NetSec Platform: Zero Trust

Zero Trust is an approach to network security that removes implicit or assumed trust. It isn't a product and it isn't owned by any one vendor.

Zero Trust is built on a simple idea:

Never trust by default, always verify. Apply least privilege access, and assume breach.

In practical terms, Zero Trust means:

• Access is explicitly granted (not assumed)
• Identity and context are central (user, device, application)
• Trust is dynamic (it can change mid-session)
• Security inspection is continuous (visibility is mandatory)
• Controls are enforced consistently (regardless of location)

Zero Trust doesn't mean every connection is treated as hostile. It means trust is verified, rather than inherited because a user is on a corporate network.

Why Does Zero Trust Matter?

Traditional network security was built around a perimeter mindset, placing the firewall as the boundary with a Virtual Private Network (VPN) extending the trusted network outward. It assumed everything inside the network was trusted (implicit trust) and everything outside the network was untrusted.

That model no longer scales safely in modern environments. Users and applications are distributed and trusted networks now contain more unmanaged devices and third parties than ever before. Lateral movement is a key part of the attack chain.

Zero Trust is a platform outcome created by combining:

• Identity and device context
• Intelligent policy engine
• Distributed enforcement fabric
• Predictable connectivity and traffic steering
• Visibility and operations

The Kipling Method

The Kipling Method is a simple way to structure security policy decisions that reflect the desired business outcomes:

• Who is the user?
• What is the application?
• When is the access happening?
• Where is the user/device?
• Why is the access needed?
• How is the access being requested?

Together, these questions ensure access decisions are intentional, explainable, and auditable.

How Palo Alto Networks Enables Zero Trust

Taking a broader platform approach can ensure Zero Trust principles are applied consistently, using identity and context as first-class policy inputs.

Palo Alto Networks implements Zero Trust through a set of identification and context capabilities. These capabilities enable policy enforcement based on verified context rather than implicit network assumptions.

The following capabilities act as policy inputs and enforcement mechanisms across the platform:

User-ID: maps network activity to a user identity and group membership, typically integrated with an Identity Provider (IdP). Rather than writing policy against a source IP address, User-ID lets policy be written for the person and their group membership directly.

App-ID: dynamically identifies the application in use, regardless of port and protocol. Where traditional firewalls see traffic using port 443, App-ID identifies what's actually running inside the session. This allows more granular controls, such as blocking a specific function within an otherwise-permitted application.

Device-ID: provides device-level context for policy decisions, distinguishing managed corporate devices from unmanaged or personal ones. On its own, Device-ID identifies what kind of device is connecting, combined with User-ID, it enables more precise decisions.

Content-ID: covers content inspection and data controls to govern what can happen within a session, such as scanning for threats and controlling file transfers. This is especially important for SaaS and AI-driven applications, where the risk isn't necessarily the application itself, but what a user does inside it.

Policy-based decryption is a critical factor underpinning Zero Trust, since most traffic is encrypted. Many of the capabilities above operate on what's actually inside the session, not just on what's visible at the network layer. Without visibility into the traffic, network policy cannot be verified or enforced consistently.

Device posture is assessed through GlobalProtect's Host Information Profile (HIP), checking attributes like disk encryption, patch level, and security software status. This allows conditional access policies to be configured based on compliant devices and non-compliant devices.

Zero Trust capabilities are operationalised through a common control plane, Strata Cloud Manager (SCM), which provides visibility, policy management, and posture validation across the platform.

Putting this together, a Zero Trust policy looks something like:

Allow engineering users on compliant devices to access approved developer applications, with decryption, logging, MFA, and threat prevention enabled.

The goal of Zero Trust isn't to make access harder, it's to make access safer, more consistent, and easier to operate at scale.

Operational Outcomes

• Reduced attack surface: access is granted to specific applications rather than broad network segments, not exposing more of the network than necessary
• Smaller blast radius: if an account or endpoint is compromised, the attacker is unable to move laterally across the network
• Reduced manual effort: policies are consistent and repeatable, based on users, groups, and applications
• Improved visibility, troubleshooting, and compliance: access decisions are tied to identity, device, and application context, making them explainable and traceable

In the next post, we'll look at how these outcomes are achieved in practice with Prisma Access.