The Zero Trust Architecture (ZTA) is a security framework or cybersecurity paradigm built on the core principle of "never trust, always verify". The concept was formally coined by analyst John Kindervag of Forrester Research in 2010. It was created to solve the problem of traditional perimeter-based security models, which failed to protect against threats once they breached the network's boundary. The rise of cloud computing, remote work, and mobile devices rendered the old "trusted internal network" assumption inadequate.
ZTA works by eliminating implicit trust and treating every access request as a potential threat, regardless of whether it originates inside or outside the network. The mechanism is based on three core tenets: Verify Explicitly, Least Privilege Access, and Assume Breach. Access is continuously authenticated and authorized based on real-time evaluation of factors like user identity and device health. Key components include Multi-Factor Authentication (MFA), Identity and Access Management (IAM), and Micro-segmentation, which breaks the network into smaller, isolated segments to limit an attacker's lateral movement.
This framework connects to the NIST Special Publication 800-207, released in 2020, which provides comprehensive guidelines for establishing ZTA. It also relates to Google's BeyondCorp initiative, which implemented a zero-trust model after 2009. The architecture has recently evolved from a network-centric approach to a more comprehensive strategy encompassing users, devices, applications, and data. This shift replaces the outdated perimeter-based model with an identity-based, data-centric approach, with Zero Trust Network Access (ZTNA) being considered an evolution beyond traditional VPNs.