Definition

Zero Trust is a security architecture that eliminates the concept of a trusted internal network. Every user, device, and application is treated as potentially hostile until explicitly authenticated and authorized for the specific resource being accessed. The model replaces traditional perimeter-based security (firewalls + VPN as the trust boundary) with identity-driven, application-level controls. Implementing Zero Trust typically requires four building blocks: strong identity (MFA + IdP), device posture verification, application-level access (ZTNA replacing VPN), and continuous policy evaluation (microsegmentation, behavioral analytics). Symantec implements Zero Trust through its ZTNA platform, CloudSOC CASB, and Cloud SWG - collectively replacing the perimeter model with identity-and-context-driven access. The 2020 NIST SP 800-207 specification is the canonical Zero Trust reference.

Symantec products that implement this

  • Symantec ZTNA (Zero Trust Network Access) - Identity-and-application-aware Zero Trust access to internal apps. Replace VPN with per-app policy enforcement, posture checks, and least-privilege access for hybrid work.
  • Symantec CASB (CloudSOC) - Cloud Access Security Broker for SaaS - visibility into shadow IT, inline enforcement on sanctioned apps, API-based scanning for data at rest, and user behavior analytics.
  • Symantec Cloud Secure Web Gateway - Cloud-delivered web security with SSL inspection, URL filtering, sandboxing, content disarm, and CASB integration. The cloud successor to the ProxySG appliance.

Related terms

Deep-dives on Zero Trust