Zero trust in plain English
Many corporate networks still work like a medieval castle: walls and a moat protect against the outside world, but anyone who gets inside can move around largely freely. This model is reaching its limits now that data resides in the cloud, employees work from home, and service providers use remote access. The wall simply has too many gates.
Zero trust turns this logic around. The model assumes that an attacker could already be inside the network. That’s why every single access request is verified – regardless of whether it comes from the office, a home office, or the data center.
An analogy: instead of a single gatehouse at the factory entrance, every door in the building has a card reader. Your card opens only the rooms you need for your work. And if it’s used at an unusual time in an unusual place, the system double-checks.
How zero trust works
Zero trust isn’t a product you can buy but an architectural principle. It rests on a few core tenets:
- Verify every access request: Before any access is granted, the system checks who is requesting it, from which device, and in what context – for example, using multi-factor authentication and a check of whether the device is managed by the company and up to date.
- Least privilege: Every person and every system receives only the privileges needed for the task – and ideally only for as long as necessary.
- Small zones: Microsegmentation divides the network into very small areas, between which only explicitly permitted connections are possible.
- Grant access to applications, not networks: Instead of opening up the entire network via VPN, users get targeted access to individual applications. This is known as zero trust network access (ZTNA).
- Continuous monitoring: Logins and access are continuously analyzed to detect anomalies early.
Identity plays a key role. Often, a central identity service handles sign-in for many applications (single sign-on) and enforces uniform rules across them.
A practical example
An engineering services company with many employees working from home has been using a VPN that opens up the entire corporate network after login. Step by step, it makes the switch: sign-in only via a central identity with MFA, access only to the applications each role needs, and only from managed, up-to-date devices.
A few months later, a rigged email attachment infects a laptop with malware. In the past, the attacker could have explored the entire network from there. Now they can reach only the affected employee’s project folder. Monitoring flags unusual access, the laptop is isolated – and accounting and the servers remain untouched.
Why does this matter for businesses?
Many serious attacks start with a single compromised account or device. What matters then is how far the attacker can get from there. Zero trust slows down exactly this spread through the network, which experts call lateral movement.
The topic is also gaining regulatory weight: in its recitals, the EU’s NIS2 Directive cites zero trust principles as an example of basic cyber hygiene – alongside software updates, network segmentation, and identity and access management.
At the same time, zero trust is a journey, not a switch you flip. The transition takes time, a thorough inventory, and clear responsibilities. Implemented half-heartedly, it can easily create a false sense of security.
How to protect your organization
- Take inventory: Determine which data, applications, and access paths are especially worth protecting and who really needs them.
- Strengthen identities: Introduce MFA for all accounts – preferably phishing-resistant methods such as security keys or passkeys – and centralize sign-ins.
- Clean up privileges: Remove unnecessary permissions and separate administrator accounts from everyday accounts.
- Segment the network: Start with the most important boundaries, such as between workstations, servers, and production (network segmentation).
- Include devices: Allow only managed devices with up-to-date software to access sensitive applications.
- Proceed step by step: Start with a clearly defined area and test its effectiveness regularly.
How Rootsektor can help
A realistic test shows whether your zero trust approach works in practice. In a Network & Infrastructure penetration test, we check, among other things, whether segmentation, access rules, and authentication methods actually slow an attacker down – with internal tests conducted either on-site or remotely. For cloud identities, a Microsoft 365 & Azure Review is a useful addition. You can get your fixed-price quote after scoping via our Pentest Quote page.