Zero trust is a set of cybersecurity principles that removes implicit trust based solely on a user’s or device’s network location or ownership. Access is evaluated in relation to the resource being requested. NIST’s SP 800-207 describes zero trust architecture as focusing on users, assets and resources rather than relying on a static network perimeter.
How zero trust access works
An organisation identifies the people, devices, services and data it needs to protect. Before access to a resource is established, the relevant identity and authorization policies are checked; device and other contextual information may also inform a decision. Policies need to apply across the systems where resources live, including cloud services and internal applications. The precise controls depend on the architecture and risk.
Illustrative business example
Illustrative example: A staff member connecting from outside the office requests access to a finance application. The service checks the user’s identity, the device and the requested role before providing access to the permitted functions. A request for a more sensitive operation may require an additional check. This example is not a description of a deployed Technine system.
Zero trust and perimeter security
A traditional perimeter model often treats the internal network differently from external networks. Zero trust does not treat network location alone as proof of trust; it focuses on resource access and identity. It does not mean that every request is handled identically, or that a VPN is automatically incompatible. A VPN can still provide a network connection, while access to each resource follows its own policy. Learn about connected devices and IoT and system integration.
Limits and implementation needs
Zero trust is not a single product or a setting that removes security risk. It depends on knowing which identities, devices and resources exist, maintaining permissions, enforcing policies and reviewing access activity. Older applications may not support modern identity controls, and policy errors can block legitimate work. Plan the rollout around business processes, test access paths and retain a recovery process.
For a service-focused overview, see technine.io’s cybersecurity and compliance service.
Frequently asked questions
Does zero trust mean trusting nobody?
It means not granting implicit trust based only on location or ownership. Access decisions still use defined identity, authorization and other relevant policies.
Does zero trust replace a VPN?
Not necessarily. A VPN can provide network connectivity. Zero trust concerns how access to particular resources is evaluated and controlled.
Is zero trust a security product?
No. It is an architectural approach and set of principles that can be implemented through a combination of identity, access, device and monitoring controls.
Primary source: NIST Special Publication 800-207: Zero Trust Architecture