Zero Trust in practice: The 10 basic rules for protection that promotes resilience

Index

• Why a mere ‘protective wall’ is no longer sufficient
• Zero Trust as the logical response to structural risks
• Selected forum contributions on this topic
• The 10 core principles of an effective zero trust architecture
• Security is an architectural decision
• FAQ

465 billion US dollars – that is how much the authors of a study by Zscaler and Marsh McLennan (PDF-Download) from 2025 estimate the global damage that could have been avoided in eight years through the consistent implementation of a zero-trust architecture. The situation in Europe is even more alarming: according to the study, 41 per cent of the security incidents analysed there are considered potentially preventable.

The message is clear: cyber incidents are no longer solely the result of highly complex attacks. They are often the consequence of structural failures in architecture, access control and identity management.

Why a mere ‘protective wall’ is no longer sufficient

The classic security model is based on a logic that was long taken for granted: the outside is dangerous, the inside is trustworthy. For decades, this thinking shaped the architecture of corporate networks, with clearly defined boundaries and a protective wall designed to shield everything behind it.

But this paradigm no longer holds true. The conditions under which companies operate today have changed fundamentally:

• No clear perimeter: Data and workloads are distributed across multi-cloud environments, on-premises systems and SaaS platforms. The corporate network is no longer a closed space, but a dynamic ecosystem.
• Hybrid working models: Employees, partners and service providers access resources regardless of location and using a wide variety of end devices. Identities constantly move across system and organisational boundaries.
• Automated attacks: Attackers are shifting their focus away from deceiving users and towards the automated exploitation of web attack surfaces (Link in German) . Attackers no longer need human error; an opportunity is enough.
• Identities as a gateway: Access data, tokens and privileged accounts are also important targets for attack. Anyone who logs in with legitimate rights can bypass traditional protection mechanisms.

This does not render traditional IT security obsolete, but it does weaken it structurally. The real problem today is less a lack of technology than implicit trust within complex infrastructures. As long as ‘internal’ is automatically considered ‘trustworthy,’ the attack surface remains larger than any firewall could ever compensate for.

Zero Trust as the logical response to structural risks

This is precisely where Zero Trust comes in. Not as an additional security tool, but as an architectural principle that consistently replaces implicit trust.

Where there is no longer a clear perimeter, Zero Trust protects critical data and systems through continuous verification: every access is checked based on context, regardless of whether it originates from the internal network, the cloud or outside the organisation. Security is not based on location, but on identity, device status and risk profile.

Where hybrid working models undermine traditional control mechanisms, Zero Trust enables secure, location-independent access: Employees, partners and service providers are given exactly the rights they need – no more and no less. This increases security without slowing down productivity.

Where automated attacks exploit vulnerabilities in seconds, Zero Trust systematically reduces the attack surface: lateral movement within the network is severely restricted through the principle of minimal rights assignment, micro-segmentation and continuous monitoring. Compromised access does not automatically mean a compromised company.

And where identities become the primary target, Zero Trust shifts the security focus precisely there: to access rights, authentication and transparency. Overprivileged accounts, orphaned permissions and uncontrolled service access can be systematically eliminated.

In addition to the security benefits, this approach offers further strategic advantages: an integrated zero trust architecture reduces tool proliferation, creates clear governance structures and enables measurable progress along a defined roadmap. Security becomes plannable and therefore controllable.

Zero Trust is therefore less of a radical break than a logical further development of existing security structures. The difference lies not in individual technologies, but in attitude: trust is not assumed, but continuously verified.

The 10 core principles of an effective zero trust architecture

Zero Trust is not created by individual products, but by consistent architectural decisions. To turn a security concept into a robust structure, the measures can be divided into three strategic pillars.

Pillar I: Strategic guidelines – the attitude behind every access.

1. Explicit verification – trust is not a starting point

Access is not granted simply because it originates from the internal network. Each request is re-evaluated based on context, including identity, location, device status and risk profile. Authentication is a continuous process, not a one-time check.

Effect in practice: Significantly reduces the risk of unauthorised access and lowers the likelihood of costly security incidents.

2. Least privilege – access within the necessary scope

Permissions follow the minimum principle: as much as necessary, as little as possible. Just-enough and just-in-time access prevent permanently overprivileged accounts.

Effect in practice: Minimises potential damage propagation while improving transparency, traceability and auditability of access.

3. Assume Breach – architecture for resilience

Zero Trust plans not only for prevention, but also for emergencies. The aim is to limit the so-called ‘blast radius’, i.e. the potential extent of damage after a successful attack. If a system is compromised, the incident must not be allowed to spread uncontrollably. Instead, the affected area remains isolated, while the rest of the infrastructure remains protected and functional.

Effect in practice: Increases operational resilience and reduces downtime and follow-up costs.

Pillar II: Technical enforcement – the digital immune system

4. Identity as the new perimeter

In distributed IT landscapes, identity becomes the central security authority. Phishing-resistant multi-factor authentication forms the basis for this.

Effect in practice: Effectively protects critical access points and strengthens the trust of customers, partners and regulators.

5. Device integrity as a prerequisite for access

Not only users, but also end devices must meet security requirements. Patch status, encryption and active security mechanisms are checked before access is granted.

Effect in practice: Prevents compromised or insecure devices from becoming a gateway.

6. Micro-segmentation to limit lateral movement

By dividing the network into isolated zones. This can prevent so-called lateral movement, i.e. an attacker moving sideways, and an attack remains locally limited.

Effect in practice: Reduces potential major damage and provides targeted protection for particularly sensitive systems.

7. Data security follows the information

Protective mechanisms are based on the sensitivity of the data, regardless of where it is stored. Classification, encryption and access controls also secure information outside the company network.

Effect in practice: Supports compliance requirements and provides long-term protection for business-critical know-how.

Pillar III: Intelligence and governance – responsiveness and strategic anchoring

8. Adaptive policy engines for real-time decisions

Dynamic policies automatically assess risks and make context-based decisions in a fraction of a second.

Effect in practice: Increases response speed to threats and reduces manual effort.

9. Continuous transparency and analysis

Comprehensive monitoring and modern analytics create visibility across users, devices and data streams.

Effect in practice: Enables early detection of anomalies and reduces the time it takes to contain an incident.

10. Zero Trust as a strategic initiative

Zero Trust is not purely an IT project, but part of the corporate strategy. Governance, processes and responsibilities must be clearly defined and anchored throughout the organisation.

Effect in practice: Ensures sustainable security structures and increases investment security in IT architecture.

Security is an architectural decision

Today, cyber risks are primarily a question of architecture. Those who continue to rely on implicit trust are managing uncertainty. Those who consistently implement zero trust create resilient structures, reduce vulnerabilities and limit potential damage.

Zero Trust is therefore not a short-term security project, but a strategic framework for resilience and digital sovereignty. Those who embed the principles early on are investing not only in protection, but also in stability and sustainable trust.