Zero trust (ZT) is a set of ideas to move defenses from static, network-based perimeters to focus on users, assets, and resources. It allows us to focus is on protecting resources and applications, not network segments (which are inherently insecure).

ZT assumes there is no implicit trust granted to assets or user accounts solely on their physical or network location or asset ownership. Authentication and authorization need to be performed before a session to an enterprise resource is established.

OpenZiti provides anyone the tools to embed zero trust mesh networking into their solution or application. It allows you to close all inbound ports on your firewall (one inbound firewall rule of deny-all), making your network unreachable from other networks, at layer 3. Your private OpenZiti Fabric allows your apps and users to outbound connect both 'sides' of the app, e.g. a client and server, into one bidirectional session, regardless of which side initiated the specific connection request.

I like the way metadat put it: "a Raw Sewage network". Zero trust is the idea that all networks are hostile and you shouldn't trust any of them.

Worst case scenario, when you attach to an unknown network (public WiFi) without knowing what other devices are on that network, they might be hostile and attempt to attack/compromise the machine that just joined the network.

Sometimes it's not active. Other compromised machines might do the same even on a trusted network like the corporate LAN or just your friend's house WiFi.

So zero trust encourages you to trust no network, open no hole in your firewall, allow no inbound connections. Any connections that are established need to be verified first before allowing the connection.