Zero Trust — Zero Trust / Zero Trust Architecture (ZTA)

Zero Trust is a security model that breaks with the assumption that everything inside one's own network is trustworthy. The guiding principle is „never trust, always verify“: every access is checked individually, context-dependently and continuously — regardless of whether it comes from inside or outside. Protection is no longer oriented at the network boundary but at the individual resources.

History & facts. The classic moat model — hard outer boundary, soft interior — fails in a world of cloud services, mobile devices and home office, in which there is no longer a clear „inside“. Zero Trust shifts control to every single access request. The model was decisively shaped by NIST Special Publication 800-207 (2020): it defines an architecture of Policy Engine and Policy Administrator (the decision) as well as Policy Enforcement Point (the enforcement) and makes identity the central control plane. Core principles are explicit verification, minimal rights per request and the assumption of already being compromised („assume breach“). Outlook & recommendation. Zero Trust is not a product one buys but an architectural goal one reaches step by step — via strong, ideally phishing-resistant multi-factor authentication (MFA), consistent segmentation, context-based policies and complete logging. Precisely because most attacks run via compromised identities, continuous verification is the core. In practice one begins where the risk is greatest (privileged access, critical applications) and builds out the model iteratively.

Related terms