NetSec Platform: Zero Trust

Zero Trust is an approach to network security that removes implicit or assumed trust. It isn't a product and it isn't owned by any one vendor.

At a high level, Zero Trust is built on a simple idea:

Never trust by default, always verify. Apply least privilege access, and assume breach.

In practical NetSec terms, Zero Trust means:

  • Access is explicitly granted (not assumed)
  • Identity context is central (user, device, application)
  • Trust is dynamic (it can change mid-session)
  • Security inspection is continuous (visibility is mandatory)
  • Controls are enforced consistently (regardless of location)

Zero Trust doesn't mean every connection is treated as hostile. It means trust is earned and verified, rather than inherited just because a user is on the corporate network.

Why Does Zero Trust Matter?

Traditional network security was built around a perimeter mindset, placing the firewall as the boundary with a Virtual Private Network (VPN) extending the trusted network outward. It assumed everything inside the network was trusted (implicit trust) and everything outside the network was untrusted.

That model no longer scales safely in modern environments. Users and applications are distributed and trusted networks now contain more unmanaged connected devices and third parties than ever before. Lateral movement has become a primary attack path.

High level visual summary of traditional trust vs Zero Trust

Zero Trust as a platform outcome is created by combining:

  • Identity and device context
  • A policy engine that can clearly express intent
  • Distributed enforcement points
  • Predictable connectivity and traffic steering
  • Visibility and operations

The Kipling Method

The Kipling Method is a simple way to structure security policy decisions that reflect the desired business outcomes:

  • Who is the user?
  • What is the application?
  • Where is the user/device?
  • When is the access happening?
  • Why is the access needed?
  • How is the access being requested?

Together, these questions ensure access decisions are intentional, explainable, and auditable.

How Palo Alto Networks Enables Zero Trust

Taking a broader platform approach can ensure Zero Trust principles are applied consistently, using identity and context as first-class policy inputs.

Palo Alto Networks implements Zero Trust through a set of identification and context capabilities. These capabilities enable policy enforcement based on verified context rather than implicit network assumptions.

The following capabilities act as policy inputs and enforcement mechanisms across the platform:

User-ID: maps network activity to a user identity (and group membership). It replaces source-IP trust with identity-based decisions.
App-ID: identifies applications at Layer 7. It replaces port-based policies with enforcement based on the actual application and actions within it.
Device-ID: helps distinguish managed vs unmanaged devices and provides device context for policy decisions. It is typically combined with User-ID for comprehensive decision making.
Content-ID: covers capabilities like content inspection and data controls. Zero Trust isn't only about who is connecting to what, but also what can they do and what data can they move. This is especially important for SaaS and AI-driven applications.

Policy-based decryption is another critical factor. As most traffic is encrypted, this is where threats will reside. Without visibility, policy cannot be verified or enforced consistently.

Zero Trust capabilities are operationalised through a central control plane, Strata Cloud Manager (SCM), which provides visibility, policy management, and posture validation across the platform.

Zero Trust Posture Centre in Strata Cloud Manager (SCM)

Putting this together, a Zero Trust policy in practice becomes something like:

  • Allow the right users,
  • on the right devices,
  • to access the right applications,
  • using the right methods,
  • with continuous inspection and visibility,
  • and enforce least privilege by default.

This is a meaningful shift from "Allow traffic from subnet A to subnet B on ports 443 and 22" to "Allow engineering users on compliant devices to access approved developer applications, with logging, MFA, and threat prevention enabled."

Operational Outcomes

The goal of Zero Trust isn't to make access harder - it's to make access safer, more consistent, and easier to operate at scale. Here is what good looks like:

Stronger security posture and reduced manual work: Zero Trust shifts security from one-off network design decisions to repeatable policy enforcement. Cleaner policies based on users, groups, devices, and applications scale well over time.
Smaller blast radius and reduced lateral movement: if an account or endpoint is compromised, the attacker should not automatically gain broad internal reach.
Improved visibility and faster troubleshooting: when enforcement decisions are tied to identity and application context, it becomes easier to understand why access was allowed or denied.

Read more