Zero Trust

The ideas predate the name. The Jericho Forum argued from 2004 for "de-perimeterisation", and in 2010 Forrester analyst John Kindervag coined "zero trust" for a model that removes implicit trust based on network location. Google's BeyondCorp, described in a series of papers from 2014, was the first large-scale implementation: employees reached internal applications through an internet-facing access proxy that evaluated user identity and device inventory state, with no privileged corporate network. NIST SP 800-207 (2020) became the reference definition, with seven tenets that include treating all data sources and services as resources, securing all communication regardless of location, granting access per session, deciding access by dynamic policy, and continuously monitoring asset integrity and posture.

Architecturally, SP 800-207 separates a control plane from a data plane. The policy decision point comprises the policy engine, which evaluates a trust algorithm, and the policy administrator, which establishes or tears down the session; the policy enforcement point sits in the data path in front of the resource. Inputs to the trust algorithm include the identity provider, device management and EDR posture, threat intelligence, activity logs, data classification and access policy. NIST distinguishes criteria-based algorithms (all conditions must be met) from score-based ones (a confidence level compared with a threshold), and singular from contextual evaluation that considers recent behaviour. It describes three implementation approaches - enhanced identity governance, micro-segmentation and software-defined perimeters - and deployment models such as device agent with gateway, resource portal and enclave gateway. NIST SP 1800-35, finalised in 2025, documents example builds with commercial products.

For planning, CISA's Zero Trust Maturity Model 2.0 (2023) defines five pillars - identity, devices, networks, applications and workloads, data - with cross-cutting capabilities for visibility and analytics, automation and orchestration, and governance, and four maturity stages from Traditional through Initial and Advanced to Optimal. US federal agencies were directed by OMB M-22-09 (2022) toward phishing-resistant MFA, device inventories, encrypted DNS and HTTP, and treating internal applications as internet-accessible.

In practice the common first steps are zero trust network access (ZTNA) replacing broad VPN access with per-application brokering, conditional access that combines identity and device compliance, and segmentation that restricts east-west traffic. Pitfalls are well known: the identity provider becomes a concentration of risk and must itself be hardened and monitored; legacy protocols such as NTLM, SMB file shares and OT systems resist per-request enforcement; session tokens issued after a strong check can be stolen and replayed; and vendors label almost any access product "zero trust". The model does not eliminate trust - it makes each trust decision explicit, narrow, short-lived and logged.