Breaking Down Least Privilege, MFA, Microsegmentation, and More
Zero Trust was coined by John Kindervag at Forrester Research in 2010. The concept was a direct challenge to the prevailing "trust but verify" model: a perimeter-based approach that assumed anything inside the network firewall was safe. Kindervag flipped this on its head: trust no one, verify everything.
But what does Zero Trust actually mean in practice? It's built on five core principles:
1. Least Privilege
Every user and system should have access to only the resources they absolutely need : nothing more. Think of it like giving a house-sitter only the key to the front door, not the safe. Least privilege limits the damage any single compromised account can cause. This applies to people, as well as to systems: a print server that needs to access a spool directory should relinquish that access the moment printing is complete.
2. Network and Device Access Controls (NAC)
Network Access Controls (802.1x) keep unauthorized users and devices off your network. In a Zero Trust environment, every device attempting to connect must be evaluated for security posture, OS compliance, and user credentials before gaining access. Devices that fail checks can be quarantined or removed.
3. Multi-Factor Authentication (MFA)
A username and password is single-factor authentication : and single-factor is not enough. True MFA requires at least two distinct factors: something you know (a password), something you have (a security token), and/or something you are (a fingerprint). This dramatically raises the bar for attackers who have purchased credentials on the Dark Web.
4. Microsegmentation
Rather than one large network "moat," microsegmentation divides your environment into many small zones. If one zone is compromised, attackers cannot easily move laterally to others. Traditional network segmentation used VLANs and ACLs : microsegmentation goes further, applying firewall policies all the way down to individual workloads or applications.
5. Ongoing Monitoring and Validation
Zero Trust is never a "set it and forget it" approach. Authenticated users and systems must be continuously validated as they move through the network. Behavioral anomalies trigger investigation, not assumed trust.
Key Takeaway: Zero Trust is not a technology : it's a set of principles. Any organization, regardless of size or budget, can begin applying these principles incrementally to dramatically reduce its risk exposure.
Tags: Zero Trust | MFA | Least Privilege | Microsegmentation | Fundamentals
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →