Zero trust

Zero trust is a security approach in which nobody is trusted just because they are inside the company's network. Every request to open an application or a file is checked, every time, whether it comes from a desk in the office or a laptop at home. No user, device or network starts with any trust.

Why was it needed? The older approach trusted anything inside the office network. A firewall guarded the edge of the network, and once a person or a program was inside, it could reach most systems. But staff now work from home and from client sites, and many applications run in the cloud, not in the office. And an attacker who steals one employee's password, or infects one laptop, is also inside. Under the old approach, that attacker could then move from system to system.

Here is how zero trust works in general. A user, or a program, asks to open one application. First, the system checks who it is, usually through single sign-on with multi-factor authentication. Next, it checks the device: is the laptop the company's own, is it updated, and is its security software running? Then a policy decides whether this identity, on this device, at this time, may open this one application. If it may, the user is connected to that application only, not to the whole network. The checks repeat during the session, and every request is recorded. Zero trust is an approach, not a single product. Security companies sell it as part of SASE platforms, which every laptop connects to first, wherever it is.

Take, for example, a sales employee working from a hotel during a client visit. Zero trust network access (ZTNA) checks her login and her laptop, and then opens only the sales application for her.

Consider a hospital, where hundreds of machines, from scanners to billing computers, share one network. Micro-segmentation divides the network into small zones, so that an attacker on one billing computer cannot reach the scanners.

Say a company's staff paste work documents into outside AI tools. The same gateway that checks every request applies shadow AI control, which limits which AI tools may be used and what may be sent to them.

How is zero trust different from a VPN? A VPN checks the user once, and then places the laptop on the company network, where it can usually reach many systems. Zero trust connects the user to one application at a time, and checks again on each request. It works together with least privilege, which decides how much each checked identity may reach.