Zero Trust Architecture

Kind: style

Layer: Security Core

Aliases: Zero Trust

Record: architecture:zero-trust-architecture

Severity: contextual

Scope: system, network, identity

Canonical: Ontology

A convention of authenticating and authorizing every request on its own identity and context, whatever network it comes from.

Listed in Architecture principles, after Least Privilege and before Secure by Default.

Requires

• Strong Identity
• Continuous Authorization

Reinforces

• Least Privilege

Enables

• Perimeterless Security

Conflicts with

• Trusted Internal Network Assumption

In tension with

• Latency/Complexity

Tensions

• Zero Trust Architecture / Latency/Complexity

Violated by

• Trusted Internal Network Assumption

Refactored by

• Authentication
• Authorization
• Network Segmentation

Term

• Zero Trust

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Linked from

• Security / Privacy / Compliance / Governance
• Security Privacy Compliance
• Severity levels
• The resolutions