Archivesecurity
Zero Trust Is an Architecture, Not a Product
Authenticate and authorize every request based on identity and context — and assume the network is hostile.
- Published
- Reading time
- 1 min read
"Zero trust" means no implicit trust from network location. Being inside the VPN does not grant access; every request carries identity and is evaluated against policy.
The components
- Identity: strong authentication for users and workloads (mTLS, short-lived credentials, SSO with MFA).
- Policy: per-resource authorization, least privilege, evaluated per request.
- Device posture: is the endpoint managed, patched, encrypted?
- Micro-segmentation: services reach only what they need.
- Logging: every decision recorded and reviewable.
What it is not
- A VPN replacement with a new name.
- A single gateway that trusts everything behind it.
- Achievable in one project — it is a migration of identity and network assumptions.
The pragmatic path
Start with workload identity and least-privilege service-to-service auth, then move user access from network-based to identity-aware proxying. Measure blast radius: what can one compromised service reach?
Takeaway: zero trust is a property of your authorization model. If a network location still grants access, you have not started.