Zero Trust
Zero Trust
What is zero trust?
- A security principle: no default trust
- Verify every request, inside or out
- “Never trust, always verify”
What actually changes when you adopt zero trust is not the equipment but the basis for granting permissions. In the past, being on the corporate network or connected to the VPN was itself the permission. Once you were in, you could see every server, from finance to design, and if one account was stolen, the whole list went with it. Under zero trust, network location becomes just one of several inputs, and every single request is re-evaluated each time. On the ground, it means moving from a setup where “turn on the VPN and the whole company opens up” to one where “only the one app you need for your work opens.”
The design standard is laid out in SP 800-207, a document published by the US NIST in 2020. Its core idea is to separate the brain that decides whether access is allowed (the Policy Decision Point) from the gate that actually enforces that decision (the Policy Enforcement Point), and to make every request pass through that gate. Three more elements come with it: identity management (accounts, roles, multi-factor authentication), device posture checks (antivirus, patches, whether it is a company asset), and microsegmentation, which splits the internal network into small zones so an intruder cannot spread sideways. ZTNA is often compared with VPN. The dividing line is that a VPN is a technology that “lets you into the network,” while ZTNA opens a connection only to a specific application.
The most common misstep in practice is treating zero trust as “a product you buy and install.” Many assume that installing a solution and enforcing multi-factor authentication for everyone finishes the job, but the real gaps are elsewhere. Legacy production-management systems that cannot support multi-factor authentication, service accounts used by programs rather than people, and temporary permissions granted in a hurry with no process for revoking them all stay exposed. Conversely, tightening least privilege too hard all at once blocks approvals and lookups, stalls day-to-day work, and floods the team with exception requests until the exception becomes the default. If you bring in the technology first without deciding how often permissions are revoked and who is accountable for it, you end up with more inconvenience and the same level of risk.
Seolyeong ParkGenerative AI and AX training specialist with 17 years of hands-on experience and 200+ sessions, who gets non-technical learners using AI right away
Ilyoung JungSmart factory, equipment management, and Industry 4.0 specialistForrester’s John Kindervag introduced the “Zero Trust” concept in 2010. It became a standard as cloud and remote work spread.
Consider a hypothetical case. Company A, an auto-parts manufacturer with 1,200 employees, connected two plants in Korea and three overseas subsidiaries over a single VPN. An account issued to a partner employee leaked, and an attempt to access the design-drawing server was detected. That kicked off a six-month zero trust transition project.
- When the information security team lead pulled the account ledger, they found that of 3,140 active accounts, 620 had gone unused for over a year and 47 belonged to employees who had left. The team spent its first month on a simple idea: count the keys before you lock the door.
- When the CIO rolled out multi-factor authentication to all employees, the three-shift production floor pushed back: "You want us to stop the line to verify on our phones?" The team switched shared floor terminals to device authentication on company-issued tablets.
- The team first split the design-drawing, quality, and ERP systems apart, so partner accounts could open only a single drawing-viewer screen. Downloads were unlocked only for requests approved by a team lead, and only through temporary 72-hour permissions.
- In the quarterly access review, the team went through 218 exception approvals and revoked 91 of them. A security team manager reported, "Access we granted for a project two years ago was still active," and that led to a documented revocation rule.
- Nine months later, accounts with standing access to the company-wide network dropped from 1,100 to 180, access-related audit findings fell from 14 to 2, and help-desk authentication tickets fell from about 300 a month at the start to about 40.