Traditional security: Trust internal network. Zero trust: Verify everything.
Principles:
- Verify explicitly: Authenticate and authorize every request
- Least privilege: Minimal access needed for the task
- Assume breach: Design as if attackers are already inside
Implementation:
- mTLS between all services
- Short-lived tokens, not long-lived credentials
- Network segmentation
- Continuous verification (not just at login)
Why now: Cloud, remote work, and microservices erased the network perimeter. You can't trust based on IP address anymore.