Services for Zero Trust Architectures - A Research Roadmap

TLDR

Zero Trust Architecture (ZTA) is a fine‑grained defense approach that assumes no entity inside or outside the protected system can be trusted, requiring comprehensive security controls, yet it lacks a single design solution and comprises many interconnected concepts that must be assessed before choosing a solution. The paper outlines a ZTA design methodology grounded in cyber‑risk assessment and known high‑security risks, discusses challenges in design and deployment, and examines how service technology can support ZTA. The methodology relies on cyber‑risk assessment and identification of high‑security risks, and it addresses challenges in designing and deploying ZTA and related solutions.

Abstract

The notion of Zero Trust Architecture (ZTA) has been introduced as a fine-grained defense approach. It assumes that no entities outside and inside the protected system can be trusted and therefore requires articulated and high-coverage deployment of security controls. However, ZTA is a complex notion which does not have a single design solution; rather it consists of numerous interconnected concepts and processes that need to be assessed prior to deciding on a solution. In this paper, we outline a ZTA design methodology based on cyber risks and the identification of known high security risks. We then discuss challenges related to the design and deployment of ZTA and related solutions. We also discuss the role that service technology can play in ZTA.