Zero trust
- Term
- Zero trust
- Exam
- CISA & CISM
- Definition
An approach in which no user or device is trusted by default based on network location; every request is verified.
- Explained
Zero trust removes implicit trust based on network location. Each access request is verified using identity, device health and context, and access is granted to specific applications rather than whole networks.
- In practice
Every request to an internal app is authenticated and checked for device health, even from the office network.
- Often confused with
- Perimeter security
- Exam angle
Defined in NIST SP 800-207.
- Related