In short
A zero trust network is one where connecting to the network grants no access by itself. Every connection to an application is authenticated, authorised and encrypted, and the network is split into segments so one compromised device cannot reach the rest. For a UK business that means ZTNA, segmentation, network access control and filtering working together.
Get a quote for zero trust networking
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What is a zero trust network?
The NCSC's seventh design principle is don't trust any network, including your own (opens in a new tab). Don't trust any network between the device and the service it is reaching, including the local network; use a secure transport such as TLS; and configure devices to resist attacks on the local network, such as DNS spoofing, man-in-the-middle attacks and unsolicited inbound connections. NIST SP 800-207 says the same in its second tenet: all communication is secured regardless of network location, and network location alone does not imply trust.
So zero trust networking is less about one new box and more about changing what the network is for. It still carries traffic and still needs good hygiene; the NCSC is clear that monitoring for unauthorised hosts and patching network kit still matter. What it stops doing is deciding who may reach which application.
Flat network vs zero trust network
This comparison works as a diagram of the two designs: on the left, one large trusted zone; on the right, small zones with a decision in front of every application.
| Flat network | Zero trust network | |
|---|---|---|
| Layout | One large LAN; users, servers, printers and cameras can all reach each other | Segments by function and criticality; traffic between them blocked unless allowed |
| User access to apps | Anyone on the LAN or VPN can reach internal servers | Users reach each application through ZTNA or SSO, after identity and device checks |
| Devices joining the network | Any device that plugs in gets an address and access | Network access control decides which segment a device joins, or keeps it out |
| Admin protocols (RDP, SSH, SMB) | Open between machines | Restricted, with just-in-time MFA for admins |
| After a compromise | Malware can scan and spread | The device is confined to its segment and its permitted applications |
| Internet and DNS | Filtered at the edge, if at all | Filtered on the device or in the cloud, wherever the user is |
NIST's assumptions for a zero trust view of a network (section 2.2) underline the right-hand column: the private network is not an implicit trust zone, devices on it may not be owned or managed by you, and no resource is inherently trusted.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
The building blocks of zero trust networking
No single product delivers a zero trust network. These are the pieces, and where each is covered:
| Building block | What it does | More detail |
|---|---|---|
| ZTNA | Per-application access for remote and office users; applications sit behind outbound connectors with no inbound ports | ZTNA vs VPN, how ZTNA works |
| Microsegmentation | Limits which machines can talk to which, so attacks cannot move sideways | Microsegmentation vs network segmentation |
| Network access control (NAC) | Checks devices as they join the wired or wireless LAN and places them in the right segment | ZTNA vs NAC; Cisco ISE (opens in a new tab) |
| Firewalls between segments | Enforce the rules between zones, and protect internet-facing services | Networking hardware (opens in a new tab) |
| DNS and web filtering | Blocks malicious domains on the device or in the cloud, since traffic no longer always passes a central gateway | DNS security (opens in a new tab) |
| Central logging | Collects access decisions and network events from every component | NCSC ZTNA guidance |
The NCSC notes that when traffic is no longer tunnelled to a central point, browsing protection has to move onto the device or into a managed cloud service. That is why DNS filtering (opens in a new tab) and device security are part of zero trust network security, not separate projects.
Office, Wi-Fi and guest networks under zero trust
Most of the practical decisions are about the networks you already have:
- Office LAN: treat it like the internet. Staff in the office reach applications through the same ZTNA or SSO policy as remote staff, so there is one rule set to maintain. Cisco calls this universal ZTNA; see Cisco universal ZTNA.
- Staff Wi-Fi: authenticate devices with certificates or NAC and put them in a user segment that can reach the internet and the ZTNA service, not the server segment.
- Guest and contractor Wi-Fi: internet only, fully separate. Contractors who need an application get it through browser-based agentless ZTNA, not a network connection.
- Printers, cameras and building systems: their own segments, reachable only by the systems that manage them.
- Servers and admin access: segment by criticality and require just-in-time MFA for admin protocols. Zero Networks describes this for RDP, SMB, SSH, WinRM and RPC on its own site (opens in a new tab).
New switches, access points and firewalls for the design are covered under the networking hardware row above, and Cisco Meraki (opens in a new tab) cloud-managed networking is on cloudnetworking.uk.
Is zero trust networking the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Zero trust network vs zero trust network access
The names are close but the scope differs. A zero trust network is the whole network design: segments, device admission, filtering and encrypted, authorised access everywhere. Zero trust network access (ZTNA) is the product category that handles user-to-application access within it. Most businesses start with ZTNA because it replaces the VPN and gives quick results, then work outwards into segmentation and NAC.
A "zero trust firewall" is not a separate category in NIST or NCSC guidance. In practice it means a firewall used as a policy enforcement point: segmenting the network, applying identity-aware rules and, in some products, enforcing ZTNA policy for on-site users. NIST lists next-generation firewalls as one way to implement micro-segmentation.
How we help design a zero trust network
We can review your current network layout, VPN and Wi-Fi set-up, then suggest a zero trust network design and the products that fit it, from ZTNA platforms to segmentation and networking hardware. Forever Systems, a Cisco Partner and Check Point Advanced Partner, supplies several of the platforms involved. Contact us for free advice or a quote.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is a zero trust network?
It is a network where being connected grants no access by itself. Every connection to an application is authenticated, authorised and encrypted, devices are checked as they join, and segments stop a compromised device from reaching the rest. The NCSC sums it up as 'don't trust any network, including your own'.
Do I still need a firewall in a zero trust network?
Yes, in most cases. Firewalls separate segments, protect internet-facing services and can act as enforcement points. What changes is that the edge firewall and VPN no longer decide who can reach internal applications; ZTNA and identity policy do.
Can a small office build a zero trust network?
Yes. A small office can start with MFA, managed devices, ZTNA for applications, a separate guest Wi-Fi and DNS filtering. Segmentation and network access control can follow as switches and access points are replaced.
Is zero trust networking the same as ZTNA?
No. Zero trust networking is the whole network design. ZTNA is one part of it, controlling how users reach applications. Segmentation, network access control, filtering and logging make up the rest.
Does zero trust mean I can remove my VPN?
Often, but not as a goal in itself. The NCSC says zero trust and a VPN are not mutually exclusive: review what your VPN provides, replace those controls, and remove it only then. See VPN replacement.
Still have a question about zero trust networking?
Ask us and a member of our team will get back to you.