Zero Trust Security: What Does It Actually Mean?

A member of staff arrives at the office. They connect their laptop to the company network. They enter the correct password.

TRADITIONAL THINKING:
YOU'RE INSIDE.
WE TRUST YOU.

Zero Trust asks different questions: Who are you? Is this really your device? Is the device healthy? What are you trying to access? Do you actually need access to it? Is anything about this request unusual?

The simple definition

NIST describes Zero Trust as an evolving set of cybersecurity ideas that moves protection away from static network perimeters and towards users, assets and resources. Authentication and authorisation are treated as separate decisions before access to a resource is established.

Microsoft commonly expresses the approach through three principles: verify explicitly, use least-privilege access and assume breach. Microsoft also describes Zero Trust as a security strategy rather than a single product or service.

What does “never trust, always verify” mean?

It is a useful shorthand, not an instruction to make users authenticate every thirty seconds. A modern access decision can evaluate identity, device, location, risk, application, behaviour and the sensitivity of the requested resource.

Good Zero Trust should often make security smarter, not simply more annoying. A low-risk request from a healthy, known device may be straightforward. A high-risk request for sensitive data should receive more scrutiny.

Why did the old model stop working?

The traditional perimeter model concentrated security on keeping attackers out of the office network. Once inside, users and devices were often trusted more readily.

OFFICE
   |
FIREWALL
   |
COMPANY NETWORK
   |
PCS + SERVERS

ONCE INSIDE: RELATIVELY TRUSTED

That model made more sense when staff worked in one office, servers were on premises, applications were internal, PCs belonged to the business and access happened through the LAN.

Modern businesses use Microsoft 365, cloud applications, remote working, mobile devices, home networks, SaaS, contractors, suppliers, personal devices, APIs and AI services. The network perimeter did not disappear. The business simply grew far beyond it.

Castle and moat

The familiar castle-and-moat analogy is still useful, but it describes only part of the problem.

Zero Trust supplements and reframes perimeter security. It does not make firewalls, secure networks or physical security unnecessary.

The three principles

1. Verify explicitly

Do not rely solely on “password correct = access granted”. Verify identity with strong authentication and consider the device, location, risk, application, behaviour and requested resource.

• MFA and passkeys
• Account and sign-in risk
• Device status and management
• Conditional Access or equivalent policy decisions
• Separate administrator accounts
• Role-based access
• Stale-account removal

A correct password from an unusual location on an unmanaged device requesting a sensitive application deserves more scrutiny than a routine request from a healthy business device.

2. Use least-privilege access

Give people and workloads only the access they need, for the shortest time practical.

• Reception does not need Domain Admin.
• Marketing does not need payroll.
• A contractor does not need the entire SharePoint estate.
• An application does not need permission to every mailbox because that was easiest to configure.

3. Assume breach

Assume breach does not mean assuming every employee is a criminal. It means designing security with the expectation that a password may be stolen, a laptop may be compromised, malware may execute, an account may be hijacked or an application may contain a vulnerability.

Then ask: how far can the attacker get? Zero Trust does not assume security will fail. It designs for what happens when one layer does.

The hotel keycard analogy

A hotel does not give a guest one master key because they have been allowed into the building. Their key opens their room and perhaps the gym. It does not automatically open every other room, the manager's office, the safe or the server room.

That is least privilege. Being allowed through reception does not entitle you to every door in the building. If the key is cancelled, access stops.

What does Zero Trust actually look like?

The Zero Trust business estate

CISA's maturity model and other recognised approaches describe related pillars and capabilities in different ways. The following is the IT Club practical view, not an official CISA diagram.

Across everything sit visibility, monitoring, automation and governance. Without those, a business may have policies on paper but no dependable way to know whether access is still appropriate.

Identity: who are you?

Identity has become one of the new security perimeters. A stolen password should not automatically equal a stolen business.

• Use MFA or passkeys for important accounts.
• Review Conditional Access or equivalent access policies.
• Separate administrator identities from everyday email and web browsing.
• Assign access to named people rather than shared accounts where possible.
• Remove stale users, guests and third-party access.
• Review privileged roles and use role-based access.

Read the IT Club Microsoft 365 Security Baseline Checklist →

Read the IT Club Microsoft 365 Admin Health Check →

Read the IT Club guide to passkeys →

Device: what are you using?

Access should not depend only on who is signing in. It can also depend on what they are using.

Imagine Mark signs in with the correct password and correct MFA, but his laptop has not patched for months, endpoint protection is disabled, the device is unmanaged and there are indicators of compromise. Should it receive exactly the same access as a healthy, managed business laptop? Zero Trust says not necessarily.

• Maintain an inventory of business and approved personal devices.
• Patch operating systems and important applications.
• Use device management where the business needs policy enforcement.
• Keep endpoint protection enabled and monitored.
• Use encryption where appropriate.
• Use device health or compliance as an access signal where the tools support it.

Intune and Microsoft technologies are examples of ways to implement parts of this model, not mandatory requirements. A business should choose controls that fit its devices, operating systems and risk.

Application: what are you allowed to run?

Traditional endpoint security often concentrates on “is this file known to be malware?” A Zero Trust and application-control approach can also ask: why should this application run at all?

• Allow known and authorised software.
• Control or block unknown software.
• Restrict application privileges.
• Control application behaviour and access to sensitive resources.
• Review software inventory and remove unnecessary local administrator rights.

Network: where can you go?

If one PC is compromised, should it automatically communicate with every server, printer, workstation and management interface? No.

Attackers often compromise one thing and then try to move sideways. Segmentation, restricted management interfaces, firewall rules and application-specific access can reduce lateral movement and the blast radius of an incident.

Data: what can you actually see?

An employee may legitimately access customer project files but not HR files, payroll or board documents. Data permissions should follow business need, not “everyone has always had access”.

The same question applies to SaaS applications, guest access, shared links, supplier accounts, backups and AI services: what information can this identity or workload actually reach?

Zero Trust and Microsoft 365

Many Microsoft 365 Business Premium customers may already own capabilities that can support significant parts of a Zero Trust approach. Depending on the current licence, tenant configuration and product changes, examples can include Microsoft Entra ID, Conditional Access, MFA, passkeys, Intune, Defender, device compliance and role-based access.

That does not mean Microsoft 365 Business Premium equals Zero Trust complete. Owning the building blocks and configuring, enforcing and reviewing them properly are very different things. Licensing, feature availability and the organisation's needs should be checked against current Microsoft documentation before making a purchase or design decision.

Microsoft 365 Security Baseline Checklist →

Microsoft 365 Admin Health Check →

Microsoft Secure Score: Is Your 365 Actually Secure? →

Zero Trust does not mean Microsoft

Microsoft has a substantial Zero Trust ecosystem, but Zero Trust itself is an architectural and security approach. It can involve technologies from many suppliers.

• Identity and MFA
• Endpoint management and EDR
• Application control
• Network segmentation and firewalls
• DNS security
• Privileged-access management
• Data protection
• Monitoring
• Backup and recovery

Zero Trust and Cyber Essentials

Cyber Essentials is not the same as Zero Trust. Cyber Essentials establishes important baseline technical controls. Zero Trust is a broader security architecture and strategy.

There is overlap around secure configuration, access control, malware protection, patching and authentication. But Cyber Essentials certification does not prove that an organisation has completed Zero Trust, and Zero Trust does not automatically equal Cyber Essentials compliance.

What counts as a cloud service for Cyber Essentials? →

Business certifications: Cyber Essentials, ISO and beyond →

Zero Trust and remote working

The old question was: are they in the office? Better questions are: who are they, what device are they using, what resource are they requesting, what is the risk and what access do they need?

A person sitting in head office is not automatically safer than the same person sitting at home. A trusted office network can still contain a compromised device, an over-privileged account or an attacker who has already obtained access.

What about VPNs?

A VPN can provide a secure network connection. It does not inherently mean that everything behind the VPN should be trusted.

Traditional VPN designs can sometimes provide broad network access after authentication. Zero Trust asks whether access can instead be application-specific, identity-aware, device-aware, risk-aware and least privilege.

Zero Trust and administrators

The account capable of changing everything deserves stronger controls than the account reading email.

• Use separate administrator accounts.
• Do not use an administrator account for everyday email and web browsing.
• Keep administrator permissions to the minimum required.
• Use just-in-time or temporary elevation where practical.
• Require strong authentication.
• Use restricted administrator devices where the risk warrants it.
• Monitor privileged activity.
• Maintain carefully controlled break-glass or emergency accounts.

What if the account is stolen?

WEAK ENVIRONMENT:
STOLEN PASSWORD
      ↓
VPN / M365
      ↓
FILES
      ↓
SERVERS
      ↓
ADMIN ACCESS
      ↓
LARGE BREACH

ZERO TRUST-ORIENTED:
STOLEN PASSWORD
      ↓
MFA / PASSKEY CHALLENGE
      ↓
DEVICE CHECK
      ↓
ACCESS POLICY
      ↓
LIMITED PERMISSIONS
      ↓
SEGMENTATION
      ↓
MONITORING / DETECTION
      ↓
CONTAINMENT

No single control is guaranteed. The aim is to reduce blast radius. The question is not only “can we stop the attacker getting in?” It is also “how much can they do if they do get in?”

The “zero” in Zero Trust

The name causes confusion. It does not mean zero human trust, zero employee trust, zero access or zero productivity.

Common Zero Trust myths

Zero Trust for a ten-person business

Zero Trust does not need to become a £100,000 enterprise transformation programme. A ten-person business can make practical progress in stages.

The IT Club Zero Trust Starter Check

Use this as a conversation starter with the person responsible for IT and security. It is deliberately qualitative. Do not turn it into a fake security score.

Identity

• MFA or passkeys are deployed for important accounts
• Stale accounts are removed or disabled
• Administrator accounts are separated

Device

• A device inventory exists
• Devices are patched
• Endpoints are protected
• Encryption is enabled where appropriate

Application and access

• A software inventory exists
• Local administrator access is controlled
• Unknown applications are considered before use
• Permissions, guest access and third-party access are reviewed

Network and data

• The firewall is maintained
• Management interfaces are restricted
• Segmentation has been considered
• Sensitive data locations are known
• Access follows business need
• Backups have been tested

Monitoring

• Security alerts are reviewed
• Sign-in anomalies are reviewed
• Endpoint incidents are reviewed

Where should you start?

Do not start by buying a Zero Trust product. Start with trust relationships.

1. 1Who has access?
2. 2What devices have access?
3. 3What applications can run?
4. 4What data can each person reach?
5. 5Who has administrator rights?
6. 6What happens if an account is compromised?
7. 7What would stop an attacker moving sideways?
8. 8Would we notice?

Zero Trust and AI

As businesses add AI applications, AI agents and SaaS AI features, the same fundamental questions apply: who or what is requesting access, what data can it see, what action can it take, does it need that permission and is the action monitored?

This is deliberately a short future-facing point. As AI becomes capable of acting rather than merely answering questions, Zero Trust principles become even more relevant.

Read the IT Club guide to Shadow AI →

The IT Club Practical Zero Trust Model

This is an original IT Club practical model, not an official NIST, CISA or Microsoft standard. It adds recovery because a small business needs operational resilience as well as access controls.

VERIFY
   ↓
LIMIT
   ↓
SEGMENT
   ↓
MONITOR
   ↓
RECOVER

Zero Trust needs an Operational Heartbeat

Zero Trust is not implement once and finished. People join, people leave, devices change, applications appear, suppliers gain access, AI tools appear, permissions accumulate and risks change.

• Identities and administrator rights
• Devices and device health
• Applications and SaaS usage
• Guests and third parties
• Permissions and sensitive data
• Network access and segmentation
• Security events and unusual behaviour
• AI and other new service usage

Use the IT Club Operational Heartbeat checklist →

Review the IT Club website backup and recovery plan →

IT Club view

Zero Trust sounds complicated because the security industry has turned it into an enormous technology category. The basic idea is much simpler.

• Do not assume. Verify.
• Do not give everyone everything. Limit access.
• Do not assume your defences will never fail. Limit the damage.
• Do not configure security once and forget it. Keep checking.

For a small business, Zero Trust does not need to begin with an expensive transformation programme. Start with identities, devices, permissions, applications and administrator access. You may already own many of the tools you need. The important part is changing the assumption from “you're inside, so you're trusted” to “show me why this access should be allowed.”

Sources and further reading

NIST SP 800-207: Zero Trust Architecture →

CISA Zero Trust Maturity Model Version 2.0 →

Microsoft Zero Trust overview →

Microsoft 365 Business Premium documentation →

NCSC: Introduction to Zero Trust →

NCSC: Zero Trust migration — where do I start? →

Frequently asked questions