Zero-Trust Security
Term 26 of 68 in the ERPStack technical glossary
What is Zero-Trust Security?
Zero-Trust is a cybersecurity framework based on the premise that no user, device, or system should be trusted by default, whether inside or outside the organization's network perimeter.
Zero-Trust Security at a glance
- Principle
- Never trust, always verify — 0 implicit trust from network location
- Per request
- Identity, device posture and authorisation evaluated on each call, not once at the perimeter
- Reference framework
- NIST SP 800-53 Rev. 5, finalised 23 September 2020, is the control catalogue most assessments map to
- Blast radius
- Segmentation plus least privilege, so 1 compromised credential does not reach 100% of the estate
- Built with
- SSO and MFA at the edge, RBAC in Next.js 16, PostgreSQL 18 policies, Kubernetes segmentation and Terraform-defined AWS or Microsoft Azure networks, scanned with Semgrep SAST and OWASP ZAP
- Numbers that matter
- NIST SP 800-53 Rev. 5, 23 September 2020; 0 implicit trust from network position; 3 highest-value first steps; 1 identity per service, not 1 shared secret
- Compare with
- Perimeter security, where a Virtual Private Cloud boundary implies trust
- Commonly paired with
- SSO, MFA, JWT, RBAC, Terraform-defined AWS or Microsoft Azure networks, Kubernetes segmentation, Semgrep SAST and OWASP ZAP
- Reference architecture
- NIST SP 800-207, Zero Trust Architecture, published August 2020, is where the control language comes from; SP 800-53 Rev. 5 supplies the controls an assessment samples.
- Who asks for it
- government and finance buyers, and healthcare estates where a Virtual Private Cloud boundary on its own stopped counting as an answer.
How Zero-Trust Security works in production
The ERPStack approach to Zero-Trust Security
We design all custom systems with Zero-Trust principles, enforcing VPC network isolation, row-level database controls, and time-bound API session tokens.
Frequently asked questions about Zero-Trust Security
What does Zero-Trust Security replace?
The castle-and-moat assumption. Traditional designs authenticate at the perimeter and treat everything inside as trusted, which fails the moment 1 credential is phished or 1 service is compromised. Zero-Trust Security removes network location as a source of authority: every request carries identity, is authorised on its own merits, and is logged, whether it originated in an office, a laptop or another service.
Is Zero-Trust a product you can buy?
No. Zero-Trust Security is an architectural stance implemented through several controls working together — strong identity with phishing-resistant Multi-Factor Authentication, per-request authorisation, network segmentation, short-lived credentials and comprehensive logging. Vendors sell components that help, but a purchase alone changes nothing if a flat internal network still lets 1 compromised host reach every database.
How does this apply to service-to-service calls?
The same way it applies to people. Under Zero-Trust Security a background job or microservice authenticates with its own identity and short-lived credential, and is authorised for exactly the operations it needs. The pattern this replaces is a long-lived shared secret in an environment variable that grants broad database access — convenient, invisible in logs, and effectively a permanent skeleton key.
What is the practical first step?
Remove standing access. Most organisations get the largest share of the benefit from 3 changes: enforcing strong Multi-Factor Authentication everywhere, replacing long-lived credentials with short-lived ones issued on demand, and segmenting so a compromised workload cannot reach unrelated systems. Zero-Trust Security is a direction of travel, and those 3 steps move further than any single purchase.