Architecture BE NL Zero Trust : Au-delà du mot à la mode

Zero trust has become one of the most discussed concepts in cybersecurity, but many organizations struggle to move from theory to practice. This article provides a pragmatic guide to implementing zero trust architecture in complex enterprise environments.

The traditional security model — a fortified perimeter protecting a trusted internal network — was designed for a world where employees worked in offices and applications ran in on-premises data centers. That world no longer exists. With hybrid work, cloud adoption, and SaaS proliferation, the perimeter has dissolved, and implicit trust has become a critical vulnerability.

The Core Principles
At its heart, zero trust is simple: never trust, always verify. Every access request — whether from inside or outside the network — must be authenticated, authorized, and continuously validated. This contrasts with traditional perimeter-based security that implicitly trusts traffic within the corporate network.

The NIST SP 800-207 framework defines three core tenets of zero trust:

Continuous verification: Authentication and authorization are not one-time events but ongoing processes that evaluate risk signals in real-time
Least privilege access: Users and systems receive only the minimum permissions needed for their current task, and those permissions are dynamically adjusted
Assume breach: Design systems as if adversaries are already inside the network, limiting blast radius through micro-segmentation
The Five Pillars of Implementation
A comprehensive zero trust architecture spans five interconnected pillars:

Identity: Multi-factor authentication, conditional access policies, and continuous identity verification using behavioral analytics
Devices: Device health assessment, compliance checking, and endpoint detection and response (EDR) — ensuring only secure devices can access resources
Network: Micro-segmentation, encrypted communications, and software-defined perimeters that replace traditional VPNs
Applications: Application-level access controls, API security, and runtime protection against exploitation
Data: Classification, encryption, data loss prevention (DLP), and rights management that follow data wherever it moves
Implementation Roadmap
Successful zero trust implementation follows a phased approach. Start with identity and access management, then extend to network segmentation, application-level controls, and finally data-centric security. Each phase builds on the previous one, gradually eliminating implicit trust from your environment.

Phase 1 (months 1-3): Deploy MFA across all users and enforce conditional access policies based on device health, location, and risk signals. This alone eliminates 99.9% of credential-based attacks.

Phase 2 (months 3-9): Implement network micro-segmentation to isolate critical workloads and limit lateral movement. Replace traditional VPNs with zero trust network access (ZTNA) solutions.

Phase 3 (months 9-18): Extend zero trust to application and data layers with API security gateways, runtime application self-protection (RASP), and automated data classification and encryption.

Lessons from the Field
For public sector and defense organizations, zero trust is particularly critical given the sensitivity of the data they handle and the sophistication of the threats they face. Atos's managed security services provide comprehensive zero trust implementation support, with dedicated security architects guiding organizations through each phase.

Common pitfalls include trying to implement everything at once, neglecting user experience (leading to shadow IT), and failing to involve business stakeholders in policy design. The most successful implementations balance security rigor with usability, ensuring that zero trust enhances rather than hinders productivity.

The Journey Continues
The key takeaway: zero trust is a journey, not a destination. Start with quick wins in identity management and work systematically toward comprehensive zero trust across your enterprise. The threat landscape will continue evolving, and your zero trust architecture must evolve with it — continuously adapting to new risks, technologies, and business requirements.