Zero trust
A security model that grants access per request based on verified identity, device state and context, never on network location alone.
Zero trust rejects the idea that being inside the network makes a request trustworthy. NIST SP 800-207 describes it as a policy decision point that evaluates each access using user identity, device posture, resource sensitivity and context, and a policy enforcement point (proxy, gateway, sidecar) that applies the decision. Google's BeyondCorp is the best-known implementation.
It exists because perimeters failed: VPNs give flat access, phished credentials and compromised laptops land attackers inside, and cloud and remote work dissolved the edge.
Common confusion: zero trust is an architecture, not a product, and not "trust nothing" in a literal sense. Strong identity (phishing-resistant MFA), device attestation, per-app access and segmentation are the substance. Interviewers often ask you to design a zero trust access gateway: identity-aware proxy, mTLS, policy engine and continuous evaluation.
Learn it properly
Also used in
- How to think like a security engineerSecEng · Foundations of Security EngineeringFree
- The security engineering interviewSecEng · Foundations of Security EngineeringFree
- Secure design principles that still holdSecEng · Foundations of Security EngineeringFree
- SSO at scale: SAML, OIDC and SCIMSecEng · Identity & Access EngineeringPro
- Kubernetes security: hard to get in, harder to get outSecEng · Cloud & Platform SecurityPro
- Remote attestation: proving what is runningSecEng · Hardware roots of trust & confidential computingPro