What is zero trust security?

Zero trust security is a security model that trusts no one by default. In a zero trust model, anyone trying to access the network must be continuously verified via mechanisms like multi-factor authentication. Zero trust architectures use such technologies to tightly control access and protect against data breaches.

Explore additional Zero Trust topics:

What is the history of zero trust security?

The zero trust security model’s origins go back at least to the early 2000s, when a similar set of cybersecurity concepts was known as de-perimeterization. Forrester analyst John Kindervag eventually coined the term “zero trust security.” The zero trust security model came to the fore around 2009, when Google created the BeyondCorp zero trust architecture in response to the operation Aurora cyberattacks, which involved advanced persistent threats (APTs) that had eluded traditional cybersecurity architectures.

Zero trust architecture overview

The core logic of a zero trust architecture is essentially “don’t trust, always verify.”

In a world of complex cybersecurity threats and mobile workforces equipped with numerous applications and devices, zero trust security (or ZTNA for short) aims to provide comprehensive protection, by never assuming a request comes from a trustworthy source — even if it originates from within the corporate firewall. Everything is treated as if it comes from an unsecured open network, and trust itself is viewed as a liability within the zero trust framework.

Zero trust security may also be called perimeterless security. This term shows how it is the polar opposite of traditional security models, which follow the principle of “trust, but verify” and regard already-authenticated users and endpoints within the company perimeter, or those connected via virtual private network (VPN), as safe. But such implicit trust increases the risk of data breaches caused by insider threats, since it allows for extensive, unchecked lateral movement across the network.

A zero trust architecture instead is built upon:

Explicit verification and continuous validation

Network users must be authenticated, authorized and validated in real time, and on an ongoing basis, to ensure that they always have the proper privileges. Numerous data points, such as location and patch level, may be leveraged for this purpose. One-time validation of a user identity is no longer enough.

Least-privileged access

Zero trust security enforces the principle of least privilege, so that identities only get the lowest level of access to the network by default. In tandem with other cybersecurity practices such as network microsegmentation, least-privileged access sharply limits lateral movement within a zero trust security model.

Reduced attack surface

When implementing zero trust principles, an organization will zero-in on its most critical data and systems — its “protect surface” — and defend them with a comprehensive platform. Such an approach is more efficient than stitching together a bunch of point solutions, such as VPNs, to protect the attack surface around each user.

Why is zero trust security important?

Zero trust data security is important because it is the most reliable cybersecurity framework for defending against advanced attacks, across complex IT environments with dynamic workloads that frequently move between locations and devices. A zero trust architecture is especially important as multicloud and hybrid cloud deployments become more common and expand the range of applications that companies use.

Indeed, with the number of endpoints in the typical organization on the rise and employees using their personal devices to access cloud applications and company data, traditional cybersecurity methodologies can’t reliably prevent data breaches. A malicious insider who has already connected to the company network via VPN would be trusted from then on, even if their behavior were unusual — e.g., they were downloading enormous amounts of data, or accessing logins they had not previously ventured near.

In contrast, the zero trust model is always evaluating each identity on the network for risk, with a close eye on exactly that type of contextual, real-time activity. Zero trust frameworks never assume that an identity is trustworthy, and accordingly require it to prove itself before being allowed to move through the network. Another way to think of zero trust security is as a perimeter-free, software-defined model that is continuously scaling and evolving to protect applications and data, no matter the user, device or location.

What are the benefits of zero trust security?

The main benefits of a zero trust model are:

  • Superior risk mitigation from closing security gaps and controlling lateral movement on the network.
  • Improved cybersecurity and support for mobile and remote employees, as Gartner has highlighted.
  • Strong protection for applications and data, whether they’re in the cloud or on-premises.
  • Reliable defense against advanced threats like APTs.

How does a zero trust architecture work?

Implemented properly, a zero trust security model is closely attuned to behavioral patterns and data points associated with all requests made to a company network. Zero trust security solutions may grant or deny access based on criteria such:

  • Geographic location
  • Time of day
  • Operating system and firmware version
  • Device health
  • Endpoint hardware type

Effective zero trust security will be highly automated, and its protections may be delivered via cloud and/or from an on-premises implementation.

Identity providers are key components of any zero trust framework, as they provide a variety of identity and access control measures such as:

  • Mulitfactor authentication: Second factors like additional devices and one-time codes may be required on top of a correct password.
  • Single sign-on: A common set of credentials allows access to multiple applications, and can be granularly managed and revoked at any time.
  • Lifecycle management: Workflows like employee onboarding and offboarding can be streamlined by assessing and correlating identity directories.

Beyond those fundamental capabilities and others, specific zero trust security tools may deliver advanced protection through:

Network segmentation and traffic isolation

Cybersecurity solutions such as next-generation firewalls and secure browsers help isolate traffic from the main corporate network. This segmentation curbs lateral movement and reduces data breach risk.

What is the importance of segmentation to zero trust security?

Segmentation minimizes the damage of a breach even if it does occur. Because risky users are confined to a relatively small subnet of the network, they cannot move laterally without authorization. Under normal circumstances, microsegmentation also helps limit access by user group and location.

Unified endpoint management

From one interface, administrators can manage all applications and resources across the enterprise. Unified endpoint management helps keep up with the rapid pace of updates to different applications and operating systems, plus it simplifies any complexity created by mergers and acquisitions.

VPN-less proxies

Classic VPNs do not align with zero trust principles, since one-time access gives a user the metaphorical keys to the kingdom. Instead of this castle-and-moat approach, the zero trust model will use a dedicated VPN-less proxy that sits between user devices and the full spectrum of applications they need, from enterprise SaaS to unsanctioned web apps. This proxy can enforce granular cybersecurity measures, such as disabling printing, copying and pasting on an endpoint if the contextual evidence supports doing so.

Security analytics

Analytics solutions amass the valuable data needed for determining what counts as anomalous activity on a network. Networks can intelligently evaluate in real time whether a request is risky.


Software-defined wide area networks (SD-WANs) provide cloud security, including secure direct access to SaaS and traffic encryption, along with scalable bandwidth and intelligent traffic control for applications of all kinds.

How to design and build a zero trust network?

Zero trust security is not a single product, but an overarching framework for continuously evaluating risk and controlling access across an environment. Accordingly, multiple solutions, including but not limited to those described above, may be deployed in tandem to support a zero trust model.

The exact process for designing and building zero trust security will vary by organization and solution set, but a common progression will involve:

  1. Assessing existing cybersecurity controls and determining the key network flows and vulnerabilities.
  2. Determining a protected surface that will be shielded from harm through zero trust security measures.
  3. Implementing specific technologies such as multifactor authentication, VPN-less proxies and secure embedded browsers.
  4. Continuously monitoring the network to keep tabs on suspicious activity and fine-tune the solution mix and overall cybersecurity approach as needed.

How does Citrix help with zero trust security?

Citrix equips companies with end-to-end solutions for realizing a zero trust architecture that defends their protect surfaces:

From Citrix Analytics for Security to Citrix Gateway, organizations are able to implement all mission-critical components of a zero trust architecture — all in one secure digital workspace solution, Citrix Workspace. Learn more about getting started with Citrix Workspace.

Additional resources