example by retiring "allow the whole office network" rules.
5. Turn on logging for sign-ins and administrative actions so that you can notice unusual behaviour.
6. Pick one maturity model, such as CISA's, and measure progress against it rather than aiming for an all-at-once rollout.