Zero Trust

Zero Trust: Security model that grants no implicit trust and verifies every request based on context. This concept shapes security architectureSecurity ArchitectureThe structured design of security controls, trust boundaries, data flows, and operational responsibilities. and systematically reduces opportunities for attacks or lateral movement. It should be planned, documented, tested, and regularly adjusted based on risk.

How it works and where it fits

Zero Trust is a building block of security architecture that must be understood in its system and business context. Its intended objective, affected trust boundaries, prerequisites, and interaction with other controls are decisive. An isolated definition is therefore not sufficient for implementation or assessment.

Practical security relevance

Sound implementation assigns ownership, configuration, data sources, and verifiable success criteria. Assumptions and exceptions should be documented and changes controlled. Periodic testing shows whether the concept reduces risk in the actual environment or has merely been addressed as a formal requirement.

Related concepts

• Zero Trust Network AccessZero Trust Network AccessGrants application-specific remote access based on identity, device state, and context.: Grants application-specific remote access based on identity, device state, and context.
• Least PrivilegeLeast PrivilegeGrants only the minimum permissions necessary for a specific task and timeframe.: Grants only the minimum permissions necessary for a specific task and timeframe.
• MicrosegmentationMicrosegmentationDivides networks and workloads into very small security zones with specific rules.: Divides networks and workloads into very small security zones with specific rules.
• Continuous AuthenticationContinuous AuthenticationContinuous assessment of whether an active session can still be attributed to the authorized user.: Continuous assessment of whether an active session can still be attributed to the authorized user.