Zero-Trust Security Architecture for Cloud Computing and Enterprise IT Systems: Principles, Design, and Implementation Challenges

The castle-and-moat security model that has long been the backbone of enterprise security has been undermined with enterprise workloads moving to public, private and hybrid cloud. To meet this change, there is a new way to securely and reliably manage access to resources: zero-trust architecture (ZTA), which assumes that every access request is a potential threat and continuously verifies identity, device posture and contextual risk before allowing least privilege access to resources on a session-by-session basis. This article reviews the literature on zero-trust security for cloud computing and enterprise information technology (IT) environments and synthesizes the information into an integrative literature review and architecture synthesis. The article follows a structured narrative-synthesis approach and is based on the National Institute of Standards and Technology (NIST) SP 800-207 model and 21 peer-reviewed and standards-based sources, which are used to build a logical zero-trust architecture, a blueprint for a multi-cloud deployment, and a zero-trust versus perimeter-based security comparison across key operational metrics. Challenges to adoption, such as legacy-system integration, policy complexity and organisational readiness are discussed and directions for future research, in particular integration of AI in continuous risk scoring are outlined. The results show that while the adoption of a zero-trust approach requires significant architectural and cultural adjustments, it has significant results in reducing the lateral movement, exposure to insider threats and impact of a breach when compared to traditional perimeter defenses.