What is zero trust?

Zero trust: definition and idea

Classic security follows the castle-and-moat principle: anyone inside the company network is considered trustworthy. That no longer works when employees work from home, data sits in the cloud and service providers need access. Zero trust dispenses with this advance of trust: location within the network alone does not justify permission.

Zero trust is not software you buy but an architectural approach. It is described, among others, in the NIST publication SP 800-207, and Germany’s BSI also takes up the concept. It is implemented step by step and across several technologies.

The core principles

Three ideas underpin the model: every access is explicitly verified, permissions are limited to what is necessary (least privilege), and you assume an attacker may already be in the network (assume breach). This leads to measures that contain damage instead of merely defending the outer perimeter.

Zero trust does not mean distrusting employees. It is about basing decisions on verifiable signals—who is signing in, from which device, with what risk—rather than on the assumption that everything inside your own network is harmless. This makes it harder for attackers to move around, even if an account has been compromised.

• Strong identities with multi-factor authentication as the foundation
• Device checks: access only from up-to-date, managed devices
• Microsegmentation instead of a flat network
• Access to individual applications instead of the whole network (ZTNA)
• Continuous monitoring and automatic response to anomalies

Real-world example: a supplier with service provider access

A machinery supplier with 150 employees gives an external maintenance service access to the company network via VPN. The access is not adjusted for years, and the password is passed on several times. In a worst case, a hijacked service provider account would open up access to design data and ERP alike.

Under a zero trust approach, the service provider gets a personal account with two-factor login, only for the maintenance system, only within the agreed time window and only from a verified device. The session is logged, and unusual access triggers an alert. A stolen password alone no longer suffices for access, and the damage would stay limited to the maintenance system.

Getting started, limits and imple­menta­tion

Zero trust is a journey, not a switch. Companies start with the biggest risks, usually identities, multi-factor sign-in and device management, for example via Microsoft Entra ID with Conditional Access and Intune. Typical mistakes are equating it with a single product, rules so rigid that they paralyze day-to-day work, and a missing inventory of existing accounts and systems.

Nano Concepts helps with an inventory of accounts, devices and access paths, the introduction of multi-factor sign-in and device management, and the gradual replacement of broad VPN access. The plan is based on your risk and your budget, not on a product catalog. We support this as a project or as ongoing consulting.