Zero trust shifts security from networks to resources
NIST’s zero-trust model evaluates access to resources without relying on network location, while a maturity roadmap cannot prove operational security.
Zero trust changes the question a security system asks. Instead of assuming that a user or device is safe because it is inside an organization’s network, the approach focuses on whether a particular request should receive access to a particular resource.
The National Institute of Standards and Technology’s August 2020 publication, Special Publication 800-207, describes zero trust as a shift away from static network perimeters toward users, assets and resources. Physical location, network location and ownership alone do not establish implicit trust.
That definition matters for government and defense-related reporting. A network described as internal is not automatically secure, while a remote user is not automatically illegitimate. The relevant question is how identity, device information and access decisions are evaluated within the architecture.
Protect resources, not a label
NIST distinguishes authentication from authorization. Establishing an identity and deciding what that identity may access are discrete functions performed before a session to an enterprise resource is established. Confusing the two can make a successful login sound like permission to reach every system.
The guidance responds to environments with remote users, personally owned devices and cloud assets outside an organization’s traditional boundary. It focuses on protecting resources such as services, workflows and accounts, rather than treating a network segment as the primary security unit.
This is an architectural approach, not evidence that a particular product prevents every intrusion. A vendor’s use of the phrase “zero trust” does not establish what controls were deployed, how access is governed or whether implementation has been tested. Those claims require evidence specific to the system involved.
The Cybersecurity and Infrastructure Security Agency’s archived Zero Trust Maturity Model describes a roadmap for agencies developing strategies and implementation plans. Its Version 2.0 presents stages of maturity, not a single switch that instantly converts an organization into a fully protected environment.
A roadmap is not proof of an outcome
CISA’s page explicitly warns that archived material may not reflect current policy or programs. Its description remains useful for explaining the model’s concepts, but it should not be used to announce a current agency deadline or certify compliance in 2026.
The model’s emphasis on least-privilege, per-request access also helps distinguish architecture from incident attribution. Discovering that an organization uses zero-trust principles does not establish who attacked it, what an intruder accessed or whether a particular incident was contained.
Analysis: a useful implementation report identifies the protected resources, the access decision being changed and the evidence used to evaluate the result. An organization might strengthen identity checks while still needing improvements in device visibility or data access. A broad maturity label can conceal those differences if the report does not describe its scope.
This is particularly important in discussions of cyber warfare. Defensive controls can reduce exposure, but they are not an offensive capability or proof that an adversary’s operation failed. Claims about attack effects require separate incident evidence. Architecture describes the intended security model; operational reporting describes what happened in a particular case.
The practical lesson is to ask what “zero trust” means in the document being cited. NIST supplies a definition and deployment framework. CISA offers a maturity roadmap. Neither substitutes for a documented assessment of a real organization’s controls, vulnerabilities or response to a real intrusion.
Follow cyber warfare coverage and Intelligence and OSINT for related reporting.
Sources
Additional sources
Photograph and licensing record. Photo: U.S. Navy photo by Petty Officer 1st Class Daniel James Lanari. Public domain; via Wikimedia Commons. Cropped to 16:9.
Related coverage
- Cyber Security and Resilience Bill Passes the Lords
- What Open-Source Intelligence Means for US Agencies
