Zero Trust assumes no implicit trust, even inside the network:
Core principles:
Verify explicitly: Authenticate and authorize every request based on all available data
Least privilege access: Just-in-time and just-enough access
Assume breach: Minimize blast radius, segment access, verify end-to-end encryption
Implementation:
- Identity-based access (not network location)
- Micro-segmentation of networks
- Continuous validation (not just at login)
- Device health verification
- Encrypted communications everywhere
Zero Trust is increasingly expected in enterprise system design interviews.