Definition
Zero Trust is a security framework that operates on the principle of 'never trust, always verify.' Instead of assuming that everything inside a network perimeter is safe, Zero Trust requires strict identity verification for every person and device trying to access resources on a private network, regardless of their location. This approach significantly reduces the attack surface by treating all network traffic as potentially hostile and enforcing least-privilege access. For example, a user trying to access a sensitive document would need to authenticate their identity and device posture, even if they are already connected to the company's internal network. A common confusion is equating Zero Trust with simply using multi-factor authentication, but it's a much broader strategy encompassing network segmentation, device management, and continuous monitoring. Accurate exams for this topic include CompTIA Security+ and CISSP.