Zero trust

Zero trust is a security model built on the assumption that no device, user, or network segment should be trusted by default, including ones already inside a traditional network perimeter — every request must be authenticated, authorized, and verified on its own merits, continuously, rather than once at the network’s edge. This is a direct response to the failure mode of older “castle and moat” designs, where anything that got past the firewall was then implicitly trusted to reach internal systems. NIST SP 800-207, the standard reference for the model, frames this shift as moving defenses “from static, network-based perimeters to focus on users, assets, and resources.” Google’s BeyondCorp paper (2014) describes one early large-scale deployment of the idea, moving access decisions away from the network perimeter to individual users and devices.

In practice, zero trust shows up as per-request identity verification, least-privilege access scoped narrowly to what’s needed, and replacing direct network-level access, like exposing RDP or VNC to a whole subnet, with brokered, identity-aware connections to individual resources. CISA’s Zero Trust Maturity Model tracks this same transition across five pillars and four maturity stages, from traditional perimeter defenses through to an optimal, fully identity-aware architecture.

AdminKit groups zero trust under its machine protocols cluster — browse the AdminKit glossary index for other related terms.