A ZERO-TRUST network architecture is based on the principle

1. ZERO TRUST: discards the legacy 'castle and moat' model where inside = trusted, outside = untrusted. 2. NEW PRINCIPLE: every request (regardless of source) must be AUTHENTICATED, AUTHORISED, and ENCRYPTED. 3. KEY COMPONENTS: • STRONG IDENTITY: MFA on every user; device posture checks. • LEAST PRIVILEGE: scoped permissions per resource, ideally per request. • MICROSEGMENTATION: small network segments — lateral movement is blocked. • CONTINUOUS verification: not just at login but during the session. 4. ENABLERS: identity providers (Okta, Azure AD), zero-trust gateways (BeyondCorp, Cloudflare Access). 5. NIST SP 800-207 is the canonical Zero Trust Architecture document. _Source: NIST SP 800-207 (Zero Trust Architecture)._