Zero Trust
ELI5 — The Vibe Check
Zero trust means 'never trust, always verify' — even if a request comes from inside your network. Traditional security is like a castle with walls: once you're inside, you're trusted. Zero trust treats every request like it's from a potential attacker, regardless of where it comes from. Every API call, every database query, every service-to-service request gets authenticated and authorized. No free passes.
Real Talk
Zero Trust Architecture (ZTA) is a security model that eliminates implicit trust based on network location. Every access request is fully authenticated, authorized, and encrypted regardless of origin. Key principles: verify explicitly (every request), least privilege access, assume breach. Implementation includes identity-based access (BeyondCorp model), micro-segmentation, mutual TLS between services, and continuous verification. Defined by NIST SP 800-207.
When You'll Hear This
"We're moving to zero trust — no more VPN-based access to internal services." / "In zero trust, being on the corporate network doesn't give you access to anything."
Related Terms
Authentication (AuthN)
Authentication is proving you are who you say you are.
Authorization (AuthZ)
Authorization is deciding what you're allowed to do after you've proven who you are.
mTLS
Normal TLS: you check that the website is legit. mTLS: you BOTH check each other. The server verifies your certificate, you verify the server's.
Service Mesh
In a microservices system, every service needs to handle retries, timeouts, mutual TLS, and send traces. You could code all that in every service.