What is Zero Trust

What zero trust actually means.

Traditional perimeter security trusts everything inside the network perimeter — users, devices, applications. Once authenticated at the perimeter (VPN, firewall), access is relatively unrestricted. This model worked reasonably well when most resources were on-premises and most users were in offices.

Zero trust inverts this. Every access request — from any user, device, or system — is verified before granting access, regardless of whether it originates inside or outside the perimeter. Authentication must be continuous, not one-time. Authorization must be per-resource, not network-wide. Principle: "never trust, always verify."

Why it matters: modern attacks often bypass perimeter controls — phishing gets an attacker into the network; supply chain compromise grants trusted access; VPN credentials get stolen. Once inside perimeter-based networks, attackers move laterally with limited obstacles. Zero trust architecture makes lateral movement much harder because every hop requires re-authentication.

The operational tenets.

NIST SP 800-207 establishes the authoritative zero trust framework. Core principles:

• All data sources and computing services are considered resources — everything requiring access is a resource that must be protected individually.
• All communication is secured regardless of network location — inside the network is not automatically trusted; all traffic must be authenticated and encrypted.
• Access to individual resources is granted per-session — one-time authentication doesn't grant standing access; each session requires re-authorization.
• Access is determined by dynamic policy — authorization decisions consider user identity, device posture, location, behavior patterns, and risk signals, not just credentials.
• Enterprise monitors and measures integrity and security posture — continuous monitoring of all owned and associated assets.
• All resource authentication and authorization are dynamic and strictly enforced — real-time verification, not periodic batch checks.
• Enterprise collects as much information as possible about current state of assets, network infrastructure, and communications — uses this information to improve security posture.

NIST SP 800-207 for authoritative framework.

What zero trust looks like in operation.

Strong authentication

MFA for all access, not just remote access. Phishing-resistant authentication methods (FIDO2, certificate-based) where possible. Continuous authentication that validates session throughout usage, not just at login. See our HIPAA technical safeguards page.

Device posture validation

Before granting access, verify device health — current patches, functioning EDR, encrypted storage, policy compliance. Unhealthy devices are denied access or granted limited access until remediated. MDM enables device posture validation for mobile; endpoint management platforms do the same for laptops and desktops. See our MDM page.

Microsegmentation

Network design that separates resources into small segments with access controls between them. Healthcare application: EHR database separated from general network; lab equipment segmented from office computers; guest Wi-Fi completely separated from clinical systems. Lateral movement restricted at each segment boundary.

Continuous monitoring

SIEM infrastructure aggregating logs from all systems, behavioral analytics identifying unusual patterns, and 24/7 response capability through managed detection and response. See our managed threat detection page.

Least privilege access

Users receive only access required for their specific role, not broader access. Privileged access is time-limited and session-scoped rather than standing. Privileged Access Management (PAM) tools enforce this for administrative access.

Encryption everywhere

All communications encrypted regardless of network location — no more "we're on the internal network so we don't need TLS." Data at rest encrypted on endpoints, servers, and backups. See our data encryption page.

Practical application and realistic implementation.

Healthcare is ideal zero trust application. Mixed device ecosystem (medical devices, workstations, mobile devices, BYOD), distributed access patterns (in-office, remote, telehealth), high-value data (PHI), and sophisticated threats (targeted ransomware, state-sponsored attacks against healthcare research). Perimeter security struggles; zero trust addresses these patterns natively.

Realistic implementation is incremental. Zero trust is not a product to buy — it's an architecture philosophy implemented over time. Typical progression: MFA everywhere (high impact, relatively quick) → microsegmentation of critical systems → continuous monitoring → device posture validation → expanded zero trust over 2-4 years. Full zero trust is a multi-year program; incremental progress produces incremental risk reduction.

Common misconceptions: zero trust doesn't mean trusting nothing ever; it means continuous verification rather than one-time trust. Zero trust doesn't eliminate VPN; it changes how VPN access is verified. Zero trust isn't a single product; it's an architecture implemented through multiple controls. CISA Zero Trust Maturity Model for government-framed maturity framework applicable to healthcare.