Trending
The first time you use a hotel keycard, it feels like a small letdown. It opens your room, the gym, and the pool. It does not open the room two doors down, the manager's office, or the supply closet. The card knows who you are, what you paid for, and when you are supposed to leave — and it stops there.
That is zero trust in miniature. For decades, most networks worked the opposite way: a strong wall on the outside, and once you were through it, you could wander. Zero trust throws out that assumption. Being "inside" proves nothing. Every request has to earn its access, on its own merits, every time.
You do not need a security background to understand it. Five principles cover the whole idea, and each one has a version you can already picture.
The old model is usually called castle and moat. A firewall guarded the perimeter. Once an employee connected, often through a VPN, they typically reached far more than their job required, because the network assumed they were trustworthy.
Then work changed. Laptops leave the building. Files live in cloud services. Contractors log in from their own kitchens. Personal phones check work email. The perimeter turned into a smear, and a single stolen password could drop an attacker into the trusted middle of everything.
Zero trust is not a product you switch on. It is a set of decisions about who gets access to what, under which conditions, and for how long.
Every request for access should be checked against what you actually know: who the person is, what device they are using, where they are, when they are asking, and what exactly they want to reach. No single signal is reliable on its own. Together, they support a decision.
You already live this. A bank teller asks for ID even though you have been a customer for years. Airport staff screen the crew as carefully as the passengers. The rule is not "I recognize you." It is "show me again."
Never trust, always verify.
Start here: turn on multi-factor authentication, beginning with your email account, since email usually controls password resets for everything else. An authenticator app or a hardware security key is stronger than a code sent by text message.
Least privilege means handing over the smallest set of permissions that still lets someone do their job, for the shortest useful amount of time.
Picture a cleaner in an office building. Their key opens the supply closets, the staff entrance, and the lifts after hours. It does not open the safe, the payroll office, or the executive floor. Nobody has to distrust the cleaner to design the key that way.
Most organisations fail this quietly rather than dramatically. Someone covers for a colleague for two weeks and keeps the extra access for two years. A contractor finishes a project and their account stays alive and forgotten. A shared drive is handed out in full because splitting it takes effort.
What to do: keep separate admin accounts for admin work, put expiry dates on temporary access, and review who holds powerful permissions at least once a quarter. When a colleague needs one folder, share that folder rather than the entire drive.
This principle is uncomfortable on purpose. Instead of asking "how do we keep them out," ask "what happens if they are already in?"
Ships are built with watertight compartments for exactly this reason. Not because the crew expects to hit a rock, but because one breach should not sink the vessel. A house with smoke detectors follows the same logic: you still lock the doors, but you also plan for the fire.
Practically, assume one password has leaked. Does the attacker who has your email password also get your bank, your cloud storage, and your work systems? They do if you reuse passwords anywhere. Use a password manager so every account has its own. Turn on login alerts so a strange sign-in reaches you quickly. Keep backups that ransomware cannot encrypt in the same step it encrypts your live files.
If an attacker reaches one system, they should not reach everything else by default. Segmentation splits a network into smaller zones and controls what is allowed to travel between them.
Think of a staff badge that opens your floor, your meeting rooms, and the cafeteria — but not finance, not the data centre, and not the room where the servers live.
Segmentation shows up in small, practical ways:
You do not have to rebuild everything. Pick your most sensitive data, identify who genuinely needs to touch it, and cut off the rest.
Trust has a shelf life. A login that was fine on Monday morning may be the wrong call by Friday afternoon, if the device missed its updates, the person changed roles, or the account has sat unused for months.
At a concert, your wristband gets you in the gate, but staff still check it at each section. Visitor badges expire at the end of the day for the same reason: yesterday's permission is not today's permission.
Useful habits: short sessions for sensitive systems, automatic revocation when someone leaves or changes roles, and a quarterly sweep for accounts nobody has logged into. An offboarding checklist that includes shared passwords, API tokens, and cloud apps saves you far more trouble than it takes to write.
Those five steps apply all five principles, and none of them require a budget or a specialist. Zero trust is less a product than a habit of asking, for every request: who is this, what do they need, and should they still have it tomorrow?
If you run a business that holds customer data or regulated information, bring in someone who does this work professionally. The principles stay the same; the details get complicated quickly.
Photo: ha11ok / Pixabay
