Zero trust architecture explained

The old security model was a castle and moat: a strong firewall at the edge, and anything inside the network is trusted. That fails when one stolen laptop, one phished password or one compromised server gives an attacker free movement inside.

Zero trust says: never trust, always verify. Network location gives no trust. Every request must prove who it is, from what, and that it is allowed.

The core principles

1. Verify explicitly. Authenticate and authorise every request using identity, device health, location and behaviour.
2. Least privilege. Give users and services only the access they need, only for the time they need it.
3. Assume breach. Design as if an attacker is already inside, to limit what they can reach and to detect them quickly.

What it looks like in practice

For people

• Strong single sign-on with multi-factor authentication (ideally phishing-resistant, like passkeys or security keys).
• Access decisions consider the device (updated, managed, encrypted) and risk signals.
• Apps are reached through an identity-aware proxy, not a flat VPN that opens the whole network.

For services

• mTLS (mutual TLS): both sides present certificates, so services prove their identity to each other.
• Short-lived credentials that rotate automatically, instead of long-lived passwords and keys in config files.
• Service-to-service authorisation: a service can call only the endpoints it needs.
• Microsegmentation: network rules that block everything by default and allow only specific flows.

For data

• Encrypt in transit and at rest.
• Fine-grained access control and full audit logs.

Adopting it step by step

You cannot switch everything at once.

1. Inventory users, devices, services and data. You cannot protect what you do not know.
2. Put strong identity and MFA everywhere first. This gives the biggest gain.
3. Replace broad VPN access with per-application access.
4. Add service identity and mTLS between internal services.
5. Segment the network and remove "allow all" rules.
6. Log, monitor and review access continuously.

Costs and traps

• It is a journey, not a product. Be wary of tools that claim to be zero trust in a box.
• More checks can hurt usability. Balance security with a smooth experience.
• Legacy systems may need a proxy in front of them.

Takeaway: treat the network as untrusted, verify identity and device on every request, give least privilege, and plan for a breach.

---

System Design series, Part 5 (failure and security): 5 of 6. Previous: DDoS defence: how to protect a website.