Zero Trust means never automatically trusting any user or device, even inside the corporate network. Every access request is verified first.

INFOGRAPHIC
Zero Trust: verify every request across every dimension
Verify every request
never trust, always verify
Identity
MFA and SSO
Device
Check device health before access
Application
Per-app access (ZTNA) instead of network-wide VPN
Network
Segment to limit movement
Visibility
Collect logs and detect anomalies

Core principles of Zero Trust

  • Verify identity and device health on every access
  • Grant the least privilege necessary
  • Assume breach and design to limit the damage

How to start Zero Trust without ripping everything out

  • Start with identity: enable MFA (see Which MFA Is Safer?) and centralize sign-in (SSO)
  • Pick one or two key applications and move from network-wide VPN access to per-app access (ZTNA)
  • Segment the network between critical systems to limit attacker movement
  • Collect logs and detect anomalous behavior

Zero Trust is not a product you buy once. It is a direction you improve step by step.

For plants and control systems, whose constraints differ from ordinary IT, read on in Zero Trust for OT

Once you have the basics, see the components and architecture in depth in Zero Trust Architecture: Components and Roadmap.

To see how least privilege applies to administrators in practice, read PAM Explained: Controlling Privileged Access.

Identity is a practical starting point for Zero Trust. See the migration steps in Rolling Out Passkeys in the Enterprise, Step by Step.

For a closer comparison of per-app access and VPN access, read ZTNA vs VPN: Which Should You Choose?.

In the cloud, the parts the customer always owns are accounts, permissions and data. See Cloud Shared Responsibility Model: Who Secures What for which parts are yours under IaaS, PaaS or SaaS.

References and further reading