For years, IT security worked like a castle. You built a strong wall (the firewall), guarded the gate (the VPN), and trusted whoever made it inside. If you were plugged into the office network, the systems assumed you were one of the good guys.
That model made sense when everyone sat at a desk in one building. It makes far less sense today, when the same person checks email on a phone in a train, opens files from a cloud drive at home, and logs in to a dozen web apps that never touch the office network at all.
The castle-and-moat problem
The weakness of the castle model is simple: once an attacker gets inside, they are trusted too. A single stolen password, one infected laptop or one careless click can give someone a foothold. From there, they can often move from machine to machine, because the network treats everything “inside” as safe.
Many well-known breaches follow this pattern. The first entry point is rarely the most valuable system; it is just the easiest door. The damage comes from what the attacker can reach afterwards.
The question is no longer “are you inside the network?” It is “should this person, on this device, reach this thing, right now?”
What zero trust actually means
Zero trust is not a product you can buy. It is a way of designing access, described in detail by the US National Institute of Standards and Technology in its publication NIST SP 800-207. Stripped down, it rests on three ideas:
- Verify every request. Check who the user is and what state their device is in, every time they ask for access, not just once at the front door.
- Give the least access needed. People and apps get exactly what their job requires, and nothing more.
- Assume a breach has already happened. Design so that if one account or machine is compromised, the damage stays small and gets noticed quickly.
The five building blocks
1. Strong identity
Every person has one account, managed in one place, protected by multi-factor authentication (MFA). If you do only one thing from this article, turn on MFA for email and remote access.
2. Device health
Access depends on the device too. Is it a known office laptop? Is it updated, encrypted and running antivirus? An unknown or out-of-date device gets less access, or none.
3. Least-privilege access
Admin rights are given only when needed and taken back afterwards. The accounts team does not need access to the server room’s management console.
4. Segmentation
The network is split into smaller zones, so a problem in one area cannot spread freely to everything else.
5. Logging and monitoring
Every login and access decision is recorded and reviewed. Unusual activity, such as a login from a new country at 3 a.m., raises an alert.
You do not need all five on day one. Zero trust is a direction you move in, step by step, not a switch you flip.
Where a small IT team should start
Most organisations cannot redesign everything at once. This order gives the most protection for the least effort:
- List your accounts. Find every user account, including old ones for staff who have left. Disable what is not needed.
- Turn on MFA for email, VPN and any admin login.
- Remove everyday admin rights. Staff should work in standard accounts and use admin access only when required.
- Keep devices patched. Set automatic updates for operating systems and browsers.
- Turn on logging for logins and review it weekly, even briefly.
- Separate critical systems such as servers and finance tools onto their own network zone.
Three common myths
| Myth | Reality |
|---|---|
| “Zero trust means we don’t trust our staff.” | It means the system checks every request, which also protects staff when their password is stolen. |
| “We need to buy a zero trust product.” | Vendors sell useful pieces, but zero trust is an approach. Many first steps use tools you already own. |
| “It’s only for big companies.” | Small teams benefit most, because one breach can hurt them the hardest. |
The firewall still matters; it just isn’t the whole story any more. Treat it as one checkpoint among many, and build your security around who is asking, from what device, for what, rather than where they happen to be sitting.