Definition
Zero trust
In one sentence
Zero trust is a security model that assumes no user, device or network location is trusted by default, so every access request is verified explicitly, granted with least privilege and monitored continuously.
Zero trust network accessConditional accessLeast privilegeNetwork segmentation
Zero Trust Explained
Traditional network security trusted anything inside the perimeter. Once an attacker got past the firewall or VPN, they could often reach everything. Zero trust removes implicit trust based on location. NIST SP 800-207 describes the architecture, and the core ideas are to verify explicitly, use least privilege and assume breach.
For a small or mid-sized Canadian business, zero trust is not a product to buy. It is a direction that shows up in specific controls: strong and preferably phishing-resistant MFA, conditional access based on device health and risk, managed devices, removal of standing admin rights, network segmentation, application-level remote access instead of broad VPNs, and continuous monitoring of identity and endpoint activity.
Most of these can be implemented with tools many SMBs already license, such as Microsoft 365 Business Premium. Be cautious of vendors claiming a single product makes you zero trust. The value comes from applying the principles consistently, starting with identity, which is where most attacks on small businesses begin.
General information for Canadian organizations, not legal advice.