Zero Trust Architecture Explained: Never Trust, Always Verify

For decades security worked like a castle: a hard perimeter — firewalls and a VPN — around a soft, trusted interior. Get inside and you were largely free to move. Cloud, remote work and a decade of breaches broke that model: there is no longer a clean inside, attackers who get a foothold move sideways with ease, and the most damaging incidents come from trusted-looking access. Zero trust architecture is the response — a security model that stops trusting the network and starts verifying every request on its own merits.

This article sits under Cybersecurity Basics and is the architecture companion to identity and access management: IAM is the engine, and zero trust is what you build with it.

What zero trust architecture is

Zero trust is not a product — it is a set of principles for designing an environment where no request is trusted because of where it comes from. Being on the office network, or connected through the VPN, earns you nothing. Instead, every access decision is made fresh from the identity of the caller, the posture of their device, and the sensitivity of what they are reaching, and access is granted for that session only. The guiding assumption is "assume breach": design as though an attacker is already inside, so that a single compromised account or laptop cannot open the whole estate.

Not the same as zero trust provisioning

The tenets (NIST SP 800-207)

The canonical reference is NIST Special Publication 800-207, published in August 2020, which turned "zero trust" from a slogan into an architecture.^[1] Its tenets, in plain terms:

• Treat every data source and computing service as a resource to be protected in its own right.
• Secure all communication regardless of network location — being "internal" grants no trust.
• Grant access per session, on least privilege, and only for as long as it is needed.
• Decide access with dynamic policy — identity, device posture, behaviour and context, evaluated at request time.
• Continuously monitor the integrity and security posture of every asset; nothing is trusted permanently.
• Enforce strong authentication and authorization before any access, for all identities — human and machine alike.
• Collect telemetry on the estate and use it to keep improving the policies that govern access.

How a zero trust decision is made

NIST describes the decision machinery as three logical parts, and understanding them demystifies most vendor pitches:

• Policy Engine (PE) — the brain. It makes the grant-or-deny decision for each request, drawing on identity, device compliance, threat intelligence and behaviour.
• Policy Administrator (PA) — the hands. It carries out the PE's decision by establishing or tearing down the connection between the caller and the resource.
• Policy Enforcement Point (PEP) — the gate. It sits directly between the subject and the resource, and enables, monitors and terminates the connection on the PA's instruction.

The important word is continuous: this loop does not run once at login and then trust you for the day. It re-evaluates as context changes, so a device that falls out of compliance, or behaviour that suddenly looks wrong, can lose access mid-session.

The building blocks

Zero trust is assembled from capabilities you may already own, wired together around identity:

• Strong IAM — MFA, single sign-on and least privilege. This is the foundation; see identity and access management.
• Microsegmentation — dividing the network into small zones so a breach in one cannot spread laterally to the rest.
• ZTNA (zero trust network access) — identity- and device-aware access to individual applications, replacing the broad network access a VPN grants.
• Device posture — checking that the endpoint is patched, encrypted and healthy before it is allowed in.
• Continuous verification and telemetry — logging and analytics feeding the policy engine so decisions improve over time.

When ZTNA is delivered together with the network layer as a cloud service, the packaging is usually called SASE — the most common way mid-sized organisations adopt zero trust without building it themselves.

ZTNA vs the VPN

The clearest way to see zero trust in practice is the shift from the VPN to ZTNA — the change most organisations feel first:

Zero trust in Singapore

Singapore is not just adopting zero trust — its government has published its own architecture for it. The Government Zero Trust Architecture (GovZTA), developed by GovTech and being evaluated for adoption across the public sector, assumes no user, application or device is trusted and requires constant verification.^[2] It is governed by four principles — apply least privilege and enforce access control, limit lateral movement, integrate security automation and orchestration, and enhance detection and response — and built on an implementation framework of five technical pillars (identity, devices, networks, applications and data) plus two enablers (visibility and automation, and governance). It is a useful, publicly documented reference model for any Singapore organisation planning its own programme.

For regulated firms, the direction is reinforced by the regulators. The Monetary Authority of Singapore's Technology Risk Management Guidelines point institutions towards zero-trust principles where appropriate,^[3] and CSA's Cyber Trust mark — recently expanded to cover cloud, AI and operational technology — sets access-control expectations that a zero-trust design satisfies naturally.

How to start

Zero trust is a journey, not a switch you flip, and the fastest way to stall is to try to boil the ocean. A workable order:

1. Fix identity first. MFA everywhere, SSO, and least privilege — the single highest-leverage step. Nothing else in zero trust works without it.
2. Inventory and classify. Know your users, devices, applications and — above all — your data, so you can decide what deserves the tightest control.
3. Put ZTNA in front of one high-value application. Prove the pattern on something that matters before rolling it out; retire the broad VPN access to it.
4. Microsegment to stop lateral movement between systems that never need to talk to each other.
5. Add device posture so unhealthy endpoints are refused, not merely logged.
6. Measure and expand. Feed telemetry back into policy and extend the model pillar by pillar.

Planning a zero trust programme?

Zero trust is an architecture, not a purchase — the design and integration decide whether it works. Compare Singapore cybersecurity providers and integrators who deliver ZTNA, microsegmentation and identity.

Browse Cybersecurity Providers in Singapore

Frequently asked questions

Sources

1. NIST SP 800-207: Zero Trust Architecture — National Institute of Standards and Technology — NIST official checked 2026-09-01
2. Government Zero Trust Architecture (GovZTA) — Singapore Government Developer Portal (GovTech) — GovTech official checked 2026-09-01
3. Technology Risk Management Guidelines — Monetary Authority of Singapore — MAS official checked 2026-09-01