What Is Zero Trust?

Definition

Zero trust is a security approach that stops treating anything inside the company network as automatically safe. NIST says zero trust "assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location." Every request is checked on identity, device, and context before access is granted.

How It Works

The traditional model was a castle with a moat: a firewall and VPN at the edge, and broad trust for anything inside. Google's BeyondCorp paper described the problem: once "that perimeter is breached, an attacker has relatively easy access to a company's privileged intranet."

Zero trust moves the checks to each request. NIST SP 800-207 says protections "usually involve minimizing access to resources" to only those subjects and assets that need them, and says authentication and authorization are "discrete functions performed before a session to an enterprise resource is established." In practice:

Strong identity for every user, with phishing-resistant MFA and single sign-on.
Device checks, so only managed, patched, encrypted devices reach company data.
Least privilege, granting access to specific apps, not whole networks.
Segmentation, so one compromised device cannot reach everything.
Continuous monitoring, re-evaluating sessions when risk changes.

CISA's Zero Trust Maturity Model organizes this into "five pillars and three cross-cutting capabilities." The pillars are identity, devices, networks, applications and workloads, and data.

Zero trust is a direction, not a product. For a small business, most of it comes from tools it may already pay for, such as Microsoft 365 conditional access, device management, and SSO.

Real-World Example

On January 19, 2024, CISA issued Emergency Directive 24-01 about Ivanti Connect Secure and Policy Secure, VPN gateways that sit at the network edge. CISA said threat actors were using the flaws "to capture credentials and drop webshells that enable further compromise of enterprise networks," and some could "move laterally, and escalate privileges without detection." CISA required agencies to disconnect the products by February 2, 2024 and told defenders to assume "rootkit-level persistence that can survive a factory reset." The case shows the risk of a single trusted gateway into the whole network.

Why It Matters for a Small Business

Small businesses now work from home offices, phones, and cloud apps, so the "inside" of the network barely exists. Remote access appliances are frequent targets, and a flat network lets one infected laptop reach every file share. Zero trust principles, applied in small steps, cut that exposure: sign-in rules on every app, managed devices, and access limited to what each person needs. It also makes offboarding, lost laptops, and contractor access easier to manage, because access is tied to identities and devices that can be switched off individually.

How to Spot It / How DTS Handles It

Warning signs: a VPN that gives full network access, MFA on email but not on remote access, personal devices reaching company data without checks, one flat office network, and admin accounts used for daily work.

DTS can help with taking zero trust in practical steps: SSO and conditional access, device compliance checks, app-level access in place of broad VPN, and network segmentation. See our managed IT service, or our Microsoft 365 security service.

Related Terms

Least privilege: the core zero trust principle.
Single sign-on (SSO): central identity for every app.
Conditional access: per-request sign-in rules.
Phishing-resistant MFA (FIDO2): the strongest identity check.
Network segmentation: limiting lateral movement.
VPN: the perimeter access zero trust narrows.
Webshell: what attackers dropped on the Ivanti gateways.
NIST Cybersecurity Framework (CSF 2.0): outcomes zero trust helps meet.

Sources

NIST, SP 800-207: Zero Trust Architecture (August 2020): https://csrc.nist.gov/pubs/sp/800/207/final
CISA, Zero Trust Maturity Model (version 2.0, April 2023): https://www.cisa.gov/zero-trust-maturity-model
Ward and Beyer, BeyondCorp: A New Approach to Enterprise Security, ;login: (December 2014): https://research.google/pubs/beyondcorp-a-new-approach-to-enterprise-security/
CISA, ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities (January 19, 2024): https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities

Last updated October 14, 2026.