Zero trust security verifies every request on its own merits and refuses to treat a network location as proof that the caller is safe.
The older perimeter idea trusted people after they crossed a firewall, which this model deliberately drops.
How it works
Each request is checked for identity, device health, and need, whether it comes from a cafe or from a desk inside the building.
A stolen password or a flat internal network is exactly what the model tries to shrink.
A VPN tunnel can still carry traffic to a private application, but the tunnel is not itself a grant of trust.
Small grants, segmentation, and monitoring replace the assumption that inside means safe.
Concrete examples
- An employee on the office network still authenticates to payroll and passes a device check.
- A contractor reaches one application and no other internal system.
- A compromised laptop inside the building cannot roam freely to every server.
Protective measures
- Authenticate the user and the device for each sensitive application.
- Grant the smallest access the job needs and remove it when the job changes.
- Segment networks so one foothold is not the whole estate.
- Monitor requests instead of trusting an address merely because it is internal.