01Introduction
The old model trusted anything inside the network perimeter. Cloud, remote work and SaaS removed the perimeter. Zero trust assumes the attacker is already inside and verifies every request anyway.
02What is Zero trust?
Zero trust is a security model, defined in NIST SP 800-207, in which no user, device or workload is trusted by default based on network location. Every access request is authenticated, authorized and evaluated against policy, with least-privilege access and continuous verification.
It applies to identity, devices, networks, workloads and data. It also applies to the application itself, where broken access control is the most common way a trusted session is abused. See application security.
03How Zero trust works
Zero trust replaces location with verification.
- 1.
Strong identity
Phishing-resistant MFA and short-lived credentials for users and workloads.
- 2.
Device posture
Check device health, often via EDR, before granting access.
- 3.
Least privilege
Grant the minimum access needed, per request and per resource.
- 4.
Continuous evaluation
Re-check context throughout the session and log everything.
04Threats and risks
Zero trust is often implemented at the edge and forgotten inside.
Over-privileged identities
IAM roles and service accounts with far more access than they use. See CSPM.
Broken object-level authorization
An authenticated user fetching another user's records by changing an ID.
Long-lived secrets
Static keys that undermine short-lived identity. See secrets detection.
Implicit service trust
Internal APIs that accept any caller on the network.
05How Parameter helps
Parameter tests whether least privilege actually holds.
Authorization testing
The pentesting agents test your app and APIs as different users and roles to find access control gaps.
IAM attack paths
Cloud Security finds roles and policies that grant more reach than intended.
Secrets cleanup
Secrets detection finds long-lived keys to rotate and replace.
