Summary
Zero Trust is a security model that grants access based on continuously verified identity, device posture, and policy. It explicitly drops the idea that being "inside the network" implies any trust.
What is Zero Trust?
Traditional security assumes a strong perimeter: outside is hostile, inside is friendly. Zero Trust rejects this assumption. Every request is evaluated as if it came from an untrusted network — because today it usually does. The decision to allow a request combines who is asking (authenticated identity), where they are asking from (device posture, location), what they are asking for (resource), and what the policy says.
Zero Trust Network Access (ZTNA) is the concrete networking pattern. Instead of dropping authenticated users into a flat internal network, every connection is brokered by a policy decision point that checks identity, device, and intent. Mesh VPNs based on WireGuard, paired with an identity provider and policy engine, implement this model directly: clients build encrypted peer connections, but the connections only exist if the central policy allows them.
The model rests on several capabilities: a strong identity provider with MFA, automated identity lifecycle (SCIM), device posture checks, fine-grained ACLs, and observability of every access decision. Regulatory frameworks (NIS2, DORA, US Executive Order 14028) increasingly cite Zero Trust as the target architecture.
Why is Zero Trust relevant?
- No perimeter dependency: Works for remote, hybrid, multi-cloud, and BYOD reality
- Least privilege by default: Every connection requires an explicit allow rule
- Limits blast radius: A compromised credential or device cannot move laterally unchecked
- Compliance alignment: NIS2, DORA, and ISO 27001 all push toward this architecture
Related Terms
- Mesh VPN: Practical implementation pattern for Zero Trust Network Access
- Identity Provider: Source of identity that every Zero Trust check relies on
- Single Sign-On: Login flow that produces tokens consumed by Zero Trust policies
- Multi-Factor Authentication: Strength layer required for trustworthy identity
- Device Posture: Health and compliance check fed into Zero Trust decisions