Read a brief summary of the ebook 👇

What is Zero Trust?

Before the concept of a ‘Zero Trust Network’ was introduced in 2010 by Forrester Research analyst John Kindervag, networks were protected using the perimeter model of security. Think of it like a castle surrounded by a large moat: all your trusted users and precious resources were within the castle walls, safeguarded from the outside world by the moat. Only those who were given access to cross the moat were allowed inside the castle, but once they were inside, they had free access to most parts of the castle. It’s pretty simple, and it makes sense, right?

Just one problem: what if someone managed to get inside without authorisation? Maybe they disguised themselves as a trusted user, or found a way to cross the moat without raising the alarm? Now the castle has a dangerous outsider roaming its innermost sanctums, and no protocols have been established to even look for—let alone identify—the intruder.

How does Zero Trust address this issue?

Zero trust is the direct answer to the issues with the perimeter model, both on a conceptual and technological level.
‍
As a concept, zero trust says that your network can’t implicitly trust users to be who they purport to be. Any device or user trying to access resources on the private network needs to verify their identity first, regardless of whether they’re within the network perimeter or not. The system assumes that there are always attackers present within the network, so no user can be trusted by default.