Zero trust

Traditional networks worked like a castle: hard walls on the outside, and once you were inside, most things trusted you. Zero trust drops the idea of a trusted inside. Being on the corporate network, or connected to the VPN, no longer grants access by itself. Each request to a resource is evaluated on its own, using signals such as the user's identity, the health of the device, the location and the sensitivity of the resource.

NIST SP 800-207 describes the architecture: a policy decision point decides whether a request is allowed, and a policy enforcement point sits in front of the resource and applies that decision. Microsoft summarizes the approach in three principles: verify explicitly, use least privilege access, and assume breach.

Example

An employee opens the payroll application from a managed laptop at home. Before access is granted, the identity provider checks their credentials and MFA, confirms the laptop is compliant and encrypted, and evaluates the sign-in risk. The same user trying from an unknown personal device is limited to read-only access in the browser, even though the password is correct.

Why it matters for a SOC analyst

Zero trust is a direction, not a product you install, and most organizations are somewhere along the way. In practice it means more decisions are logged at the identity and policy layer, such as Conditional Access results, device compliance and session controls, and that data is often where you find out why an attacker's access was blocked, or why it was not.