Zero Trust Security: Why Being Inside the Network Proves Nothing

The 30-second explanation

For a long time, security worked like an office with a guarded front door. Get past reception and you could wander most of the building. Zero trust drops that idea. Being on the company network earns you nothing by itself. Each time a person or a program asks for access, the system checks who is asking, whether their device looks healthy and whether they need that particular thing, then lets them in for that one purpose only.

How it works

1. 1

   1. Verify who

   The user signs in with MFA, ideally a phishing-resistant method, so identity is checked before anything else.

2. 2

   2. Check the device

   The laptop or phone is checked for basics like a managed install, current updates and a running security agent.

3. 3

   3. Grant the minimum

   Access is limited to the one application or dataset requested, for as long as the task needs it.

4. 4

   4. Keep watching

   Sessions are logged and re-checked, so a change in behaviour or device health can cut access mid-session.

The older model is often called castle and moat. A firewall and a VPN form the wall, and once a person or a laptop is inside, most systems treat it as friendly. That holds up until one stolen password, one infected laptop or one phished employee puts an attacker on the inside. From there they can move from machine to machine with very little in the way. Zero trust is built for that day. Access is decided fresh each time. It depends on who the user is, checked with MFA, whether the device is managed and up to date, and what exactly is being requested. Even then the answer is narrow: access to one application, not to the whole network. Systems are split into small segments, so a compromised laptop cannot talk to the finance database just because both sit in the same building. Everything is logged, which gives defenders a trail to follow. Zero trust is a way of designing access. Vendors sell tools that help, but no single purchase makes an organisation zero trust.

Real-world example

How to spot it

• One VPN login reaches everything

  After connecting, a user can see file servers, admin consoles and databases their job never touches.

• A flat internal network

  A single compromised laptop can talk freely to servers across the whole company.

• Permanent admin rights

  People hold powerful access all the time, instead of getting it only while a task needs it.

• Trust between systems by default

  Internal services accept each other's requests without checking identity, because they sit on the same network.

What to do

1. 1Start with identity: turn on MFA everywhere, and move admins and email to phishing-resistant methods first.
2. 2Shrink access to what each role needs, and replace standing admin rights with temporary grants wherever you can.
3. 3Split the network into segments and log access between them, so one compromised device has a short list of places to go.