Zero trust security a plain English guide

[Storm]

TL;DR

• Zero trust means no user, device or network location is trusted automatically: every access request is checked based on identity, device health and context
• The idea was popularised by Forrester analyst John Kindervag around 2010, and Google's BeyondCorp work from 2014 showed it could run at scale
• NIST SP 800-207 (2020) defines zero trust architecture, and CISA's Zero Trust Maturity Model version 2.0 (2023) maps progress across identity, devices, networks, applications and data
• US federal agencies were directed to adopt zero trust by Executive Order 14028 (2021) and OMB memo M-22-09 (2022)
• Zero trust is a strategy and a journey, not a single product, and strong identity with phishing resistant authentication is usually the best first step

Why zero trust became necessary

For decades, many organisations secured their networks like medieval castles. A strong perimeter of firewalls kept outsiders out, and anyone inside the walls was largely trusted. Staff worked in offices, applications ran in company data centres and the boundary between inside and outside was reasonably clear. Security teams focused on guarding the gates

That model has worn thin. People now work from homes, trains and cafes, applications run in multiple clouds, and partners and contractors need access to internal systems. Attackers learned that once they got inside, through a phishing email or a stolen password, they could often move freely. Many of the most damaging breaches of the past decade followed exactly that pattern

Zero trust responds to this reality. Instead of assuming that anything inside the network is safe, it treats every access request as potentially hostile and verifies it explicitly. The phrase often used is never trust, always verify. It sounds stern, but in practice it can make work smoother as well as safer

Where the idea came from

The term zero trust is usually credited to John Kindervag, then an analyst at Forrester Research, who described the model around 2010. He argued that trust based on network location was itself a vulnerability. The idea gained practical credibility when Google published papers from 2014 onwards describing BeyondCorp, its approach to letting employees work securely from any network without a traditional VPN. Google showed that access could be granted based on user and device rather than location

Governments then formalised the concept. In August 2020, NIST published Special Publication 800-207, Zero Trust Architecture, which defines core principles and components. In May 2021, US Executive Order 14028 on improving the nation's cybersecurity directed federal agencies to move towards zero trust, and in January 2022, OMB memo M-22-09 set specific goals for agencies to meet by the end of fiscal year 2024. In April 2023, CISA released version 2.0 of its Zero Trust Maturity Model to help organisations measure progress

The UK NCSC has also published zero trust architecture design principles, and many other national agencies offer similar guidance. While details differ, the core ideas are consistent across them. That consistency makes zero trust a good framework for organisations operating in several countries. It also means plenty of free, authoritative guidance is available

The core principles

The first principle is to verify explicitly. Every request to access a resource should be authenticated and authorised using all available signals, including who the user is, what device they are using, the health of that device, their location and the sensitivity of the resource. Decisions are made per request rather than once at login. This continuous evaluation is a key difference from perimeter thinking

The second principle is least privilege. Users and services should get only the access they need, for only as long as they need it. Just in time access, where elevated permissions are granted temporarily and then removed, is a common technique. Least privilege limits how far an attacker can go with any single compromised account

The third principle is to assume breach. Design systems on the expectation that attackers may already be present somewhere. Segment networks and applications so that a compromise in one area does not spread easily, encrypt traffic internally as well as externally, and monitor continuously for unusual behaviour. Assuming breach shifts the goal from perfect prevention to containment and rapid detection

These principles apply to machines as well as people. Services, scripts and AI agents increasingly access data and systems on their own, and each needs a verified identity, narrowly scoped permissions and monitoring. Non human identities often outnumber human ones in modern environments. Zero trust programmes that ignore them leave a large gap

The five pillars

CISA's Zero Trust Maturity Model organises work into five pillars: identity, devices, networks, applications and workloads, and data. Three cross cutting capabilities run across them: visibility and analytics, automation and orchestration, and governance. Each pillar has maturity stages from traditional through initial and advanced to optimal. This structure helps organisations see where they stand and plan realistic next steps

Identity is usually the foundation. Strong authentication, ideally phishing resistant methods such as passkeys or hardware security keys, combined with centralised identity management and conditional access policies, delivers large benefits quickly. OMB's M-22-09 specifically required phishing resistant multi factor authentication for federal staff. Many experts recommend starting here because so many attacks begin with stolen credentials

Devices matter because a trusted user on a compromised laptop is still a risk. Device management, health checks such as up to date patches and endpoint protection, and policies that restrict access from unmanaged devices all contribute. Networks are segmented into smaller zones, with encryption and controls between them. Applications and data receive protections matched to their sensitivity

What zero trust is not

Zero trust is not a single product. Many vendors market zero trust solutions, and some tools such as zero trust network access services, identity providers and microsegmentation platforms are useful building blocks. No product delivers zero trust on its own, however. It is an architecture and a strategy that combines people, processes and technology

Zero trust also does not mean distrusting employees as people. The phrase refers to not granting implicit technical trust based on network location. Good implementations often make life easier for staff, for example by replacing clunky VPNs with seamless, policy based access to applications from anywhere. Communicating this clearly helps avoid cultural resistance

Nor does zero trust require ripping out existing systems. Most organisations adopt it incrementally, wrapping legacy applications with modern access controls and gradually retiring older approaches. Hybrid states are normal for years. Progress matters more than purity

Finally, zero trust is not a project with an end date. Threats evolve, systems change and new resources appear. Maturity models describe continuous improvement rather than a finish line. Organisations should expect to refine their approach for years

A practical roadmap

Start by understanding what you need to protect. Inventory critical data, applications and services, and map how users and systems access them. This step, sometimes called identifying the protect surface, focuses effort where it matters most. Trying to apply zero trust everywhere at once usually stalls

Strengthen identity next. Consolidate identity providers, enforce multi factor authentication everywhere and move high risk users to phishing resistant methods. Introduce conditional access policies that consider device health and risk signals. Remove standing administrator privileges in favour of just in time elevation

Then improve device and network controls. Bring devices under management, require health checks for access to sensitive resources and segment networks so that critical systems are isolated. Replace broad VPN access with application specific access where practical. Encrypt internal traffic and monitor it

Finally, extend to applications and data. Classify data by sensitivity, apply access controls and encryption accordingly, and integrate logging so that unusual access is detected quickly. Automate responses where possible, such as revoking sessions when risk rises. Measure progress against a maturity model and report it to leadership

Budget and skills shape the pace. Many capabilities are already included in identity and endpoint platforms organisations pay for, so a review of existing licences often reveals quick wins. Training staff and administrators matters as much as buying tools. Managed service providers can help smaller organisations without in house expertise

Zero trust and the post quantum future

Zero trust architectures rely heavily on cryptography: authentication protocols, encrypted tunnels, signed tokens and certificates. All of these will need to migrate to post quantum algorithms over the coming decade. The good news is that zero trust encourages centralised identity, consistent policy enforcement and good inventories, which make cryptographic migration easier. A mature zero trust programme and a post quantum migration programme reinforce each other

Organisations planning zero trust investments should ask vendors about their post quantum roadmaps, especially for identity providers, access proxies and secure tunnels. US Executive Order 14412, signed in June 2026, set 2030 and 2031 deadlines for post quantum key establishment and signatures on federal high value systems. Zero trust components will be part of meeting those dates. Building crypto agility into the architecture now saves work later

Measuring success

• Percentage of users on phishing resistant authentication
• Number of standing privileged accounts, aiming for as few as possible
• Share of devices managed and meeting health requirements before access
• Proportion of applications accessed through policy based controls rather than broad network access
• Time to detect and contain unusual access attempts
• Maturity stage per pillar in the CISA model, reviewed regularly

Closing thoughts

Zero trust is less a revolution than a long overdue update to how we think about security. It accepts that perimeters have dissolved and that attackers will sometimes get in, then designs systems so that every access is verified and every breach is contained. The principles are clear, the guidance is free and the benefits accumulate with each step. Starting with strong identity delivers value quickly

If your organisation is on a zero trust journey, please share what worked and what proved harder than expected. Smaller organisations' experiences are especially valuable, because most published case studies come from large enterprises. Practical lessons help everyone move faster


Key references for citation

• NIST SP 800-207, Zero Trust Architecture, August 2020
• CISA, Zero Trust Maturity Model version 2.0, April 2023
• US Executive Order 14028, May 2021, and OMB Memorandum M-22-09, January 2022
• Google, BeyondCorp research papers, 2014 onwards
• UK NCSC, Zero trust architecture design principles