Zero Trust Security

Many organisations have used network security to secure their systems. They would ensure they had a secure network with only users connecting to the network. When they connected to the network they were generally trusted to access any other systems.

However, organisations are using technology differently now:

• Employees are not connecting to systems from an office.
• Applications are using the cloud.
• Data is stored in many places.
• Services regularly interact with each other using the internet.

A secure network with trusted users is no longer enough to protect your organisation. You no longer trust the users or devices to connect to your network. This is where Zero Trust Security comes in.

Zero Trust Security ensures your company resources are secure by verifying users and devices. The principle is based around:

Never Trust, Always Verify

1. What is Zero Trust Security is a type of cybersecurity that ensures users, devices and applications are verified before they can gain access to company resources. Traditional security methods often use network security to allow users to connect to the internal network and access multiple systems.

However, with Zero Trust Security this is no longer the case. Even if a user is connected to the company network their identity, device and permissions will need to be considered.

For example if an employee is trying to access an internal application they will need to:

• Log into the application.
• Verify their identity.
• Check their device meets the security requirements.
• Check their permissions.
• Only allow access if they meet the security policies.

They will not automatically have access to everything. All requests will be checked against the security requirements.

2. Why is Zero Trust Important?

The network boundary has become more complex. Traditionally organisations would focus on securing their network from within the office. However now employees, applications and services are spread across multiple environments.

This causes some issues:

• Remote working – Employees regularly connect to company systems from home and public networks.
• Cloud Applications – Data is stored and applications are run across multiple cloud platforms.
• Password theft – Credentials can be stolen to allow unauthorised users to access company accounts.
• Insider threats – Employees or authorised users may accidentally expose information or misuse their privileges.
• Devices – Organisations must manage access from devices such as laptops, mobiles and servers.

We can no longer trust users to have access just because they are connecting from a certain network. Zero Trust looks at all access requests.

For example, if an employee is connecting to a company application from a managed laptop they may meet the security requirements. However, if they are connecting from an unknown device or there is suspicious activity during login further verification may be required or no access given. This means organisations have more control over who has access to the systems.

3. Zero Trust Principles

There are many security principles within Zero Trust. These help to prevent unnecessary access and increase security.

3.1 Never Trust, Always Verify

Probably the most well known principle of Zero Trust. Instead of trusting users to have access because they are connecting to an internal network all requests should be verified. This means the organisation can consider:

• User identity.
• Device identity.
• Authentication.
• Location & Context.
• Application/Resource.
• Security policies.

For example, even if the user has authenticated to their company account they may not have access to sensitive financial information. The system should check they have the correct permissions.

3.2 Least Privilege

Least Privilege means only giving users and services the necessary permissions. Giving users too many permissions can cause more damage if their account is compromised or accidentally.

• An administrator would have permissions to manage systems and configurations.
• A developer would have access to development environments.
• An analyst may only have view permissions to reports.

All these roles have different responsibilities so should have different access. If all employees had administrator access this would cause unnecessary risk. With Zero Trust you should be careful with permissions and ensure they are reviewed so users don’t have access to resources they don’t need.

3.3 Assume Breach

Zero Trust assumes organisations may have already had a breach or an attacker may gain access. This means organisations should not rely on one security boundary. Limiting access between systems, monitoring and preparing for possible incidents.

If one user account is compromised the attacker should not be able to access all systems. Limiting permissions and separating resources will help with this.

3.4 Continuous Verification

Authentication should not just be a one off process. Sometimes users may log in but their situation may have changed. For example their device may no longer meet company security policies or unusual activity may be detected. The organisation may want to verify further or deny access.

4. Zero Trust Architecture

Zero Trust Architecture is the framework organisations use to implement the security principles. This will depend on the infrastructure but generally will have some components:

• Identity Provider (IdP) – Manages user identities and authentication.
• Policy Engine – Verifies access requests and checks if they meet security policies.
• Policy Administrator – Takes action based on policy engine decisions.
• Policy Enforcement Point – Controls the connection between the user and resource.
• Monitoring – Capture relevant security events to help identify suspicious activity.

When a user tries to access a company resource the following will occur:

• User requests to access an application/resource.
• Identity provider verifies user.
• Device and context information is checked.
• Policy engine checks if request meets security policies.
• Policy administrator notifies enforcement point.
• Grant/Deny access.
• Monitor relevant activity.

The main thing to note is that the organisation will decide whether to grant the request based on the request. Depending on the technologies being used the architecture may look different but the principles will be the same.

5. Benefits of Zero Trust

Implementing Zero Trust can help improve a number of areas within an organisations security. Some key benefits include:

• Reduce unauthorised access – Users and devices will need to meet the security requirements to gain access to secured resources.
• Improved identity security – Authentication and identity management becomes more important.
• Better access control – Least Privilege means users can’t access systems and information they don’t need.
• Remote working – Employees can securely access company resources.
• Improved visibility – Monitoring will help organisations understand who is accessing resources and identify any suspicious activity.
• Reduce lateral movement – Separating systems and limiting access can make it harder for attackers to move between resources if their account/device is compromised.

Another key benefit is that Zero Trust can be implemented across different environments. Organisations may not need to rely on one internal network.

6. Challenges of Zero Trust

Whilst Zero Trust can help organisations become more secure it may not be easy to implement across the organisation. This can cause issues with the infrastructure, applications and processes. Some common issues include:

• Legacy systems – Older applications may not support modern authentication or identity based access.
• Complex Infrastructure – There may be multiple networks, cloud platforms and applications.
• Poor User Experience – Poorly designed verification can cause frustration for employees.
• Cost – Extra investment may be needed for identity platforms, monitoring and improving the infrastructure.
• Managing Policies – Policies may need to be updated as employees change roles, devices change and new applications are added.

It may be challenging to know where to start. Trying to implement Zero Trust across all systems can cause unnecessary disruption. It is best to implement it gradually. Start with key user accounts, sensitive information and critical applications. This will help organisations understand their infrastructure and make changes.

7. Best Practice

When implementing Zero Trust organisations should start by understanding what they need to protect and how users are currently accessing resources. Some key points to focus on include:

• Identify Key Resources – Understand what systems, applications and data are most important.
• Keep accurate records – Keep track of users, devices, applications and services.
• Strong Authentication – Ensure appropriate authentication methods are in place, especially for elevated accounts.
• Least Privilege – Ensure users only have access to the resources they need.
• Monitoring – Monitor activity around sensitive applications and company information.
• Separate – Don’t allow unnecessary access between environments.
• Review Permissions – Remove access if employees change roles.
• Incident Management – Have a process in place to manage security issues.
• Test Policies – Regularly test policies are working as intended.

This will help create a more controlled environment. Remember to regularly review Zero Trust

As requirements and infrastructure change.

8. Future of Zero Trust

As organisations move towards using cloud platforms, remote working and connected applications identity based security will still be an important aspect of cybersecurity. As organisations use more cloud native environments Zero Trust is becoming more relevant.

Applications and services may be interacting with other services across different cloud providers, networks and infrastructures. This makes traditional network boundaries less practical. Organisations should consider how to authenticate and authorise users, devices and services.

NIST have also released a practical guide titled SP 1800-35 in 2025 showing how organisations can implement Zero Trust Architecture using commercially available technologies. This can be a useful reference.

Overall, Zero Trust is not a product that can be installed to fix all security issues. It is an ongoing strategy that organisations need to review, manage identities, monitor and make changes to policies as their infrastructure changes.

9. Conclusion

Zero Trust is changing the way organisations secure their networks and information. Instead of trusting users and devices because they are connecting to an internal network they will be verified based on their identity, permissions and situation.

Principles such as Least Privilege, Continuous Verification and Assume Breach help to reduce unnecessary access and reduce damage from compromised accounts/devices.

Whilst there can be challenges with implementing Zero Trust, especially with complex/legacy infrastructure, implementing it gradually can help. As businesses move towards using more cloud services, remote working and distributed applications Zero Trust will remain an important part of securing modern IT environments.

References

• NIST SP 800-207 – Zero Trust Architecture: https://www.nist.gov/publications/zero-trust-architecture
• NIST SP 1800-35 – Implementing a Zero Trust Architecture: https://www.nccoe.nist.gov/projects/implementing-zero-trust-architecture
• NIST – Zero Trust Networks: https://www.nist.gov/programs-projects/zero-trust-networks