The core principles of zero-trust networking

Zero-trust networking is built on four principles that apply to every access decision across the network:

• Never trust, always verify. Every user, device, and connection is treated as untrusted until verified - even if it originates inside the corporate network.
• Verify explicitly. Authentication and authorization are based on multiple data points, including user identity, device health, location, workload, and behavior.
• Apply least-privilege access. Users and devices receive only the access required for the specific task, limiting exposure if credentials are compromised.
• Assume breach. The network is designed with the expectation that attackers may already be inside, minimizing the blast radius of any successful intrusion.

These principles align with the zero-trust architecture defined in NIST SP 800-207 and inform the broader Zero Trust strategy adopted by U.S. federal agencies and global enterprises.

The five pillars of zero trust

The Cybersecurity and Infrastructure Security Agency (CISA) defines zero trust through five pillars that span the components of a modern enterprise network. Each pillar requires continuous verification and policy enforcement. The CISA Zero Trust Maturity Model describes how organizations progress through these pillars from traditional perimeter-based security toward a fully integrated zero-trust architecture.

How zero-trust networking differs from perimeter security

Traditional perimeter security and zero-trust networking take fundamentally different approaches to trust, verification, and access. Perimeter security worked when applications, users, and data lived inside a defined corporate network. Zero-trust networking is designed for environments where users work remotely, applications run in multiple clouds, and data flows across hybrid infrastructure.

Zero-trust networking enforcement mechanisms

Zero-trust networking is enforced through several technologies that work together. Each plays a specific role in verifying users, devices, and connections.

• Identity verification. Strong authentication - including multi-factor authentication - confirms users are who they claim to be before granting access.
• Device posture. Endpoint security tools verify the device requesting access meets security policy before allowing it onto the network.
• Micro-segmentation. Micro-segmentation divides the network into smaller protected zones to contain lateral movement if a breach occurs.
• Continuous monitoring. Network traffic, user behavior, and device telemetry are monitored continuously to detect anomalies and revoke access when risk increases.
• Least-privilege access. Identity and access management policies grant users access only to the specific applications and data their role requires.

How to build a zero-trust network

Building a zero-trust network is a phased process that works with existing infrastructure rather than replacing it. Most organizations follow five steps.

1. Identify assets. Inventory the data, applications, and services that need protection. Assess each asset's value and exposure.
2. Verify users and devices. Implement strong authentication for users and posture checks for devices. Multi-factor authentication and device trust are foundational controls.
3. Map workflows. Document who needs access to which assets, when, and why. This information becomes the basis for access policy.
4. Define and automate policies. Translate workflow decisions into authentication and authorization rules. Automate policy enforcement through firewalls and access control systems.
5. Monitor and adapt. Continuously observe access patterns and device behavior. Update policies as workflows, threats, and the network change.

Zero-trust networking terms

• Protect surface: The asset or set of assets that needs to be protected, such as data, applications, services, or specific user groups.
• Segmentation gateway: A firewall or policy enforcement point that protects a specific segment within a larger network. Segmentation gateways apply zero-trust policies at the boundary of each segment.
• Microsegment: A small, secured area within a larger network protected by its own perimeter. Microsegments allow granular access control to specific workflows and limit lateral movement during a breach.
• Layer 7 firewall: A firewall that inspects packet contents at the application layer, allowing access decisions to consider the actual application and user behavior - not just the network address or port.
• Multi-factor authentication: A verification method that requires users to provide two or more independent factors before granting access. Multi-factor authentication is a core control in nearly every zero-trust deployment.
• Least-privilege access: The practice of granting users and devices only the specific access they need for their immediate task - no more, no less.
• Zero Trust Network Access (ZTNA): A security service that verifies users and grants access to specific applications based on identity and context policies, rather than to the entire network. ZTNA uses a trust broker to authorize each connection request on a need-to-know basis and hides applications from public discovery, which limits lateral movement and reduces the attack surface.
• Software-defined network: A network where rules and policies are written and enforced through software rather than hardware configuration. Software-defined networking is a foundational technology for zero-trust deployments because it allows policies to follow workloads as they move.
• Granular enforcement: The application of fine-grained access control at the level of individual users, devices, applications, or sessions - rather than at the network or perimeter level.

Where zero trust fits with SASE and SSE

Zero-trust networking is the security model. Secure access service edge (SASE) is the architecture that delivers zero-trust controls - along with network connectivity, secure web gateway, and cloud access security broker capabilities - as a converged cloud service. Security service edge (SSE) is the security-focused subset of SASE, including the cloud-delivered controls that enforce zero-trust principles at the network edge.

Zero-trust networking can be deployed with or without SASE. SASE makes zero-trust principles operationally easier to deliver across distributed users and applications.

Common questions about zero-trust networking