Zero Trust (ZT) is a cybersecurity approach based on the principle “Never Trust, Always Verify.” It assumes that no user, device, or resource should be trusted automatically, regardless of its network location or ownership.
Zero Trust Architecture (ZTA)
Applies Zero Trust principles to enterprise IT infrastructure and workflows.
Requires authentication and authorization before granting access to resources.
Provides session-based access instead of persistent trust.
Protects resources rather than relying only on network boundaries.
Supports remote users, BYOD (Bring Your Own Device), and cloud-based assets
Core Principles of Zero Trust
Verify explicitly: Authenticate and authorize every access request.
Least privilege: Grant only the minimum permissions required (need-to-know approach).
Assume breach: Operate as if a security breach may occur.
Continuous visibility: Monitor activities, metadata, and security events.
Automation and orchestration: Automate security tasks and coordinate responses.
Dynamic access control: Make access decisions using context, identity, device compliance, and risk.
Unified security policy: Apply consistent security policies across the IT environment
Six Foundational Elements of Microsoft Zero Trust
|
Element |
Purpose |
|
Identities |
Verify users and non-person entities using authentication
and MFA. |
|
Devices |
Monitor device inventory, updates, and compliance. |
|
Data |
Classify, label, and encrypt data at rest and in transit. |
|
Applications |
Secure on-premises and cloud applications. |
|
Infrastructure |
Protect cloud services, servers, containers, and
databases. |
|
Network |
Secure wired and wireless network access. |
Software-Defined Perimeter (SDP)
SDP Client: Runs on the user's device and initiates an access request.
SDP Controller: Verifies the request and decides whether access should be granted.
Access Gateway: Provides the approved connection to the protected application or service.
