Zero trust starts with identity
What "never trust, always verify" really means for users, devices and service accounts.
"Zero trust" is one of the most overused terms in our industry. Vendors put it on firewalls, VPNs and dashboards. But zero trust is not a product. It is an architectural principle, described well in NIST SP 800-207 (opens in a new tab): no implicit trust based on network location. Every access request is evaluated on its own merits.
If the network no longer decides who is trusted, something else must. That something is identity.
From "inside" to "who, what and how"
The traditional model was a castle: hard walls, soft inside. Once you were on the internal network or the VPN, you could reach most systems. Ransomware groups love this model, because one phished laptop gives them the whole castle.
In a zero trust model, each request answers three questions:
- Who is asking? A strongly authenticated user or workload identity.
- From what? A known, managed and healthy device.
- For what, and how much? Only the access this task needs, for as long as it needs it.
Five identity building blocks
1. One authoritative identity
Every person has one identity, driven by HR or another authoritative source, with automatic joiner, mover and leaver processes. Orphaned accounts of people who left years ago are the quiet enemy of zero trust.
2. Phishing-resistant authentication
If the identity is the new perimeter, it must not be phishable. That means passkeys or FIDO2 security keys, at least for administrators and remote access. SMS codes are not enough.
3. Conditional access
The policy engine combines signals: user risk, device compliance, location, the sensitivity of the application and the time of day. A healthy managed laptop gets seamless access; an unknown device gets limited access or a step-up challenge.
4. Least privilege and just-in-time administration
Nobody should be a permanent domain administrator. Privileged roles are requested for a task, approved, time-limited and logged. Standing privileges are the treasure attackers look for.
5. Non-human identities
Service accounts, API keys, certificates and AI agents now outnumber people in most organisations. They need owners, short-lived credentials, rotation and the same least-privilege thinking. A forgotten API key with full access is a castle gate left open.
Where to start
- Inventory identities, both human and non-human, and remove the ones nobody owns.
- Enforce phishing-resistant MFA for administrators and remote access.
- Put your most critical application behind conditional access first, and learn from it.
- Replace standing admin rights with just-in-time elevation.
- Log every access decision, and actually look at the logs.
Zero trust is a journey of many small steps, not a big-bang project. Every step that makes access depend on verified identity instead of network location is a step in the right direction.