Traditional network security operated on a "castle and moat" model: trust everything inside the perimeter, block everything outside. Zero trust replaces this with three principles: verify explicitly (always authenticate and authorize every request), use least privilege access (grant only the access needed for the specific task), and assume breach (design systems as if an attacker is already inside).
Applied personally, zero trust means: verify unusual requests before acting on them, even from familiar contacts (their accounts can be compromised). Limit the access you grant to apps — not every app needs all permissions it requests. Assume that any of your accounts could be compromised and plan accordingly by using unique passwords and 2FA everywhere.
The zero-trust mindset makes you appropriately skeptical without being paranoid. It replaces "I trust this because it comes from someone I know" with "I trust this because I have verified it through an independent channel." The email from your CEO asking for an urgent wire transfer deserves a phone call, not immediate action.
This mindset is the mental counterpart to all the specific defenses in this course. Strong passwords, 2FA, updates, and backups are implementations of zero-trust principles applied to specific contexts. The underlying principle — verify before trusting, minimize access, plan for breach — applies everywhere.