Zero Trust

What it is

Zero Trust is a security model that eliminates implicit trust in corporate networks. The core principle is "never trust, always verify": every request is authenticated, authorized, and encrypted regardless of origin — whether from the internet or the internal network.

The term was coined by Forrester in 2009 and formalized by NIST in publication SP 800-207 (2020), which defines seven fundamental principles: explicit verification, least-privilege access, assume breach, microsegmentation, end-to-end encryption, continuous monitoring, and policy automation.

Why the perimeter no longer works

The traditional perimeter security model assumes everything inside the corporate network is trustworthy. This fails for three reasons:

• Remote and hybrid work: users access from uncontrolled networks
• Cloud services: resources are no longer within a physical perimeter
• Lateral movement: an attacker who penetrates the perimeter has free access to the entire internal network

Reference architecture

The Policy Engine evaluates each request considering: user identity, device state, location, time, requested resource, and risk level. Being authenticated is not enough — context determines access.

Implementation models

BeyondCorp (Google)

Google published its Zero Trust implementation in 2014. Key principles:

• No privileged network — the corporate network grants no additional access
• Access is based on device and user, not network location
• An Access Proxy mediates all connections to internal applications
• Device state (patches, disk encryption, certificate) is verified on every request

Identity-Aware Proxy (IAP)

Services like Cloudflare Access, AWS Verified Access, and Google IAP implement Zero Trust without VPN:

• The user authenticates via OIDC/SAML against the identity provider
• The proxy verifies identity and policies before forwarding the request
• Internal applications are never directly exposed to the internet

Microsegmentation

In a microservices architecture, microsegmentation applies access policies at the individual service level. With a service mesh like Istio:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: product-service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: product-service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/api-gateway"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/api/products/*"]
    when:
    - key: request.auth.claims[iss]
      values: ["https://auth.example.com"]

This policy allows only the api-gateway to access the product-service, only with GET method, only on specific paths, and only with a valid JWT token from the correct issuer. Any other combination is blocked by default.

Comparison: traditional perimeter vs Zero Trust

Implementation pillars

CISA defines five pillars for Zero Trust maturity:

1. Identity: multi-factor authentication, continuous verification, risk-based access
2. Devices: complete inventory, state verification, policy compliance
3. Network: microsegmentation, traffic encryption, east-west traffic inspection
4. Applications: per-application access (not per-network), continuous security testing
5. Data: classification, encryption, granular access control, loss prevention

Why it matters

Zero Trust is not a product you buy — it is an architectural shift that affects identity, network, applications, and data. Implementation is incremental: start with multi-factor authentication and identity-based access, then advance toward microsegmentation and continuous monitoring. For teams with microservices and service mesh, microsegmentation with mTLS is the most natural entry point.

References

• NIST SP 800-207: Zero Trust Architecture — NIST, 2020. Federal standard defining Zero Trust principles.
• BeyondCorp Enterprise — Google Cloud, 2023. Reference Zero Trust implementation.
• OWASP Zero Trust Architecture Cheat Sheet — OWASP, 2022. Practical implementation guide.
• CISA Zero Trust Maturity Model — CISA, 2023. Maturity model with five pillars.
• Forrester: The Business Benefits of Zero Trust — Forrester. Origin of the term and business benefits analysis.