Skip to content
Search

Zero trust security model

lastmod 2026-02-04created 2023-03-084 edits

Zero trust can be understood as "security activity that, on the assumption that nothing can be trusted, continuously enforces least privilege and fine-grained control based on the user and various other information." Could we sum it up in one phrase as "Never Trust, Always Verify"?

Concept of the zero trust model

Zero Trust literally means there is no trust, that is, "trust no one." The basic concept is a security strategy that trusts nothing from the start when a user or device requests access to a network or data. In traditional security systems, once a user or device passes through the security system known as the castle gate or checkpoint and enters the IT system, that user or device is recognized as trusted because it passed the security system. In the zero trust concept, however, the basic premise is that even a user or device that has passed the security system and connected to the IT system is not trusted.

In the zero trust concept, to access the IT system, that is, to be granted access, every form of validity must first be proven: who the user is, whether the device is a safe, authorized device, what access permissions it has, and so on. Only then are permissions granted and access accepted. This applies not only to accessing the IT system; after connecting, there are many systems inside the IT system, and all the validity checks mentioned above must be proven each time each system is accessed. The same applies when using data inside the IT system. In other words, entering the IT system is not the end of it.

This zero trust model was proposed in 2010 by John Kindervag, principal analyst on the security threat team at Forrester Research. A model already proposed 10 years ago is drawing attention again now, 10 years later. Various companies such as Google, Coca-Cola, and WestJet have adopted the zero trust model to build and apply their security systems, and after the breach of the Office of Personnel Management (OPM) systems that took place from December 2013 to May 2014, the U.S. House of Representatives has recommended that all government agencies adopt the zero trust model.

Zero Trust Architecture (ZTA)

Zero Trust Network Access (ZTNA)

See also

Favorite site

author Zer0 sitemap