Zero Trust in Practice: Identity, Part 1 — Building the Identity Foundation

Why “never trust, always verify” starts with your collaboration platform

This is the first part in a three-part series on moving from Foundation to Advanced Zero Trust for the identity pillar. Each post maps to a maturity stage in the CISA Zero Trust Maturity Model and shows how Mattermost supports the journey.

For decades, enterprise security was built on a simple premise: keep the bad guys out, and trust everyone inside. Firewalls defined the boundary, and VPNs extended it. Everything inside the walls was, more or less, trusted.

That model is functionally dead.

The combination of hybrid work, cloud infrastructure, workstation attacks, and increasingly sophisticated supply chain attacks has dissolved the perimeter. The 2020 SolarWinds compromise, where trusted software updates became the attack vector, made this crystal clear: perimeter trust is a liability masquerading as a security posture.

Zero Trust replaces that assumption with a simple principle: never trust, always verify. Every user, device, and request is verified continuously, not just at the front door.

For organizations aligned to the DoD Zero Trust Strategy or the CISA Zero Trust Maturity Model, this is a mandate. For NATO and EU-aligned organizations, the equivalent framework is ACP 240, which establishes similar requirements for information security across Allied communications and information systems. 

Regardless of which framework governs your environment, the foundational moves are largely the same. This post covers the Traditional and Initial (together, Foundation) maturity stages: the baseline controls that establish Zero Trust hygiene before you can build anything more sophisticated on top.

Why your collaboration platform is a Zero Trust problem

Security teams often think about Zero Trust in terms of network access, identity providers, and endpoint management. Collaboration tools get treated as a productivity concern instead of a security concern.

That’s backwards.

Your collaboration platform is where sensitive operational decisions are made, where classified adjacents get shared, and where incident response happens in real time. If it’s running on implicit trust, and anyone inside the network perimeter can see anything, then it’s a vulnerability.

Data-centric security reframes this. Instead of protecting the network boundary, you protect the data itself and everywhere it lives and moves. 

For collaboration, that means controlling who can see which channels, which messages, which files, and continuously verifying they still should. The DoD ZT Pillars place Data at the center precisely because everything else — Users, Devices, Networks, and Workloads — exists in service of protecting it.

Mattermost is designed from the ground up for this model. Rather than bolting security controls onto a consumer-grade chat platform, it implements Zero Trust as a continuous enforcement model across identity, devices, networks, applications, and data.

Foundation controls: what every organization should already have in place

The Traditional and Initial maturity stage closes the obvious gaps before tackling sophisticated, context-aware policy. Here’s how to get started.

1. Replace passwords with federated identity

Per-app credentials are a real threat. Most people aren’t creative with passwords. They pick something simple, then reuse it across systems with minor variations: password!!01, password!!02, password!!03. One compromised credential becomes a skeleton key across your entire environment.

Mattermost replaces standalone credentials with your enterprise identity provider (IdP) through SAML 2.0 and OpenID Connect, supporting Okta, Microsoft ADFS, Entra ID, and others out of the box. User accounts and attributes are created and synchronized automatically on first login. There aren’t any locally managed credentials to compromise.

This also means the organization’s existing deprovisioning workflows work immediately: when a user is terminated or temporarily suspended in the IdP, their Mattermost access goes with it. The attack surface shrinks automatically.

2. Continuously sync directory state

Identity is a continuous state. Someone’s job role, clearance level, or organizational affiliation can change at any time, and collaboration access needs to keep pace.

AD/LDAP continuous sync keeps Mattermost access rights current with Active Directory or LDAP. When a user is disabled or reassigned in the directory, their Mattermost access updates automatically on the next sync cycle. Group memberships flow through automatically, too, eliminating manual role management.

3. Enforce multi-factor authentication (MFA)

MFA is non-negotiable these days, but it’s still worth calling out. Every authentication should require a second factor that can’t be guessed or stolen from a database dump.

Mattermost supports MFA out of the box with Google Authenticator, Microsoft Authenticator, and FreeOTP. Admins can enforce MFA across all users or delegate enforcement to the identity provider leveraging its options, whichever model fits the organization’s existing posture.

4. Scope external access

Not every collaborator is a full-time employee working for the organization. Contractors, partners, coalition members, and external liaisons all need controlled access.

Mattermost’s Guest Accounts give external users access limited to individual specific channels. Guests can’t discover other channels or teams; their view is explicitly constricted to what they need to know. 

For frictionless external access without shared credentials, passwordless magic links provide expiring, single-use access that eliminates the shared password problem entirely.

5. Encrypt everything in transit and at rest

Zero Trust doesn’t mean unencrypted. Every message, file, and notification Mattermost handles is protected in motion and at rest.

In transit, TLS covers all client-server and server-server communication. For mobile push notifications, Mattermost uses an ID-only model; instead of transmitting message content through Apple or Google infrastructure, the system sends an opaque ID and the mobile app retrieves the full content directly from your server. 

Translation: Apple and Google never see your message content.

At rest, Mattermost encrypts data stored in PostgreSQL and supports bring-your-own-key (BYOK) encryption for cloud deployments. File attachments in S3-compatible storage can be encrypted independently of the database.

Again, these are baseline requirements that should be in place before anything else is built on top.

6. Start your audit trail

You can’t enforce what you can’t see. In a Zero Trust model, visibility isn’t optional. 

Mattermost provides granular audit logging across every layer of the platform: user authentication events, permission changes, channel access, file activity, and administrative actions. Logs are exportable at error, panic, debug, and trace levels to Syslog and TCP destinations, making it straightforward to feed into your existing SIEM without custom integration work.

For organizations running multiple Mattermost servers, the Grafana Loki integration enables centralized log aggregation across the entire deployment from day one. That means a single pane of glass for security operations, which means there’s no more hunting across servers when you’re reconstructing an incident timeline.

The audit trail also matters for compliance. Whether you’re working toward FedRAMP or CMMC, or satisfying an ATO requirement, demonstrating that every access event is logged and queryable is foundational. You can’t show auditors what you haven’t captured.

The data-centric framing for Foundation-stage conversations

When you brief leadership or security stakeholders on Foundation-stage Zero Trust, the framing matters. Perimeter security is intuitive; you can draw a box around it. Data-centric security, however, requires a different mental model.

Try this pitch: “We’re moving towards protecting the data wherever it lives; we don’t count on the network to do it for us.”

Every control at the Foundation stage moves protection closer to the data itself instead of depending on the perimeter to hold. Our eventual goal is to wrap the data in those controls, but to get there, this is the foundation:

• SSO and MFA means access to data requires verified identity, not just network presence
• Directory sync means data access reflects current organizational state, not historical provisioning
• Guest scoping means sensitive data is only visible to explicitly authorized parties
• Logging means every access to data is recorded and auditable

This framing also translates cleanly into ACP 240 language for NATO/EU contexts, where information assurance requirements focus on the protection of information objects instead of network segments.

What comes next

Foundation-stage controls reduce the most obvious attack surface. But they rely on a fundamentally static model: you configure roles, provision access, and hope both stay current.

The next post covers the Advanced maturity stage: attribute-based access control (ABAC), dynamic policy evaluation, and what it means to enforce access based on who someone is right now — not who they were when they were provisioned.

Mattermost maps to the CISA Zero Trust Maturity Model across all five pillars: Identity, Devices, Networks, Applications/Workloads, and Data. For a full technical mapping, see the Zero Trust with Mattermost documentation.

For organizations operating under NATO ACP 240 or EU information security frameworks, contact us to discuss how Mattermost’s deployment models support allied and coalition environments.