## Zero Trust Principles

"Never Trust. Always Verify."

### The Old Model: Castle and Moat
*   Hard shell (Firewall). Soft gooey center (Internal Network).
*   If you VPN in, you are "Trusted". You can access everything.

### The Zero Trust Model
*   Assume the network is **Hostile**.
*   Assume the attacker is **already inside**.
*   Therefore: Verify *every single request*.
    1.  **Identity**: Who are you? (MFA).
    2.  **Device**: Is your laptop patched? (Health).
    3.  **Context**: Are you in a weird location?
    4.  **Resource**: Do you need access to *this specific* file?

### Pillars of Zero Trust (CISA)
1.  **Identity**: Users.
2.  **Devices**: Endpoints.
3.  **Network**: Segmentation.
4.  **Applications**: Workloads.
5.  **Data**: Encryption/Tagging.