Identity & Access · Chapter 8 of 8
Zero trust, honestly
The most over-marketed term in security, wrapped around a genuinely good idea. This chapter separates the two.
Zero trust appears in 20% of the identity postings in this atlas and in approximately 100% of security vendor marketing. Underneath the noise is a real and useful principle, and being able to state it plainly — while being honest about what it does not solve — is a strong signal in an interview.
The actual idea
Stop treating network location as evidence of trustworthiness. The traditional model had a perimeter: inside was trusted, outside was not, and a VPN moved you inside. That model fails because attackers get inside routinely, and because ‘inside’ stopped being meaningful once workloads moved to cloud and people worked from anywhere.
So instead: authenticate and authorise every request, using identity, device posture and context — not the source address.
What it genuinely gives you
- Lateral movement becomes much harder. This is the real prize: an attacker who compromises one endpoint does not inherit the network.
- Access decisions become auditable, because they are made per request against a policy rather than implied by a network path.
- The VPN stops being a single point of both failure and compromise.
What it does not give you
It is not a product, whatever the vendor says. It is an architectural principle that several products contribute to. A purchase order does not make you zero trust.
It does not fix authorisation. Verifying every request tells you nothing about whether the entitlement behind it was appropriate. An organisation with excellent zero-trust access and terrible entitlement hygiene has moved the problem, not solved it — and this is extremely common.
It does not protect against a valid session doing something wrong, which includes both an insider and an AI agent acting on a poisoned instruction.
It does not remove the need for network controls. Egress restriction still matters, and 'the network is not a boundary' is frequently over-read into 'the network does not matter'.
What it looks like when it is real
| Component | Question that tests whether it exists |
|---|---|
| Strong identity | Is authentication phishing-resistant, or is it a push notification someone can be fatigued into accepting? |
| Device posture | Is the device's state actually checked at access time, or enrolled once and trusted forever? |
| Per-request authorisation | Is policy evaluated on each request, or once at session establishment? |
| Micro-segmentation | Can a compromised workload reach its neighbours? |
| Continuous evaluation | If a device falls out of compliance mid-session, does anything happen? |
| Logging | Can you answer who accessed what, from which device, under which policy? |
The interview answer that lands
“Zero trust means we stopped using network position as a proxy for trust, and authorise each request on identity, device and context instead. The benefit I actually care about is that lateral movement gets much harder. What it does not do is fix entitlements — if the identity making the request should never have had that access, verifying it perfectly just means we let the right person do the wrong thing very reliably.”
That last sentence is the one that marks someone who has implemented it rather than bought it.