Zero trust: never trust, always verify

For decades, corporate security looked like a castle: a strong wall (the firewall at the network edge) and, once you were inside, broad trust. Anyone on the office network could reach most internal systems. That model broke down for good reasons: laptops leave the office, services moved to the cloud, and attackers who get past the wall, often with one stolen password, can then move freely from machine to machine.

Zero trust is the answer security agencies now recommend. Its core idea fits in four words: never trust, always verify. NIST’s reference document, SP 800-207, defines zero trust as moving defences from static, network-based perimeters to focus on users, assets and resources, with no implicit trust granted because of where a device sits on the network.

The principles, in plain words

• No trust by location: being on the office Wi-Fi or the VPN does not, by itself, grant access to anything.
• Every request is authenticated and authorized: access is decided per session and per resource, not once at the door.
• Least privilege: each user, device and program gets only the access its current task needs.
• Context counts: the decision can take into account the device’s health, the time, the location and the behaviour observed.
• Assume breach: design as if an attacker is already inside, and limit how far they could move.
• Monitor continuously: collect information about devices, traffic and requests, and use it to improve decisions.

How the pieces fit

SP 800-207 describes a logical architecture with a policy engine that decides, a policy administrator that sets up or tears down the connection, and a policy enforcement point that sits in front of the resource and applies the decision. In practice, these roles are filled by identity providers with strong MFA, device management tools that report whether a laptop is patched and encrypted, and gateways or proxies that only open a path to a specific application after the checks pass.

CISA’s Zero Trust Maturity Model organises the journey into five pillars: identity, devices, networks, applications and workloads, and data. Few organisations are fully “zero trust”; it is a direction, measured in stages from traditional to optimal, not a product you buy.

What zero trust is not

Zero trust does not mean distrusting your colleagues, and it does not mean removing firewalls. Network controls remain useful; they are simply no longer the only thing that decides. It is also not a single tool: vendors sell “zero trust” products, but NIST and the UK’s National Cyber Security Centre both frame it as an architecture and a set of principles that many tools implement together.

Zero trust on one Mac

The same thinking works on a personal computer. On a typical Mac, every installed app is trusted to connect anywhere it likes, the digital equivalent of the castle model. Applying zero trust means that each app has to earn its network access:

• Identify each app by its code signature rather than its name, so trust is attached to a verified identity.
• Ask before an app’s first connection, and allow only what it needs.
• Take context into account: stricter rules on a café Wi-Fi than at home.
• Keep watching: new destinations, unsigned programs and unusual patterns are signals to review.

This is what FireAI does. It identifies apps by their code signature, prompts or applies per-app rules before connections go out, switches security mode based on the network (Coffee Shop Armor moves to a stricter mode on open or weak Wi-Fi), and in “Under attack” mode lets only apps with an explicit Allow rule connect. It is a small, local version of the same principle: nothing is trusted just because it is already on the machine.

Getting started

1. Know what you have: list users, devices, applications and the data that matters most.
2. Make identity strong: SSO with phishing-resistant MFA for everyone, admins first.
3. Check device health before granting access: updates, disk encryption, screen lock.
4. Replace broad network access with per-application access.
5. Log decisions and review them; refine policies as you learn.