What it means
Trust in cybersecurity is not a permanent feeling; it is a scoped decision with consequences. A system may trust an identity to read one data set, a device to connect for one session, or a supplier to sign one class of software. The decision should be explicit about subject, resource, action, context, and duration.
How it works
Trust decisions draw on identity assurance, device posture, authorization policy, cryptographic evidence, risk, behavior, location, business relationship, and current threat information. Zero Trust architecture emphasizes evaluating access continuously and limiting the reach of any granted trust.
A managed laptop with a valid certificate may be trusted to request access, but the user must still authenticate, the application must authorize the action, and high-risk behavior may trigger another check or session termination.
Practical focus
- Define exactly what is trusted, for which action, and for how long
- Use multiple relevant signals for high-consequence access
- Reevaluate trust when context, privileges, or risk changes
- Limit blast radius when a trusted component is compromised
Common mistakes
- Treating an internal network location as universal trust
- Confusing authentication with authorization
- Allowing inherited or transitive trust to expand unnoticed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: