A Survey on Zero Trust Architecture: Principles, Deployment,  and  Open Challenges

moamin hajo; Karam Hatim

doi:10.71229/pkffyc08

Authors

Moamin Mohammed Department of Software Engineering, College of Computer Science and Mathematics University of Mosul, Mosul, Iraq https://orcid.org/0009-0003-0000-7499
Karam Hatim Department of Software Engineering, College of Computer Science and Mathematics University of Mosul, Mosul, Iraq

DOI:

https://doi.org/10.71229/pkffyc08

Keywords:

cyber security, , zero trust, , risk management, , threat landscape

Abstract

Zero Trust Architecture (ZTA) is such a shift from traditional model of cybersecurity by focusing on a holistic approach rather than a perimeter-based security model. According to the authors' knowledge at the time a comprehensive overview of the ZTA concepts, deployment models, challenges, benefits, and future of it are discussed. The review article includes an insight on how ZTA can be used or applied for example in cloud networks, remote work sites, multicloud environments, and hybrid deployments with reference to NIST SP 800-207 guidelines and real-life settings. The article mainly discusses a survey of the literature covering NIST SP 800-207, industry guidance documents and other standards related to ZT. Besides, the paper highlights key challenges in adopting ZT that may hinder its widespread implementation. As one of the major findings from this paper shows, using a continuous verification mechanism as part of ZTA implementation can help reduce lateral movement incidents by as much as 72-90% and insider threats by 65%. In addition to this, the level of data protection should significantly increase. The review article is intended as a reference point for practitioners looking for a step-by-step guide on how to establish and deploy ZTA in cybersecurity systems.

References

[1] Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. NIST Special Publication 800-207. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207 DOI: https://doi.org/10.6028/NIST.SP.800-207

[2] Ahmadi, S. (2024). Zero Trust Architecture in Cloud Networks: Application, Challenges and Future Opportunities. DOI: https://doi.org/10.31219/osf.io/dt4km

Journal of Engineering Research and Reports, 26(2), 215-

228. https://doi.org/10.9734/JERR/2024/v26i21083 DOI: https://doi.org/10.9734/jerr/2024/v26i21083

[3] Jonnakuti, S. (2021). Zero-Trust Architectures for Secure Multi-Cloud AI Workloads. International Journal of Leading Research Publication, 2(5), 1-6. DOI: https://doi.org/10.70528/IJLRP.v2.i5.1558

[4] Chaudhary, R., et al. (2024). Zero-Trust Security in Hybrid Cloud Environments. Journal of Cloud Computing Research, 12(3), 45-62.

[5] Kim, J., Oh, J., Ryu, K., & Lee, M. (2020). A review of insider threat detection approaches with IoT perspective. DOI: https://doi.org/10.1109/ACCESS.2020.2990195

IEEE Access, 8, 78847-78867.

https://doi.org/10.1109/ACCESS.2020.3015135

[6] Syed, N. F., Shah, S. W., Shaghaghi, A., Anwar, A., Baig, Z., & Doss, R. (2022). Zero trust architecture (ZTA): A comprehensive survey. IEEE Access, 10, 57143-57179. https://doi.org/10.1109/ACCESS.2022.3178270 DOI: https://doi.org/10.1109/ACCESS.2022.3174679

[7] Kim, H., Kim, Y., & Kim, S. (2024). A Study on the Security Requirements Analysis to Build a Zero Trust-Based Remote Work Environment. Korea University Technical Report.

[8] DeCusatis, C., Liengtiraphan, P., Sager, A., & Pinelli, M. (2016). Implementing zero trust cloud networks with transport access control and first packet authentication. In 2016 IEEE International Conference on Smart Cloud

(SmartCloud) (pp. 5-10). IEEE.

https://doi.org/10.1109/SmartCloud.2016.22 DOI: https://doi.org/10.1109/SmartCloud.2016.22

[9] Wang, W., Sadjadi, S. M., Rishe, N., & Mahara, A.

(2024). Applying Transparent Shaping for Zero Trust Architecture Implementation in AWS: A Case Study. arXiv preprint arXiv:2405.01412. https://arxiv.org/abs/2405.01412

[10] Rashid, W. (2024). Analysis of Automated Zero Trust AWS Home Network for Confidentiality and Authentication Issues [Master's thesis, National College of Ireland]. National College of Ireland Repository.

[11] Zimmer, B. (2018). LISA: A practical zero trust architecture. In Proceedings of the 32nd Large Installation System Administration Conference (LISA18). USENIX Association.

[12] Dimitrakos, T., et al. (2020). Trust-aware continuous authorization for zero trust in consumer internet of things. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (pp. 1801-1812). IEEE. DOI: https://doi.org/10.1109/TrustCom50675.2020.00247

[13] Fernandez, E. B., & Brazhuk, A. (2024). A critical analysis of Zero Trust Architecture (ZTA). Computer DOI: https://doi.org/10.1016/j.csi.2024.103832

Standards & Interfaces, 89, 103832.

https://doi.org/10.1016/j.csi.2023.103832

[14] Tyler, D., & Viana, T. (2021). Trust no one? A framework for assisting healthcare organisations in transitioning to a zero-trust network architecture. Applied Sciences, 11(2), 499. https://doi.org/10.3390/app11020499 [15] Mehraj, S., & Banday, M. T. (2020). Establishing a zero trust strategy in cloud computing environment. In 2020 International Conference on Computer Communication and DOI: https://doi.org/10.3390/app11167499

Informatics (ICCCI) (pp. 1-6). IEEE.

https://doi.org/10.1109/ICCCI48352.2020.9104210 DOI: https://doi.org/10.1109/ICCCI48352.2020.9104210

[16] National Cyber Security Centre. (2023). Zero Trust Summary: Principles and Implementation. UK Government Publication.

[17] Lee, S., & Park, J. (2023). Zero Trust Home Network Summary: Security Considerations for Residential Deployments. Home Network Security Journal, 5(1), 23-45.

[18] Xie, L., Hang, F., Guo, W., Lv, Y., & Chen, H. (2021). A micro-segmentation protection scheme based on zero trust architecture. In 6th International Conference on Information Science, Computer Technology and Transportation (pp. 1-4). IEEE.

[19] Chen, S., Qiao, J., Zhao, D., Liu, X., Shi, M., & Lyu, Y. (2020). A security awareness and protection system for 5G smart healthcare based on zero-trust architecture. IEEE Internet of Things Journal, 8(13), 10248-10263. https://doi.org/10.1109/JIOT.2020.3041042 DOI: https://doi.org/10.1109/JIOT.2020.3041042

[20] Yao, Q., Wang, Q., Zhang, X., & Fei, J. (2020). Dynamic access control and authorization system based on zero-trust architecture. In Proceedings of the 2020 1st International Conference on Control, Robotics and Intelligent System (pp. DOI: https://doi.org/10.1145/3437802.3437824

123-127). ACM. https://doi.org/10.1145/3437802.3437829. DOI: https://doi.org/10.1145/3437802.3437829