Zero Trust

Also Known As

TL;DR

Explanation

Zero Trust is a security model that eliminates the concept of a trusted internal network. Traditional perimeter security assumes anything inside the firewall is safe — Zero Trust assumes breach and verifies every request as if it originates from an untrusted network. In practice: authenticate every user and device, authorise every individual resource access, encrypt all traffic (including internal), log everything, and grant least-privilege access. Particularly important for cloud and hybrid environments where the "inside" is not well-defined.

Common Misconception

Why It Matters

Common Mistakes

• Trusting requests because they come from an internal IP — internal networks are routinely compromised.
• Service-to-service calls without authentication — a compromised internal service gets unrestricted access.
• Long-lived credentials instead of short-lived tokens — compromised credentials have a longer attack window.
• Not logging and monitoring internal traffic — lateral movement after initial compromise goes undetected.

Code Examples

// Trust based on network location:
if (in_array($_SERVER['REMOTE_ADDR'], $internal_ips)) {
    // Bypass authentication — 'trusted' internal request
    return $this->handleAdminAction($request);
}
// Attacker on internal network (via phishing, supply chain) bypasses all auth

// Zero Trust — never trust, always verify
// Even internal services must authenticate

// Service-to-service auth with shared secret:
class InternalApiClient {
    public function request(string \$endpoint, array \$data): array {
        \$token   = hash_hmac('sha256', json_encode(\$data) . time(), \$_ENV['INTERNAL_SECRET']);
        return \$this->http->post(\$endpoint, \$data, [
            'X-Internal-Token' => \$token,
            'X-Timestamp'      => time(),
        ]);
    }
}

// Per-request authorisation even inside the network:
class OrderService {
    public function getOrder(int \$id, User \$caller): Order {
        \$order = Order::findOrFail(\$id);
        if (\$order->user_id !== \$caller->id && !\$caller->isAdmin()) abort(403);
        return \$order; // verified even on 'trusted' internal call
    }
}

References

• ↗ https://en.wikipedia.org/wiki/Zero_trust_security_model

Tags

Related Terms