---
title: What is Zero Trust?
description: A zero-trust approach considers all resources as external and continuously verifies trust before granting only the required access. Need to know more?
image: https://blog.dreamfactory.com/hubfs/Imported_Blog_Media/Image23-1024x576.jpg
---

[![DreamFactory logo](https://cdn.prod.website-files.com/64ed8da8a866be7a702fbae0/68d51994d3678214b54acb60_dreamfactory-navbar-logo.svg)](https://www.dreamfactory.com/)

 Products & Services

[AI Data Gateway](https://www.dreamfactory.com/ai-data-gateway/overview)

[Overview Why DreamFactory exists](https://www.dreamfactory.com/ai-data-gateway/overview) [Data Gov, Comp, Security Policy enforcement at the API layer](https://www.dreamfactory.com/ai-data-gateway/ai-data-governance) [Standard API Layer One contract for every backend](https://www.dreamfactory.com/ai-data-gateway/standard-api-layer) [API Gateway Functionality Routing, auth, rate limits, observability](https://www.dreamfactory.com/ai-data-gateway/api-gateway-functionality) [Deployment & Integration Self-hosted, cloud, hybrid](https://www.dreamfactory.com/ai-data-gateway/on-premise-deployment-and-integration) [Developer Productivity Auto-generated, never hand-coded](https://www.dreamfactory.com/ai-data-gateway/ai-development-accelerated) [AI App Architectures Patterns for RAG, agents, MCP](https://www.dreamfactory.com/ai-data-gateway/enterprise-ai-architectures)

AI Data Models

[AIOpenAI](https://www.dreamfactory.com/use-cases/openai) [GGoogle Gemini](https://www.dreamfactory.com/use-cases/google-gemini) [CAnthropic Claude](https://www.dreamfactory.com/use-cases/anthropic-claude-landing) [LMeta Llama](https://www.dreamfactory.com/use-cases/meta-llama) [MMistral AI](https://www.dreamfactory.com/use-cases/mistral) [CoCohere](https://www.dreamfactory.com/use-cases/cohere)

Services and support

[Quickstart Service Packages Expert-led Quickstarts to production](https://www.dreamfactory.com/services-and-support/quickstart-services-packages)

API Management

[Generate & Manage REST APIs From any database, in seconds](https://www.dreamfactory.com/api-management/generate-rest-apis) [Features Security, scripting, self-hosted & more](https://www.dreamfactory.com/api-management/features) [API Generation The complete guide to auto-generated APIs](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) [API Management Concepts, tools, and best practises](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools?_gl=1*jl0njh*_gcl_au*MjQzMjgwMTc3LjE3ODIzMjI3MzY)

 Use Cases

AI Use Cases

[AI Data Access Secure, governed reads for your LLMs](https://www.dreamfactory.com/use-cases/ai-data-access) [MCP Server Drop-in Model Context Protocol](https://www.dreamfactory.com/use-cases/mcp-server) [Legacy Modernization Wrap mainframes with REST](https://www.dreamfactory.com/use-cases/legacy-modernization) [Data Governance Audit every call, enforce every policy](https://www.dreamfactory.com/use-cases/data-governance)

[Customer Case Studies](https://www.dreamfactory.com/case-studies)

[Energy Modernization](https://www.dreamfactory.com/case-studies/energy-snowflake-modernization) [Government Modernization](https://www.dreamfactory.com/case-studies/government-mainframe-oracle-modernization) [Government Business Intelligence](https://www.dreamfactory.com/case-studies/government-sql-server-bi-analyst-queries) [Manufacturing Modernization](https://www.dreamfactory.com/case-studies/steel-manufacturing-sap-erp-modernization) [Financial Services Investor Portal](https://www.dreamfactory.com/case-studies/financial-services-sql-server-investor-portal) [Non-Profit Partner Data Sharing](https://www.dreamfactory.com/case-studies/non-profit-sql-server-partner-data-sharing) [Professional Services Exec Dashboards](https://www.dreamfactory.com/case-studies/professional-services-erp-dashboards) [Education HR and External Data Sharing](https://www.dreamfactory.com/case-studies/education-student-hr-sql-server-mysql-external-data-sharing)

 Industries

Industries

#### [Healthcare HIPAA-grade APIs across EHR, claims, and labs.](https://www.dreamfactory.com/use-cases/healthcare)

#### [Financial Services Portfolios, partners, and portals on one layer.](https://www.dreamfactory.com/use-cases/financial-services)

#### [Government Modernize mainframes without re-platforming.](https://www.dreamfactory.com/use-cases/government)

#### [Manufacturing SAP, MES, and shop-floor data, governed.](https://www.dreamfactory.com/use-cases/manufacturing)

#### [Spotlight How enterprises run on DreamFactory From healthcare to energy to finance — governance baked into every endpoint. Browse case studies →](https://www.dreamfactory.com/case-studies)

 Connectors

SQL Database

[SQL SQL Server](https://www.dreamfactory.com/connectors/sql-server) [OR Oracle](https://www.dreamfactory.com/connectors/oracle) [PG PostgreSQL](https://www.dreamfactory.com/connectors/postgresql) [My MySQL](https://www.dreamfactory.com/connectors/mysql)

NoSQL & Docs

[Dy DynamoDB](https://www.dreamfactory.com/connectors/dynamodb) [Do DocumentDB](https://www.dreamfactory.com/connectors/azure-documentdb) [Mo MongoDB](https://www.dreamfactory.com/connectors/mongodb) [Cb CouchDB](https://www.dreamfactory.com/connectors/couch-db)

Cloud Warehouses

[S3 S3](https://www.dreamfactory.com/connectors/amazon-s3) [Ab Azureblob](https://www.dreamfactory.com/connectors/azure-blob) [FS FTP/SFTP](https://www.dreamfactory.com/connectors/ftp-sftp) [LS Local Storage](https://www.dreamfactory.com/connectors/local-storage)

C & SaaS

[Sf Salesforce](https://www.dreamfactory.com/connectors/salesforce) [API REST / SOAP](https://www.dreamfactory.com/connectors/soap-to-rest)

[See all 30+ connectors](https://www.dreamfactory.com/connectors)

[Blog](https://blog.dreamfactory.com/)

[FREE 30 Minute Demo](https://www.dreamfactory.com/demo)

[![DreamFactory logo](https://cdn.prod.website-files.com/64ed8da8a866be7a702fbae0/68d51994d3678214b54acb60_dreamfactory-navbar-logo.svg)](https://www.dreamfactory.com/)

![hamburger](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/menu-hamburger.svg) ![close](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/close-menu.svg)

 Back to main menu

 Products & Services

 Use Cases

 Industries

 Connectors

[Blog](https://blog.dreamfactory.com/)

[FREE 30 Minute Demo](https://www.dreamfactory.com/demo)

[AI Data Gateway](https://www.dreamfactory.com/ai-data-gateway/overview)

[Overview Why DreamFactory exists](https://www.dreamfactory.com/ai-data-gateway/overview) [Data Gov, Comp, Security Policy enforcement at the API layer](https://www.dreamfactory.com/ai-data-gateway/ai-data-governance) [Standard API Layer One contract for every backend](https://www.dreamfactory.com/ai-data-gateway/standard-api-layer) [API Gateway Functionality Routing, auth, rate limits, observability](https://www.dreamfactory.com/ai-data-gateway/api-gateway-functionality) [Deployment & Integration Self-hosted, cloud, hybrid](https://www.dreamfactory.com/ai-data-gateway/on-premise-deployment-and-integration) [Developer Productivity Auto-generated, never hand-coded](https://www.dreamfactory.com/ai-data-gateway/ai-development-accelerated) [AI App Architectures Patterns for RAG, agents, MCP](https://www.dreamfactory.com/ai-data-gateway/enterprise-ai-architectures)

AI Data Models

[AIOpenAI](https://www.dreamfactory.com/use-cases/openai) [GGoogle Gemini](https://www.dreamfactory.com/use-cases/google-gemini) [CAnthropic Claude](https://www.dreamfactory.com/use-cases/anthropic-claude-landing) [LMeta Llama](https://www.dreamfactory.com/use-cases/meta-llama) [MMistral AI](https://www.dreamfactory.com/use-cases/mistral) [CoCohere](https://www.dreamfactory.com/use-cases/cohere)

Services and support

[Quickstart Service Packages Expert-led Quickstarts to production](https://www.dreamfactory.com/services-and-support/quickstart-services-packages)

AI Data Models

[Generate & Manage REST APIs From any database, in seconds](https://www.dreamfactory.com/api-management/generate-rest-apis) [Features Security, scripting, self-hosted & more](https://www.dreamfactory.com/api-management/features) [API Generation The complete guide to auto-generated APIs](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) [API Management Concepts, tools, and best practises](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools?_gl=1*jl0njh*_gcl_au*MjQzMjgwMTc3LjE3ODIzMjI3MzY)

AI Use Cases

[AI Data Access Secure, governed reads for your LLMs](https://www.dreamfactory.com/use-cases/ai-data-access) [MCP Server Drop-in Model Context Protocol](https://www.dreamfactory.com/use-cases/mcp-server) [Legacy Modernization Wrap mainframes with REST](https://www.dreamfactory.com/use-cases/legacy-modernization) [Data Governance Audit every call, enforce every policy](https://www.dreamfactory.com/use-cases/data-governance)

[Customer Case Studies](https://www.dreamfactory.com/case-studies)

[Energy Modernization](https://www.dreamfactory.com/case-studies/energy-snowflake-modernization) [Government Modernization](https://www.dreamfactory.com/case-studies/government-mainframe-oracle-modernization) [Government Business Intelligence](https://www.dreamfactory.com/case-studies/government-sql-server-bi-analyst-queries) [Manufacturing Modernization](https://www.dreamfactory.com/case-studies/steel-manufacturing-sap-erp-modernization) [Financial Services Investor Portal](https://www.dreamfactory.com/case-studies/financial-services-sql-server-investor-portal) [Non-Profit Partner Data Sharing](https://www.dreamfactory.com/case-studies/non-profit-sql-server-partner-data-sharing) [Professional Services Exec Dashboards](https://www.dreamfactory.com/case-studies/professional-services-erp-dashboards) [Education HR and External Data Sharing](https://www.dreamfactory.com/case-studies/education-student-hr-sql-server-mysql-external-data-sharing)

Industries

#### [Healthcare HIPAA-grade APIs across EHR, claims, and labs.](https://www.dreamfactory.com/use-cases/healthcare)

#### [Financial Services Portfolios, partners, and portals on one layer.](https://www.dreamfactory.com/use-cases/financial-services)

#### [Government Modernize mainframes without re-platforming.](https://www.dreamfactory.com/use-cases/government)

#### [Manufacturing SAP, MES, and shop-floor data, governed.](https://www.dreamfactory.com/use-cases/manufacturing)

SQL Database

[SQL SQL Server](https://www.dreamfactory.com/connectors/sql-server) [OR Oracle](https://www.dreamfactory.com/connectors/oracle) [PG PostgreSQL](https://www.dreamfactory.com/connectors/postgresql) [My MySQL](https://www.dreamfactory.com/connectors/mysql)

NoSQL & Docs

[Dy DynamoDB](https://www.dreamfactory.com/connectors/dynamodb) [Do DocumentDB](https://www.dreamfactory.com/connectors/azure-documentdb) [Mo MongoDB](https://www.dreamfactory.com/connectors/mongodb) [Cb CouchDB](https://www.dreamfactory.com/connectors/couch-db)

Cloud Warehouses

[S3 S3](https://www.dreamfactory.com/connectors/amazon-s3) [Ab Azureblob](https://www.dreamfactory.com/connectors/azure-blob) [FS FTP/SFTP](https://www.dreamfactory.com/connectors/ftp-sftp) [LS Local Storage](https://www.dreamfactory.com/connectors/local-storage)

C & SaaS

[Sf Salesforce](https://www.dreamfactory.com/connectors/salesforce) [API REST / SOAP](https://www.dreamfactory.com/connectors/soap-to-rest)

[See all 30+ connectors](https://www.dreamfactory.com/connectors)

[![back arrow](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/orange-arrow.svg) Blog](https://blog.dreamfactory.com/)

# What is Zero Trust?

 by Spencer Nguyen

![calendar icon](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/calendar-icon.svg) January 2, 2026

Table of contents

RECOMMENDED ARTICLES

- [A Complete Guide to API Generation](https://blog.dreamfactory.com/a-complete-guide-to-api-generation)
- [10 Best API Management Tools](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools)
- [Creating a Microsoft SQL Server API in Less Than 5 minutes with DreamFactory](https://blog.dreamfactory.com/creating-a-microsoft-sql-server-api-in-less-than-5-minutes-with-dreamfactory)
- [Hasura vs. DreamFactory: A Comprehensive Comparison](https://blog.dreamfactory.com/hasura-vs-dreamfactory)
- [Build A Snowflake REST API in Less Than 5 Minutes](https://blog.dreamfactory.com/generate-a-snowflake-rest-api-in-less-than-5-minutes)

![Locks representing zero trust](https://blog.dreamfactory.com/hs-fs/hubfs/Imported_Blog_Media/Image23-1024x576.jpg?width=1200&height=675&name=Image23-1024x576.jpg)

Traditional security systems rely on a castle and moat style approach wherein the objective is to protect the perimeter and assumes that anyone inside the network is safe and trustworthy. However, the modern enterprise computing environment has become incompatible with this approach, bringing about the emergence of the ‘zero-trust’ concept. Disruptive technologies and accompanying behaviors such as BYOD’s (bring your device), IoT, and cloud adoption have made attack surfaces and perimeters porous and diffuse making IT infrastructure increasingly difficult for security teams to safeguard.

Did you know you can generate a full-featured, documented, and secure REST API in minutes using DreamFactory? Sign up for our **free 14 day hosted trial** to learn how! Our guided tour will show you how to create an API using an example MySQL database provided to you as part of the trial!

[Start Securing Your APIs Now](https://genie.dreamfactory.com/register?utm_source=blog&utm_medium=What%20is%20Zero%20Trust?=blog)

Under a [zero-trust approach](http://www.virtualstarmedia.com/downloads/Forrester_zero_trust_DNA.pdf) framework, all resources are considered external and continuously verified before being granted only the required access based on granular access control lists and rules. This approach implements a “software-defined perimeter,” which facilitates privileged access to human and non-human identities within [IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) (Identity and Access Management) based controls.

## Zero Trust Principles

It is fundamental that an organisation authenticates and verifies user access for all resources. Every time a user accesses an application, file, or cloud device, that user should be required to authenticate. In this way, it is assumed that every access attempt is a threat to the system and must be categorized and handled as a threat until authenticated as a friendly. Multifactor authentication (MFA) is an excellent way to establish a user’s identity. It relies on at least two pieces of evidence to assess the user’s credibility. These can include security questions, geolocation, Time of Request monitoring, biometrics, SMS messaging, tokens, email/text confirmation, or logic-based exercises. Generally, increasing the number of authentication factors will inherently strengthen the network security.

Attacks are further mitigated through least-privilege access, meaning that the organization grants the lowest access possible to each user or device. Identities are given the least amount of entitlements to perform their ongoing responsibilities which also prevents entities from granting or configuring new permissions. This in turn reduces the likelihood of attackers escalating privileges to more flexible roles.

Micro-segmentation allows for the logical division of a data center into distinct security segments down to the individual workload level. Software-defined micro-segmentation provides an ability to define granular segmentation at the host level. The ability to control workloads in a multi-cloud environment with granular policy controls restricts the spread of lateral threats when breaches occur. Traditionally, network firewalls would be deployed with access lists carrying out segmentation with static IPs and subnets. However, allowing the implementation of strong security controls with infrastructure as code makes the entire process more transparent, responsive, and robust.

Finally, a suite of logging, monitoring and analytics functions enhances an organization's enterprise security. Logging mechanisms enable an organization to continuously examine internal and external logs while monitoring allows teams to detect anomalies and bad actors within the system. In combination with logging and monitoring, security analytics assists in detecting compromised logins, ransomware attacks, or malicious actors uploading files to cloud systems.

## Why Zero Trust?

Streamlined security. Implementing a security mechanism is often associated with increased cost and difficulty. This approach allows a business to achieve multiple security controls over a network while reducing capital expenditure and operating expenses. Security management is streamlined as the number of management consoles needed is reduced. Furthermore, organizations do not need to install a complex stack of equipment to secure each data center – a single cloud service can secure all of their applications, data, users, and devices.

Compliance. As zero trust systems are segmented by design, it reduces the need for time-consuming manual audits. Auditors can achieve clearer insight into what data flows the organization has and can see how workloads are protected. These systems are inherently transparent and reduce the number of ways bad actors can exploit network communications. Ultimately, this results in fewer negative audit findings and more straightforward remediation. ‍Furthermore, segmentation allows organizations to create perimeters around certain types of data (e.g., PCI or credit card data, data backups, medical, legal, etc.) using refined controls that keep regulated data isolated siloed away from non-regulated data sources.

Reducing the risk of a breach. As the zero trust model focuses on system workload considerations, workloads with unverified workloads are prevented from communicating with anything else on the system until authenticated and verified. If a service behaves unusually or attempts a malicious activity, it will automatically be untrusted and essentially left in isolation. The service will therefore will be unable to communicate until it’s access control policies have been reset and verified. As the zero trust model requires constant authentication and re-authentication, an Edward Snowden style scenario is less likely to occur, enabling organisations to better mitigate risk.

Infrastructure awareness. In order to implement an effective zero-trust architecture, operations and security teams must have an effective relationship with the underlying systems. Zero trust forces an organization to implement security best practices whilst enabling a more effective IT operation cycle. Traditionally, friction has existed between rapid deployment and ensuring security protocols are observed. This method allows security to envelop applications in protection and assign them a unique fingerprint. As long as that fingerprint remains the same or matches an already-verified application, it can communicate freely. The application therefore develops and grows without imposing unnecessary constraints whilst also ensuring adequate security protocols.

Did you know you can generate a full-featured, documented, and secure REST API in minutes using DreamFactory? Sign up for our **free 14 day hosted trial** to learn how! Our guided tour will show you how to create an API using an example MySQL database provided to you as part of the trial!

[Start Securing Your APIs Now](https://genie.dreamfactory.com/register?utm_source=blog&utm_medium=What%20is%20Zero%20Trust?=blog)

## Zero Trust with DreamFactory

There is no panacea or one tool for implementing a zero-trust architecture. However, a journey of a thousand miles starts with a single step. Overcoming inertia is always the most challenging part, and implementing one piece of the puzzle will give you instant momentum to start building your zero trust architecture.

[DreamFactory](https://www.dreamfactory.com/) helps bring improved security with a minimum of time and effort on the part of your business. We offer instant API creation backed by comprehensive security features such as Role Based Access Control (RBAC) and authentication integration. From simple API generation to logging and scripting, DreamFactory is the ultimate REST API management platform. [Integrate](https://www.dreamfactory.com/hub/categories/all/) DreamFactory into your business by starting your [free trial](https://genie.dreamfactory.com/register) today!

Related reading:

[Securing the Mobile Enterprise](https://blog.dreamfactory.com/securing-the-mobile-enterprise/)

TAGS: [Zero Trust](https://blog.dreamfactory.com/tag/zero-trust)

![Spencer Nguyen](https://blog.dreamfactory.com/hs-fs/hubfs/d0352ad8ab4e13aed9bf6eb0839b43c5.png?width=100&height=100&name=d0352ad8ab4e13aed9bf6eb0839b43c5.png)

Spencer Nguyen

As a seasoned content moderator with a keen eye for detail and a passion for upholding the highest standards of quality and integrity in all of their work, Spencer Nguyen brings a professional yet empathetic approach to every task.

 Stay Connected with   
 The Connector Newsletter!

 Subscribe to stay up-to-date with DreamFactory's latest product updates, API best practices, and tech humor in your inbox.

[![Dreamfactory Logo](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/Megamenu-logo.svg)](https://www.dreamfactory.com/)

[Call Sales +1 (415) 993-5877](tel:+14159935877)

Open – Mon–Fri 9–5 PT

[FREE 30 Minute Demo](https://www.dreamfactory.com/demo)

#### Follow us

- [GitHub](https://github.com/dreamfactorysoftware/dreamfactory)
- [Facebook](https://www.facebook.com/dfsoftwareinc/)
- [X (Twitter)](https://twitter.com/dfsoftwareinc)
- [LinkedIn](https://www.linkedin.com/company/dreamfactory-software)
- [YouTube](https://www.youtube.com/c/dreamfactorysoftware)

### Features

[Features](https://www.dreamfactory.com/features) [Self hosted](https://www.dreamfactory.com/features#self) [API Generation](https://www.dreamfactory.com/features#api) [Security](https://www.dreamfactory.com/features#secure) [Customization](https://www.dreamfactory.com/features#custom) [Pricing](https://www.dreamfactory.com/pricing)

### Installers

[Linux](https://www.dreamfactory.com/features#installer) [Docker](https://www.dreamfactory.com/features#installer) [Kubernetes](https://www.dreamfactory.com/features#installer)

### API Resources

[Documentation](https://docs.dreamfactory.com/) [Case Studies](https://www.dreamfactory.com/stories) [White Papers](https://www.dreamfactory.com/resources/whitepapers) [Academy](https://www.dreamfactory.com/academy) [API Calculator](https://calculator.dreamfactory.com) [Open Source](https://github.com/dreamfactorysoftware)

### Company

[Blog](https://blog.dreamfactory.com/) [Hub](https://www.dreamfactory.com/hub) [About us](https://www.dreamfactory.com/about) [Partners](https://www.dreamfactory.com/partners) [Support](https://www.dreamfactory.com/support) [Connectors](https://www.dreamfactory.com/connectors) [Contact Us](https://www.dreamfactory.com/demo)

 © 2025 DreamFactory. All rights reserved.

[Terms of Use](https://www.dreamfactory.com/terms-of-use) [Privacy Policy](https://www.dreamfactory.com/privacy-policy) [LLMs](https://www.dreamfactory.com/llms.txt)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Spencer Nguyen",
    "url" : "https://blog.dreamfactory.com/author/spencernguyen"
  },
  "dateModified" : "2024-05-07T08:19:39.431Z",
  "datePublished" : "2026-01-03T00:00:00.000Z",
  "headline" : "What is Zero Trust?",
  "image" : [ "https://blog.dreamfactory.com/hubfs/Imported_Blog_Media/Image23-1024x576.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.dreamfactory.com/what-is-zero-trust",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.dreamfactory.com/hubfs/DreamFactory%20-%20Orange%20-%20Transparent-1.png"
    }
  }
}
```