What is zero trust?
Zero trust is a security model in which no user, device or connection is trusted by default because of where it sits on the network. Being on the office LAN, in the data center or connected through the VPN earns nothing. Every request to a resource is judged on who is asking, from what device, in what context and for which resource, and access is granted per session rather than once at the perimeter. NIST SP 800-207, published in 2020, is the standard reference for the model and its architecture.
Zero trust is a strategy and a set of principles, not a product. Vendors attach the label to many tools, but no single purchase delivers it.
Why the perimeter model stopped working
The older castle-and-moat design trusted anything inside the firewall. Once an attacker phished one password or compromised one laptop, they inherited that trust and could move laterally to file servers, databases and management consoles. Cloud applications, remote work, contractors and personal devices have also blurred the line between inside and outside, so trust based on location no longer matches how people reach data.
The core principles
- Never trust, always verify. Every request is evaluated explicitly using identity, authentication strength, device health and context.
- Assume breach. Design as if some account or device is already compromised: segment finely, encrypt and monitor internal east-west traffic, and centralize logs.
- Least privilege per resource and per session. Users are connected to the one application they need, with short-lived tokens and just-in-time elevation for administrative rights.
- Continuous verification. Trust is re-evaluated during the session. If the device falls out of compliance or behavior changes, the system can require step-up MFA, restrict the session or end it.
How a zero trust architecture makes decisions
Access is split into two jobs. A policy enforcement point (PEP), such as an access proxy, gateway or endpoint agent, sits in front of the resource and carries out decisions. A policy decision point (PDP) evaluates each request against policy. NIST SP 800-207 divides the decision point into a policy engine, which makes the decision, and a policy administrator, which sets up or tears down the session. Those components form the control plane, while application traffic flows on the data plane. A compromised laptop sits on the data plane and should have no path to change policy. The only implicit trust left is the short hop between the enforcement point and the resource, which is why enforcement points sit as close to resources as possible.
Two decisions for the same user show the idea:
09:12 decision=ALLOW resource=hr-portal user=mlopez auth=fido2 device=managed,compliant
19:40 decision=ALLOW_LIMITED resource=hr-portal user=mlopez auth=fido2 device=unmanaged restrictions=browser-only
The user and the authentication method are the same. The device changed, so the decision changed.
Zero trust vs. VPNs, NAC and defense in depth
A traditional VPN places a remote device on the internal network, where it can reach anything the firewall allows. Zero trust network access (ZTNA) connects the user to specific applications instead. Network access control (NAC) traditionally checks a device's posture when it joins the network, while zero trust evaluates every request for the whole session. Defense in depth is about stacking layers, and zero trust is one way to design those layers. Firewalls and perimeter controls stay in place; what goes away is the assumption that passing them makes a request trustworthy.
Zero trust on the CompTIA Security+ exam
SY0-801 covers the principles in objective 1.1 and the architecture, including device health checks, conditional access and microsegmentation, in the secure architecture scenarios of objective 3.2. Wording such as regardless of network location, the internal network should not be considered trusted, evaluate every request, check device posture before granting access, or limit lateral movement points to zero trust. Wrong answers usually grant trust by location: placing a server on a trusted VLAN, allowing a subnet because the company owns it, or treating a VPN connection as proof of identity. A control that checks only once, such as a posture check at network join, also falls short. Zero trust also appears in A+ Core 2 (220-1202) objective 2.1.