Zero Trust Architecture

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Some solutions may require additional steps to perform a given workflow, which may change how enterprise subjects perform the workflow.

“Some solutions may require additional steps to perform a given workflow.This may change how enterprise subjects perform the workflow.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Some solutions assume that requested resources will reside in the cloud (north-south traffic) and not within an enterprise perimeter (east-west traffic).

“Some solutions assume that requested resources will reside in the cloud (so-called north-south traffic) and not within an enterprise perimeter (east-west traffic).”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Currently, there is a wide variety of models and solutions seeking to become the leading authority of ZTA.

“Currently, there is a wide variety of models and solutions seeking to become the leading authority of ZTA.”

Probably not a substantial claim: may not pass S4 (based).

There are no standards that purchasers can rely on to identify compatibility between products.

“There are no standards that purchasers can rely on to identify compatibility between products.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Some solutions may support a broad range of protocols (web, SSH, etc.) and transports (IPv4 and IPv6), while others may only work with a narrow focus such as web or email.

“Some solutions may support a broad range of protocols (web, secure shell [SSH], etc.) and transports (IPv4 and IPv6), while others may only work with a narrow focus such as web or email.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The spectrum of components within the wider enterprise is vast, with many products focusing on a single niche within zero trust and relying on other products to provide either data or some service to another component.

“The spectrum of components within the wider enterprise is vast, with many products focusing on a single niche within zero trust and relying on other products to provide either data or some service to another component (e.g., integration of MFA for resource access).”

Probably not a substantial claim: may not pass S4 (based).

Industry has not yet coalesced around a single set of terms or concepts to describe ZTA components and operations.

“Industry has not yet coalesced around a single set of terms or concepts to describe ZTA components and operations.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The gaps listed in B.4 do not hinder an organization from adopting a ZTA for its enterprise.

“The gaps listed here do not hinder an organization from adopting a ZTA for its enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There has not been a rigorous examination of how end users act in an enterprise that is using a ZTA.

“There has not been a rigorous examination of how end users act in an enterprise that is using a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Vendors are required to implement and maintain wrappers for each partner component to allow maximum compatibility and interoperability.

“Additionally, vendors are required to implement and maintain wrappers for each partner component to allow maximum compatibility and interoperability.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There is a misconception that ZTA is a single framework with a set of solutions that are incompatible with the existing view of cybersecurity.

“There is a misconception that ZTA is a single framework with a set of solutions that are incompatible with the existing view of cybersecurity.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Zero trust as a strategy for the design and deployment of enterprise infrastructure is still a forming concept.

“Zero trust as a strategy for the design and deployment of enterprise infrastructure is still a forming concept.”

Probably not a substantial claim: may not pass S4 (based).

Systemic gaps affect initial implementation and deployment of ZTA and continued operation/maturity.

“These are the gaps that affect initial implementation and deployment of ZTA and continued operation/maturity.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Vendors too often rely on proprietary APIs provided by partner companies rather than standardized, vendor-independent APIs to achieve integration.

“Vendors too often rely on proprietary APIs provided by partner companies rather than standardized, vendorindependent APIs to achieve this integration.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Many MFA product vendors are required to create a different wrapper for each cloud provider or identity management system to be usable in different kinds of client combinations.

“For example, many MFA product vendors are required to create a different wrapper for each cloud provider or identity management system to be usable in different kinds of client combinations.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Some users resent having to use personally-owned devices for business processes or feel that they are being constantly monitored for possible violations of IT policies.

“However, some users resent having to use personally-owned devices for business processes or feel that they are being constantly monitored for possible violations of IT policies.”

• cites [4] 4. CSA-SDP] Cloud Security Alliance (2015) SDP Specification 1.0. Available at https://cloudsecurityalliance.org/artifacts/sdp-specification-v1-0/Not checked yet

  Not checked in the free run.

• cites [5] 5. National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 199. https://doi.org/10.6028/NIST.FIPS.199 sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

The survey of the ZTA vendor ecosystem displayed the wide range of infrastructure that an enterprise deploying a ZTA would need to consider.

“The survey of the ZTA vendor ecosystem displayed the wide range of infrastructure that an enterprise deploying a ZTA would need to consider.”

May combine two claims.

The complexity of a typical enterprise's infrastructure has outstripped legacy methods of perimeter-based network security because there is no single, easily identified perimeter for the enterprise.

“This complexity has outstripped legacy methods of perimeter-based network security as there is no single, easily identified perimeter for the enterprise.”

May combine two claims.

Perimeter-based network security is insufficient because once attackers breach the perimeter, further lateral movement is unhindered.

“Perimeter-based network security has also been shown to be insufficient since once attackers breach the perimeter, further lateral movement is unhindered.”

May combine two claims.

A contextual trust algorithm can detect an attack whereas a singular trust algorithm may fail to detect the new behavior.

“These are examples where a contextual TA can detect an attack whereas a singular TA may fail to detect the new behavior.”

May combine two claims.

A contextual trust algorithm requires the PE to maintain some state information on all subjects and applications but may be more likely to detect an attacker using subverted credentials to access information in a pattern atypical for the subject.

“This means the PE must maintain some state information on all subjects and applications but may be more likely to detect an attacker using subverted credentials to access information in a pattern that is atypical of what the PE sees for the given subject.”

Classified as probably not a substantial claim.

The idea of zero trust is to explicitly authenticate and authorize all subjects, assets and workflows that make up the enterprise.

“The idea is to explicitly authenticate and authorize all subjects, assets and workflows that make up the enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing).

There are several ways that an enterprise can enact a ZTA for workflows.

“There are several ways that an enterprise can enact a ZTA for workflows.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Enclave-based deployment requires the enterprise to have a robust asset and configuration management program in place to install/configure device agents.

“The enterprise needs a robust asset and configuration management program in place to install/configure the device agents.”

Classified as probably not a substantial claim.

In ZTA, enterprise resources cannot connect to each other without the PA's permission and, possibly, configuration action.

“Enterprise resources cannot connect to each other without the PA's permission and, possibly, configuration action.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Botnets such as Mirai produce massive DoS attacks against key internet service providers and disrupt service to millions of internet users.

“Botnets such as Mirai produce massive DoS attacks against key internet service providers and disrupt service to millions of internet users.5”

• cites [5] 5. National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 199. https://doi.org/10.6028/NIST.FIPS.199 sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

In device application sandboxing, the PEP will refuse requests from other applications on the asset.

“The applications can communicate with the PEP to request access to resources, but the PEP will refuse requests from other applications on the asset.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In enhanced identity governance-based approaches, network access is initially granted to all assets but access to enterprise resources is restricted to identities with the appropriate access privileges.

“Network access is initially granted to all assets but access to enterprise resources are restricted to identities with the appropriate access privileges.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

When balanced with existing cybersecurity policies and guidance, identity and access management, continuous monitoring, and best practices, a ZTA can protect against common threats and improve an organization's security posture by using a managed risk approach.

“When balanced with existing cybersecurity policies and guidance, identity and access management, continuous monitoring, and best practices, a ZTA can protect against common threats and improve an organization's security posture by using a managed risk approach.”

• AssumptionThe authors state this as an assumption: Zero trust security models assume that an attacker is present in the environment.
• AssumptionThe authors state this as an assumption: An enterprise-owned environment is no different or no more trustworthy than any nonenterprise-owned environment.
• AssumptionThe authors state this as an assumption: No resource is inherently trusted.

Classified as probably not a substantial claim. May combine two claims.

ZT is not a single architecture but a set of guiding principles for workflow, system design and operations that can be used to improve the security posture of any classification or sensitivity level.

“ZT is not a single architecture but a set of guiding principles for workflow, system design and operations that can be used to improve the security posture of any classification or sensitivity level [FIPS199].”

• cites FIPS199Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

The enhanced identity governance approach uses the identity of actors as the key component of policy creation.

“The enhanced identity governance approach to developing a ZTA uses the identity of actors as the key component of policy creation.”

May combine two claims.

Resource portal-based deployment can only scan and analyze assets and devices once they connect to the PEP portal and may not be able to continuously monitor them for malware, unpatched vulnerabilities, and appropriate configuration.

“This model can only scan and analyze assets and devices once they connect to the PEP portal and may not be able to continuously monitor them for malware, unpatched vulnerabilities, and appropriate configuration.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Any organization can benefit from a zero trust architecture.

“That said, any organization can benefit from a zero trust architecture.”

May combine two claims.

In enclave-based deployment, the gateway protects a collection of resources and may not be able to protect each resource individually.

“The downside is that the gateway protects a collection of resources and may not be able to protect each resource individually.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

An organization looking to develop a ZTA may find that its chosen use case and existing policies point to one approach over others.

“An organization looking to develop a ZTA for its enterprise may find that its chosen use case and existing policies point to one approach over others.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Identity-driven approaches also work well for enterprises that use cloud-based applications/services that may not allow for enterprise-owned or -operated ZT security components to be used (such as many SaaS offerings).

“Identity-driven approaches also work well for enterprises that use cloud-based applications/services that may not allow for enterprise-owned or -operated ZT security components to be used (such as many SaaS offerings).”

Probably not a substantial claim: may not pass S2 (checkable).

To allow the PDP/PEP to be as specific as possible, the implicit trust zone must be as small as possible.

“To allow the PDP/PEP to be as specific as possible, the implicit trust zone must be as small as possible.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Depending on how an enterprise network is set up, multiple ZTA deployment models may be in use for different business processes in one enterprise.

“Depending on how an enterprise network is set up, multiple ZTA deployment models may be in use for different business processes in one enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Each ZTA approach implements all the tenets of ZT but may use one or two (or one component) as the main driver of policies.

“Each approach implements all the tenets of ZT (see Section 2.1) but may use one or two (or one component) as the main driver of policies.”

May combine two claims.

In resource portal-based deployment, there is no local agent that handles requests, so the enterprise may not have full visibility or arbitrary control over assets as it can only see/scan them when they connect to a portal.

“The main difference with this model is there is no local agent that handles requests, and so the enterprise may not have full visibility or arbitrary control over assets as it can only see/scan them when they connect to a portal.”

Classified as probably not a substantial claim.

In ZTA, the policy engine and policy administrator are key components of the entire enterprise.

“In ZTA, the policy engine and policy administrator are the key components of the entire enterprise.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Other approaches may be more difficult to implement and may require more fundamental changes to how the enterprise currently conducts business flows.

“That does not mean the other approaches would not work but rather that other approaches may be more difficult to implement and may require more fundamental changes to how the enterprise currently conducts business flows.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Certain approaches lend themselves to some use cases more than others.

“Certain approaches lend themselves to some use cases more than others.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Analysis of subject behavior can be used to provide a model of acceptable use, and deviations from this behavior could trigger additional authentication checks or resource request denials.

“Analysis of subject behavior can be used to provide a model of acceptable use, and deviations from this behavior could trigger additional authentication checks or resource request denials.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In a ZT environment, there should be a separation (logical or possibly physical) of the communication flows used to control and configure the network and application/service communication flows used to perform the actual work of the organization.

“In a ZT environment, there should be a separation (logical or possibly physical) of the communication flows used to control and configure the network and application/service communication flows used to perform the actual work of the organization.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Any enterprise environment can be designed with zero trust tenets in mind.

“Any enterprise environment can be designed with zero trust tenets in mind.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

One disadvantage of device application sandboxing is that enterprises must maintain these sandboxed applications for all assets and may not have full visibility into client assets.

“One of the disadvantages of this model is that enterprises must maintain these sandboxed applications for all assets and may not have full visibility into client assets.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There will likely be a period when ZTA components and perimeter-based network infrastructure are concurrently in operation in an enterprise.

“As discussed in Section 7.2, there will likely be a period when ZTA components and perimeter-based network infrastructure are concurrently in operation in an enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

In device agent/gateway deployment, access is possible only via the device agent, which can be placed on enterprise-owned assets.

“Access is possible only via the device agent, which can be placed on enterprise-owned assets.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The PDP/PEP applies a set of controls so that all traffic beyond the PEP has a common level of trust.

“The PDP/PEP applies a set of controls so that all traffic beyond the PEP has a common level of trust.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Most definitions of ZT continue to define themselves in relation to perimeters in some way (such as micro-segmentation or microperimeters) as part of the functional capabilities of a ZTA.

“However, most of these definitions continue to define themselves in relation to perimeters in some way (such as micro-segmentation or microperimeters; see Section 3.1) as part of the functional capabilities of a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For the enhanced identity governance approach, enterprise resource access policies are based on identity and assigned attributes.

“For this approach, enterprise resource access policies are based on identity and assigned attributes.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Developing a set of criteria or weights/threshold values for each resource requires planning and testing.

“Developing a set of criteria or weights/threshold values for each resource requires planning and testing.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Most enterprise infrastructures will operate in a hybrid zero trust/perimeter-based mode while continuing to invest in IT modernization initiatives and improve organization business processes.

“Most enterprise infrastructures will operate in a hybrid zero trust/perimeter-based mode while continuing to invest in IT modernization initiatives and improve organization business processes.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In ZTA, the PA is the key component for resource access.

“In ZTA, the PA is the key component for resource access.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A full ZT solution will include elements of all three approaches.

“A full ZT solution will include elements of all three approaches.”

Classified as probably not a substantial claim. May combine two claims.

The key necessity to micro-segmentation ZTA is that the PEP components are managed and should be able to react and reconfigure as needed to respond to threats or change in the workflow.

“The key necessity to this approach is that the PEP components are managed and should be able to react and reconfigure as needed to respond to threats or change in the workflow.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The separation of communication flows is often broken down to a control plane for network control communication and a data plane for application/service communication flows.

“This is often broken down to a control plane for network control communication and a data plane for application/service communication flows [Gilman].”

• cites GilmanNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

For a general, public-facing resource that does not require login credentials to access, the tenets of ZTA do not directly apply.

“For a general, public-facing resource that does not require login credentials to access (e.g., public web page), the tenets of ZTA do not directly apply.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Enhanced identity governance-based approaches for enterprises are often employed using an open network model or an enterprise network with visitor access or frequent nonenterprise devices on the network.

“Enhanced identity governance-based approaches for enterprises are often employed using an open network model or an enterprise network with visitor access or frequent nonenterprise devices on the network (such as with the use case in Section 4.3 below).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Zero trust applies to two basic areas: authentication and authorization.

“This implies that zero trust applies to two basic areas: authentication and authorization.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The Trusted Internet Connections (TIC) and agency perimeter firewalls provide strong internet gateways.

“The Trusted Internet Connections (TIC) and agency perimeter firewalls provide strong internet gateways.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Continually prompting a subject for reauthentication against behavior that is consistent with historical trends and norms for their mission function and role within the organization can lead to usability issues.

“Continually prompting a subject for reauthentication against behavior that is consistent with historical trends and norms for their mission function and role within the organization can lead to usability issues.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

There is a downside in granting basic network connectivity as malicious actors could still attempt network reconnaissance and/or use the network to launch denial of service attacks either internally or against a third party.

“There is a downside in granting basic network connectivity as malicious actors could still attempt network reconnaissance and/or use the network to launch denial of service attacks either internally or against a third party.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The enterprise can use the identity of requestors to form and enforce policy on cloud-based platforms.

“The enterprise can use the identity of requestors to form and enforce policy on these platforms.”

May combine two claims.

This mitigation reduces the risk but does not eliminate it.

“This mitigates the risk but does not eliminate it.”

Probably not a substantial claim: may not pass S4 (based).

In ZTA, no communication between enterprise resources occurs unless it is approved and possibly configured by the PE and PA.

“No communication between enterprise resources occurs unless it is approved and possibly configured by the PE and PA.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When ZTA using network infrastructure and SDP is implemented at the application network layer (layer 7), the most common deployment model is the agent/gateway.

“When the approach is implemented at the application network layer (i.e., layer 7), the most common deployment model is the agent/gateway (see Section 3.2.1).”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

These tenets are the ideal goal, though not all tenets may be fully implemented in their purest form for a given strategy.

“These tenets are the ideal goal, though it must be acknowledged that not all tenets may be fully implemented in their purest form for a given strategy.”

Probably not a substantial claim: may not pass S4 (based).

Unauthorized lateral movement within the environment has been one of the biggest challenges for federal agencies.

“As a result, unauthorized lateral movement within the environment has been one of the biggest challenges for federal agencies.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Micro-segmentation ZTA requires an identity governance program (IGP) to fully function.

“This approach requires an identity governance program (IGP) to fully function but relies on the gateway components to act as the PEP that shields resources from unauthorized access and/or discovery.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Other factors such as device used, asset status, and environmental factors may alter the final confidence level calculation or tailor the result in some way, such as granting only partial access to a given data source based on network location.

“Other factors such as device used, asset status, and environmental factors may alter the final confidence level calculation (and ultimate access authorization) or tailor the result in some way, such as granting only partial access to a given data source based on network location.”

Classified as probably not a substantial claim.

Enterprise resources should not be reachable without accessing a PEP.

“Enterprise resources should not be reachable without accessing a PEP.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The PEP is the only component that accesses the policy administrator as part of a business flow.

“The PEP is the only component that accesses the policy administrator as part of a business flow.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Enterprises can mitigate the DoS/network disruption threat by having the policy enforcement reside in a properly secured cloud environment or be replicated in several locations following guidance on cyber resiliency.

“Enterprises can mitigate this threat by having the policy enforcement reside in a properly secured cloud environment or be replicated in several locations following guidance on cyber resiliency .”

Probably not a substantial claim: may not pass S3 (load-bearing).

Contextual, score-based trust algorithms provide the ability to offer more dynamic and granular access control, since the score provides a current confidence level for the requesting account and adapts to changing factors more quickly than static policies modified by human administrators.

“However, contextual, score-based TAs would provide the ability to offer more dynamic and granular access control, since the score provides a current confidence level for the requesting account and adapts to changing factors more quickly than static policies modified by human administrators.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Enterprise administrators may encounter issues during the initial implementation of ZTA where access requests that should be approved are denied due to misconfiguration.

“Enterprise administrators may encounter issues during the initial implementation of ZTA where access requests that should be approved are denied due to misconfiguration.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The primary requirement for resource access in the enhanced identity governance approach is based on the access privileges granted to the given subject.

“The primary requirement for resource access is based on the access privileges granted to the given subject.”

Probably not a substantial claim: may not pass S4 (based).

Any enterprise administrator with configuration access to the PE's rules may be able to perform unapproved changes or make mistakes that can disrupt enterprise operations.

“Any enterprise administrator with configuration access to the PE's rules may be able to perform unapproved changes or make mistakes that can disrupt enterprise operations.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A singular trust algorithm can allow faster evaluations, but there is a risk that an attack can go undetected if it stays within a subject's allowed role.

“This can allow faster evaluations, but there is a risk that an attack can go undetected if it stays within a subject's allowed role.”

Probably not a substantial claim: may not pass S4 (based).

ZT principles take the view that there should be no difference between enterprise-owned and -operated network infrastructure and infrastructure owned and operated by any other service provider.

“As discussed in Section 2.2, ZT principles take the view that there should be no difference between enterprise-owned and -operated network infrastructure and infrastructure owned and operated by any other service provider.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Resource portal-based deployment allows attackers to discover and attempt to access the portal or attempt a denial-of-service (DoS) attack against the portal.

“This model also allows attackers to discover and attempt to access the portal or attempt a denial-of-service (DoS) attack against the portal.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Zero trust provides a set of principles and concepts around moving the PDP/PEPs closer to the resource.

“Zero trust provides a set of principles and concepts around moving the PDP/PEPs closer to the resource.”

Probably not a substantial claim: may not pass S4 (based).

The PDP/PEP cannot apply additional policies beyond its location in the flow of traffic.

“The PDP/PEP cannot apply additional policies beyond its location in the flow of traffic.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The identity-driven approach works well with the resource portal model since device identity and status provide secondary support data to access decisions.

“The identity-driven approach works well with the resource portal model ( see Section 3.2.3)since device identity and status provide secondary support data to access decisions.”

Classified as probably not a substantial claim.

In the multi-cloud use case, the application hosted in Cloud Provider A should be able to connect directly to the data source hosted in Cloud Provider B rather than force the application to tunnel back through the enterprise network.

“For performance and ease of management, the application hosted in Cloud Provider A should be able to connect directly to the data source hosted in Cloud Provider B rather than force the application to tunnel back through the enterprise network.”

Classified as probably not a substantial claim. May combine two claims.

The contextual TA can detect access patterns that are out of normal behavior and deny the compromised account or insider threat access to sensitive resources.

“The contextual TA can detect access patterns that are out of normal behavior and deny the compromised account or insider threat access to sensitive resources.”

Probably not a substantial claim: may not pass S2 (checkable).

Enterprises need a clear set of subject attributes and policies that can be used by a PE to evaluate access requests.

“Enterprises need a clear set of subject attributes and policies that can be used by a PE to evaluate access requests.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Several existing federal policies and guidance intersect with the planning, deployment, and operation of a ZTA.

“Several existing federal policies and guidance intersect with the planning, deployment, and operation of a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

This includes personal information used by the enterprise to support ZTA operations and any biometric attributes used in access request evaluations.

“This includes personal information used by the enterprise to support ZTA operations and any biometric attributes used in access request evaluations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Some of this traffic may contain private information or have associated privacy risks.

“Some of this traffic may contain private information or have associated privacy risks.”

Classified as probably not a substantial claim.

The policy engine cannot determine if attempted connections are authorized to connect to a resource if the PE has insufficient information to identify associated subjects and resources.

“The policy engine cannot determine if attempted connections are authorized to connect to a resource if the PE has insufficient information to identify associated subjects and resources.”

Probably not a substantial claim: may not pass S3 (load-bearing).

NIST produced a Privacy Framework for use by organizations.

“In response, NIST produced a Privacy Framework for use by organizations [NISTPRIV].”

• cites NISTPRIVNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

The NIST Privacy Framework could help in developing a formal process to identify and mitigate any privacy-related risks to an enterprise developing a zero trust architecture.

“The NIST Privacy Framework [NISTPRIV] could help in developing a formal process to identify and mitigate any privacy-related risks to an enterprise developing a zero trust architecture.”

• cites NISTPRIVNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Artificial intelligence and other software-based agents are being deployed to manage security issues on enterprise networks.

“Artificial intelligence and other software-based agents are being deployed to manage security issues on enterprise networks.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

These policies do not prohibit an enterprise from moving to a more zero trust-oriented architecture but can influence development of a zero trust strategy for an agency.

“These policies do not prohibit an enterprise from moving to a more zero trust-oriented architecture but can influence development of a zero trust strategy for an agency.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

TIC 3.0 has an updated TIC Security Capability Handbook, which defines two types of security capabilities: Universal Security Capabilities and PEP Security Capabilities.

“In addition, TIC 3.0 has an updated TIC Security Capability Handbook, which defines two types of security capabilities:”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

This could happen due to a DDoS attack or simply due to unexpected heavy usage.

“This could happen due to a DDoS attack or simply due to unexpected heavy usage.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Implementation of MFA for access requests may reduce the risk of information loss from a compromised account.

“Implementation of MFA for access requests may reduce the risk of information loss from a compromised account.”

Probably not a substantial claim: may not pass S4 (based).

Often, the assets used to store and process this information do not have a common, open standard on how to interact and exchange information.

“Often, the assets used to store and process this information do not have a common, open standard on how to interact and exchange information.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The NIST Privacy Framework provides a framework to describe privacy risks and mitigation strategies, as well as a process for an enterprise to identify, measure, and mitigate risks to user privacy and private information stored and processed by an organization.

“This document provides a framework to describe privacy risks and mitigation strategies, as well as a process for an enterprise to identify, measure, and mitigate risks to user privacy and private information stored and processed by an organization.”

• cites NISTPRIVNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Strong subject provision and authentication policies need to be in place before moving to a more zero trust-aligned deployment.

“Strong subject provision and authentication policies need to be in place before moving to a more zero trust-aligned deployment.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

For a federal agency to perform its mission, there is an acceptable level of risk.

“For a federal agency to perform its mission, there is an acceptable level of risk.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

NCPS (operationally known as EINSTEIN) is an integrated system-of-systems that delivers intrusion detection, advanced analytics, information sharing, and intrusion prevention capabilities to defend the Federal Government from cyber threats.

“NCPS (operationally known as EINSTEIN) is an integrated system-of-systems that delivers intrusion detection, advanced analytics, information sharing, and intrusion prevention capabilities to defend the Federal Government from cyber threats.”

Probably not a substantial claim: may not pass S3 (load-bearing).

An attacker could gain access to a software agent's credentials and impersonate the agent when performing tasks.

“There is also a risk that an attacker could gain access to a software agent's credentials and impersonate the agent when performing tasks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A ZTA deployment involves developing access policies around acceptable risk to the designated mission or business process.

“A ZTA deployment involves developing access polices around acceptable risk to the designated mission or business process (see Section 7. 3.3).”

Probably not a substantial claim: may not pass S3 (load-bearing).

These software-based agents need to interact with the management components of ZTA (e.g., policy engine, policy administrator), sometimes in lieu of a human administrator.

“These components need to interact with the management components of ZTA (e.g., policy engine, policy administrator), sometimes in lieu of a human administrator.”

Classified as probably not a substantial claim. May combine two claims.

This change is due to the addition of new components (e.g., policy engine, policy administrator, and PEPs) and a reduction of reliance on network perimeter defenses.

“This is due to the addition of new components (e.g., policy engine, policy administrator, and PEPs) and a reduction of reliance on network perimeter defenses.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Attackers may use phishing, social engineering, or a combination of attacks to obtain credentials of valuable accounts.

“Attackers may use phishing, social engineering, or a combination of attacks to obtain credentials of valuable accounts.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This risk can be reduced with regular retuning analysis to correct mistaken decisions and improve the decision process.

“This can be reduced with regular retuning analysis to correct mistaken decisions and improve the decision process.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Organizations will need to identify any possible risks associated with intercepting, scanning, and logging network traffic.

“Organizations will need to identify any possible risks associated with intercepting, scanning, and logging network traffic [NISTIR 8062].”

• cites NISTIR 8062Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim. May combine two claims.

ZTA reduces risk and prevents any compromised accounts or assets from moving laterally throughout the network.

“ZTA reduces risk and prevents any compromised accounts or assets from moving laterally throughout the network.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

TIC 3.0 is focused on network-based security protections, whereas ZTA is a more inclusive architecture addressing application, user, and data protections.

“TIC 3.0 is focused on network-based security protections, whereas ZTA is a more inclusive architecture addressing application, user, and data protections.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

It is possible to deny all network access to a resource and allow access only via a connected terminal, but this is disproportionately restrictive in the majority of cases and could inhibit work from being accomplished.

“It is possible to deny all network access to a resource and allow access only via a connected terminal, but this is disproportionately restrictive in the majority of cases and could inhibit work from being accomplished.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

TIC 2.0 provides a list of network-based security capabilities to be deployed at the TIC Access Point at the agency's perimeter; many of these capabilities are aligned with ZT principles.

“TIC 2.0 provides a list of network-based security capabilities (e.g.content filtering, monitoring, authentication, and others) to be deployed at the TIC Access Point at the agency's perimeter; many of these capabilities are aligned with ZT principles.”

Probably not a substantial claim: may not pass S3 (load-bearing).

TIC 3.0 has been updated to accommodate cloud services and mobile devices.

“TIC 3.0 has been updated to accommodate cloud services and mobile devices [M-19-26].”

• cites M-19-26Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

This is also possible in legacy remote-access VPNs and is not unique to ZTA.

“This is also possible in legacy remote-access VPNs and is not unique to ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing).

If monitor scans, network traffic, and metadata are being stored for building contextual policies, forensics, or later analysis, that data becomes a target for attackers.

“If monitor scans, network traffic, and metadata are being stored for building contextual policies, forensics, or later analysis, that data becomes a target for attackers.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The software agent may have a lower bar for authentication (e.g., API key versus MFA) to perform administrative or security-related tasks compared with a human user.

“The software agent may have a lower bar for authentication (e.g., API key versus MFA) to perform administrative or security-related tasks compared with a human user.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

If an attacker can interact with the agent, they could theoretically trick the agent into allowing the attacker greater access or into performing some task on behalf of the attacker.

“If an attacker can interact with the agent, they could theoretically trick the agent into allowing the attacker greater access or into performing some task on behalf of the attacker.”

Probably not a substantial claim: may not pass S3 (load-bearing).

PEP Security Capabilities may be applied at any appropriate PEP located along a given data flow instead of at a single PEP at the agency perimeter.

“The PEP Security Capabilities may be applied at any appropriate PEP located along a given data flow instead of at a single PEP at the agency perimeter.”

May combine two claims.

The management tool contains access policies to resources and can give an attacker information on which accounts are most valuable to compromise.

“Like stored traffic, this component contains access policies to resources and can give an attacker information on which accounts are most valuable to compromise (e.g., the ones that have access to the desired data resources).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

All traffic is inspected and logged on the network and analyzed to identify and react to potential attacks against the enterprise.

“As mentioned in Section 3.4.1,all traffic is inspected and logged on the network and analyzed to identify and react to potential attacks against the enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

TIC is a federal cybersecurity initiative jointly managed by OMB, DHS, and the General Services Administration (GSA), and is intended to establish a network security baseline across the Federal Government.

“TIC is a federal cybersecurity initiative jointly managed by OMB, DHS, and the General Services Administration (GSA), and is intended to establish a network security baseline across the Federal Government.”

May combine two claims.

Cloud services have experienced disruptions in the past, both infrastructure as a service (IaaS) and SaaS.

“Cloud services have experienced disruptions in the past, both infrastructure as a service (IaaS)foot_6 and SaaS.7”

• cites [6] 6. Gilman E, Barth D (2017) Zero Trust Networks: Building Secure Systems in Untrusted Networks (O'Reilly Media, Inc., Sebastopol, CA), 1st Ed.Not checked yet

  Not checked in the free run.

• cites [7] 7. Department of Homeland Security (2015) Hardware Asset Management (HWAM) Capability Description. Available at https://www.us- cert.gov/sites/default/files/cdm_files/HWAM_CapabilityDescription.pdfNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Historically, TIC was a perimeter-based cybersecurity strategy which required agencies to consolidate and monitor their external network connections.

“Historically, TIC was a perimeter-based cybersecurity strategy which required agencies to consolidate and monitor their external network connections.”

Classified as probably not a substantial claim.

As ZTA is heavily dependent on precise identity management, any ZTA effort will need to integrate the agency's ICAM policy.

“As ZTA is heavily dependent on precise identity management, any ZTA effort will need to integrate the agency's ICAM policy.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When complemented with existing cybersecurity policies and guidance, identity and access management, continuous monitoring, and general cyber hygiene, a properly implemented and maintained ZTA can reduce overall risk and protect against common threats.

“When complemented with existing cybersecurity policies and guidance, identity and access management, continuous monitoring, and general cyber hygiene, a properly implemented and maintained ZTA can reduce overall risk and protect against common threats.”

• Also stated in: § 6 Zero Trust Architecture and Possible Interactions with Existing Federal Guidance · hedged

  “When complemented with existing cybersecurity policies and guidance, ICAM, continuous monitoring, and general cyber hygiene, ZTA may reinforce an organization's security posture and protect against common threats.”

Probably not a substantial claim: may not pass S3 (load-bearing).

EINSTEIN sensors enable CISA's National Cybersecurity and Communications Integration Center (NCCIC) to defend federal networks and respond to significant incidents at federal agencies.

“EINSTEIN sensors enable CISA's National Cybersecurity and Communications Integration Center (NCCIC) to defend federal networks and respond to significant incidents at federal agencies.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Enterprise resources may not be reachable from the PA, so even if access is granted to a subject, the PA cannot configure the communication path from the network.

“There is also the risk that enterprise resources may not be reachable from the PA, so even if access is granted to a subject, the PA cannot configure the communication path from the network.”

Probably not a substantial claim: may not pass S4 (based).

A properly developed and implemented ZTA should prevent a compromised account or asset from accessing resources outside its normal purview or access patterns.

“A properly developed and implemented ZTA should prevent a compromised account or asset from accessing resources outside its normal purview or access patterns.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In such cases, only a portion of enterprise subjects is affected.

“In such cases, only a portion of enterprise subjects is affected.”

Probably not a substantial claim: may not pass S3 (load-bearing).

M-19-17 calls on all federal agencies to form an ICAM office to govern efforts related to identity issuance and management.

“The memo calls on all federal agencies to form an ICAM office to govern efforts related to identity issuance and management.”

• cites M-19-17Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

OMB issued M-19-17 on improving identity management for the Federal Government.

“The Office of Management and Budget (OMB) issued M-19-17 on improving identity management for the Federal Government.”

• cites M-19-17Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Part of the core requirements for ZT is that an enterprise should inspect and log traffic (or at least log and inspect metadata when dealing with traffic that cannot be decrypted by monitoring systems) in its environment.

“Part of the core requirements for ZT is that an enterprise should inspect and log traffic (or at least log and inspect metadata when dealing with traffic that cannot be decrypted by monitoring systems) in its environment.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The ZT principle of no implicit trust based on network location means attackers need to compromise an existing account or device to gain a foothold in an enterprise.

“The ZT principle of no implicit trust based on network location means attackers need to compromise an existing account or device to gain a foothold in an enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing).

An attacker may be able to induce or coerce an NPE to perform some task that the attacker is not privileged to perform.

“The associated risk is that an attacker will be able to induce or coerce an NPE to perform some task that the attacker is not privileged to perform.”

Probably not a substantial claim: may not pass S4 (based).

ZTA relies on several different data sources to make access decisions, including information about the requesting subject, asset used, enterprise and external intelligence, and threat analysis.

“ZTA relies on several different data sources to make access decisions, including information about the requesting subject, asset used, enterprise and external intelligence, and threat analysis.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The overall process described in the NIST Risk Management Framework will not change in a ZTA.

“The overall process described in the RMF will not change in a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The goals of NCPS align with the overarching goals of zero trust: to manage cyber risk, improve cyber protection, and empower partners to secure cyber space.

“The goals of NCPS, which align with the overarching goals of zero trust, are to manage cyber risk, improve cyber protection, and empower partners to secure cyber space.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Many TIC 3.0 security capabilities directly support ZTA.

“Many of these TIC 3.0 security capabilities directly support ZTA (e.g., encrypted traffic, strong authentication, microsegmentation, network and system inventory, and others).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Many of these management policies should use the recommendations in NIST SP 800-63-3, Digital Identity Guidelines.

“Many of these management policies should use the recommendations in NIST SP 800-63-3, Digital Identity Guidelines [SP800-63].”

• cites SP800-63Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based).

Properly implemented ZT, information security and resiliency policies, and best practices reduce the risk of an attacker gaining broad access via stolen credentials or insider attack.

“Properly implemented ZT, information security and resiliency policies, and best practices reduce the risk of an attacker gaining broad access via stolen credentials or insider attack.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Protecting the privacy of users and private information is a prime concern for organizations.

“Protecting the privacy of users and private information (e.g., personally identifiable information) is a prime concern for organizations.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The biggest risk when using automated technology for configuration and policy enforcement is the possibility of false positives and false negatives impacting the security posture of the enterprise.

“The biggest risk when using automated technology for configuration and policy enforcement is the possibility of false positives (innocuous actions mistaken for attacks) and false negatives (attacks mistaken for normal activity) impacting the security posture of the enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

A change in digital certificate providers may not appear to have a significant impact but may involve certificate root store management, Certificate Transparency log monitoring, and other factors that are not apparent at first.

“For example, a change in digital certificate providers may not appear to have a significant impact but may involve certificate root store management, Certificate Transparency log monitoring, and other factors that are not apparent at first.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

This may include additional organizational changes depending on how the enterprise is currently set up and operating.

“This may include additional organizational changes depending on how the enterprise is currently set up and operating.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The placement of NCPS sensors for DHS situational awareness is based on a perimeter network defense in the Federal Government, while ZTA moves protections closer to the assets, data and all other resources.

“The placement of NCPS sensors for DHS situational awareness is based on a perimeter network defense in the Federal Government, while ZTA moves protections closer to the assets, data and all other resources.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Vital to that posture is an agency's insight into the assets, configuration, and subjects within itself.

“Vital to that posture is an agency's insight into the assets, configuration, and subjects within itself.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The degree of success depends on how dependent this new infrastructure is on existing resources.

“The degree of success depends on how dependent this new infrastructure is on existing resources (e.g., ID management systems).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Additional logs from ZTA may be saved for after-the-fact analyses by incident responders.

“Information generated in a ZTA may better inform event impact quantification; machine learning tools could use ZTA data to improve detection; and additional logs from ZTA may be saved for after-thefact analyses by incident responders.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Subjects could encompass both human and possible NPEs, such as service accounts that interact with resources.

“Subjects could encompass both human and possible NPEs, such as service accounts that interact with resources.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Incident responders could potentially leverage information from the authentication, traffic inspection, and logging of agency traffic available to federal agencies that have implemented a zero trust architecture.

“Incident responders could potentially leverage information from the authentication, traffic inspection, and logging of agency traffic available to federal agencies that have implemented a zero trust architecture.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Most enterprises will continue to operate in a hybrid zero-trust/perimeter-based mode for an indefinite period while continuing to invest in ongoing IT modernization initiatives.

“Most enterprises will continue to operate in a hybrid zero-trust/perimeter-based mode for an indefinite period while continuing to invest in ongoing IT modernization initiatives.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Once the workflows are identified, the enterprise can narrow down the components needed and begin to map how the individual components interact.

“Once the workflows are identified, the enterprise can narrow down the components needed and begin to map how the individual components interact.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Having an IT modernization plan that includes moving to an architecture based on ZT principles may help an enterprise form roadmaps for small scale workflow migrations.

“Having an IT modernization plan that includes moving to an architecture based on ZT principles may help an enterprise form roadmaps for small scale workflow migrations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

One of the key requirements of ZTA is the ability to identify and manage devices.

“As mentioned in Section 2.1, one of the key requirements of ZTA is the ability to identify and manage devices.”

Probably not a substantial claim: may not pass S2 (checkable).

Before undertaking an effort to bring ZTA to an enterprise, there should be a survey of assets, subjects, data flows, and workflows.

“Before undertaking an effort to bring ZTA to an enterprise, there should be a survey of assets, subjects, data flows, and workflows.”

Probably not a substantial claim: may not pass S2 (checkable).

The ability to manage enterprise assets is key to the successful deployment of ZTA.

“The ability to manage enterprise assets is key to the successful deployment of ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

To move to ZTA, an enterprise must have a system to discover and record physical and virtual assets to create a usable inventory.

“For example, to move to ZTA, an enterprise must have a system to discover and record physical and virtual assets to create a usable inventory.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The DHS CDM program has initiated several efforts to build the capabilities needed within federal agencies to move to a ZTA.

“The DHS CDM program has initiated several efforts to build the capabilities needed within federal agencies to move to a ZTA.”

Classified as probably not a substantial claim.

Agencies must have visibility into the assets active on the network (or those accessing resources remotely) to categorize, configure, and monitor the network's activity.

“Agencies must have visibility into the assets active on the network (or those accessing resources remotely) to categorize, configure, and monitor the network's activity.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The enterprise needs to make sure that the common elements (e.g., ID management, device management, event logging) are flexible enough to operate in a ZTA and perimeter-based hybrid security architecture.

“The enterprise needs to make sure that the common elements (e.g., ID management, device management, event logging) are flexible enough to operate in a ZTA and perimeter-based hybrid security architecture.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The ability to observe the current state of an asset is part of the process of evaluating access requests.

“The ability to observe the current state of an asset is part of the process of evaluating access requests (see Section 2.1).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Data resources and applications and services that are primarily cloud-based or primarily used by remote workers are good candidates for a ZTA approach because the subjects and resources are located outside of the enterprise network perimeter and are likely to see the most benefit in use, scalability, and security.

“Data resources and applications and services that are primarily cloudbased or primarily used by remote workers are good candidates for a ZTA approach (see Section 7.3.3)because the subjects and resources are located outside of the enterprise network perimeter and are likely to see the most benefit in use, scalability, and security.”

Classified as probably not a substantial claim. May combine two claims.

As ZTA is adopted across the Federal Government, the NCPS implementation would need to continually evolve, or new capabilities would need to be deployed to fulfill NCPS objectives.

“As ZTA is adopted across the Federal Government, the NCPS implementation would need to continually evolve, or new capabilities would need to be deployed to fulfill NCPS objectives.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This goes beyond simply cataloging and maintaining a database of enterprise assets.

“This goes beyond simply cataloging and maintaining a database of enterprise assets.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Migration to a ZTA approach to the enterprise may take place one business process at a time.

“Migration to a ZTA approach to the enterprise may take place one business process at a time.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

These steps can be mapped to the steps in the RMF as any adoption of a ZTA is a process to reduce risk to an agency's business functions.

“These steps can be mapped to the steps in the RMF [SP800-37] as any adoption of a ZTA is a process to reduce risk to an agency's business functions.”

• cites SP800-37Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Having a strong CDM program implementation is key to the success of ZTA.

“Having a strong CDM program implementation is key to the success of ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

ZTA also requires the ability to identify and monitor nonenterprise-owned devices that may be on enterprise-owned network infrastructure or that access enterprise resources.

“ZTA also requires the ability to identify and monitor nonenterprise-owned devices that may be on enterprise-owned network infrastructure or that access enterprise resources.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This inventory is critical to determining what business processes and resources would benefit from implementing a ZTA.

“This inventory is critical to determining what business processes and resources would benefit from implementing a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

For a zero trust enterprise to operate, the PE must have knowledge of enterprise subjects.

“For a zero trust enterprise to operate, the PE must have knowledge of enterprise subjects.”

Probably not a substantial claim: may not pass S3 (load-bearing).

These policies require agencies to inventory and assess how they collect, store, and access data, both on premises and in the cloud.

“These policies require agencies to inventory and assess how they collect, store, and access data, both on premises and in the cloud.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

In these cases, it might be possible to introduce ZT concepts to some degree.

“In these cases, it might be possible to introduce ZT concepts to some degree.”

Probably not a substantial claim: may not pass S3 (load-bearing).

ZTA deployments may require administrators to satisfy a more stringent confidence level or criteria as outlined in NIST SP 800-63A, Section 5.

“ZTA deployments may require administrators to satisfy a more stringent confidence level or criteria as outlined in NIST SP 800-63A, Section 5 [SP800-63A].”

• cites SP800-63ANot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Migrating an existing workflow to a ZTA will likely require (at least) a partial redesign.

“Migrating an existing workflow to a ZTA will likely require (at least) a partial redesign.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Agencies using a ZTA for these assets may need to take collaboration or publication requirements into account when developing the strategy.

“Agencies using a ZTA for these assets may need to take collaboration or publication requirements into account when developing the strategy.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Enterprises may take this opportunity to adopt secure system engineering practices if they have not already done so for workflows.

“Enterprises may take this opportunity to adopt secure system engineering [SP800-160v1] practices if they have not already done so for workflows.”

• cites SP800-160v1Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Information generated in a ZTA may better inform event impact quantification.

“Information generated in a ZTA may better inform event impact quantification; machine learning tools could use ZTA data to improve detection; and additional logs from ZTA may be saved for after-thefact analyses by incident responders.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In a greenfield approach, it would be possible to build a zero trust architecture from the ground up.

“In a greenfield approach, it would be possible to build a zero trust architecture from the ground up.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The DHS Hardware Asset Management (HWAM) program is an effort to help agencies identify devices on their network infrastructure to deploy a secure configuration.

“For example, the DHS Hardware Asset Management (HWAM) [HWAM] program is an effort to help agencies identify devices on their network infrastructure to deploy a secure configuration.”

• cites HWAMNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

One additional consideration with the Federal Data Strategy is how to make agency data assets accessible to other agencies or the public.

“One additional consideration with the Federal Data Strategy is how to make agency data assets accessible to other agencies or the public.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Enterprise architects may also want to restrict ZTA candidate solutions to those that can interface with existing components.

“Enterprise architects may also want to restrict ZTA candidate solutions to those that can interface with existing components.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This knowledge is accessed by the PE when evaluating resource requests.

“This knowledge is accessed by the PE when evaluating resource requests.”

May combine two claims.

The Cloud Smart strategy, updated Data Center Optimization Initiative policy, and Federal Data Strategy all influence some requirements for agencies planning a ZTA.

“The Cloud Smartfoot_8 strategy, updated Data Center Optimization Initiative [M-19-19] policy, and Federal Data Strategyfoot_9 all influence some requirements for agencies planning a ZTA.”

• cites M-19-19Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

It is unlikely that any significant enterprise can migrate to zero trust in a single technology refresh cycle.

“It is unlikely that any significant enterprise can migrate to zero trust in a single technology refresh cycle.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This includes hardware components (e.g., laptops, phones, IoT devices) and digital artifacts (e.g., user accounts, applications, digital certificates).

“This includes hardware components (e.g., laptops, phones, IoT devices) and digital artifacts (e.g., user accounts, applications, digital certificates).”

Probably not a substantial claim: may not pass S3 (load-bearing).

There may be an indefinite period when ZTA workflows coexist with non-ZTA workflows in an enterprise.

“There may be an indefinite period when ZTA workflows coexist with non-ZTA workflows in an enterprise.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

An agency could design newly needed infrastructure around ZT principles and secure system engineering, such as evaluating subjects' trust before granting access and establishing micro-perimeters around new resources.

“The agency could design the newly needed infrastructure around ZT principles and secure system engineering [SP8900-160v1], such as evaluating subjects' trust before granting access and establishing micro-perimeters around new resources.”

• cites SP8900-160v1Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Implementing a ZTA is a journey rather than a wholesale replacement of infrastructure or processes.

“Implementing a ZTA is a journey rather than a wholesale replacement of infrastructure or processes.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

It may not be possible to conduct a complete census on all enterprise-owned assets, so an enterprise should consider building the capability to quickly identify, categorize, and assess newly discovered assets that are on enterprise-owned infrastructure.

“It may not be possible to conduct a complete census on all enterprise-owned assets, so an enterprise should consider building the capability to quickly identify, categorize, and assess newly discovered assets that are on enterprise-owned infrastructure.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The NCPS program is evolving to ensure that situational awareness is preserved through utilization of security information about cloud-based traffic, helping to set the foundation for expanded situational awareness telemetry from ZTA systems.

“The NCPS program is evolving to ensure that situational awareness is preserved through utilization of security information about cloud-based traffic, helping to set the foundation for expanded situational awareness telemetry from ZTA systems.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Incomplete knowledge will most often lead to a business process failure where the PE denies requests due to insufficient information.

“Incomplete knowledge will most often lead to a business process failure where the PE denies requests due to insufficient information.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

NCPS intrusion prevention functions would also require evolution to be able to inform policy enforcement at both the current NCPS locations as well as ZTA systems.

“NCPS intrusion prevention functions would also require evolution to be able to inform policy enforcement at both the current NCPS locations as well as ZTA systems.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

From that point, it is an engineering and organizational exercise in building the infrastructure and configuring the components.

“From that point, it is an engineering and organizational exercise in building the infrastructure and configuring the components.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

This is similar to the first steps in developing a road map to ZTA.

“This is similar to the first steps in developing a road map to ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The DHS CDM program is an effort to improve federal agency information technology (IT).

“The DHS CDM program is an effort to improve federal agency information technology (IT).”

Probably not a substantial claim: may not pass S3 (load-bearing).

The enterprise needs this information before it can develop a list of candidate business processes and the subjects/assets involved in this process.

“The enterprise needs this information before it can develop a list of candidate business processes and the subjects/assets involved in this process.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

An enterprise cannot determine what new processes or systems need to be in place if there is no knowledge of the current state of operations.

“An enterprise cannot determine what new processes or systems need to be in place if there is no knowledge of the current state of operations.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

This awareness forms the foundational state that must be reached before a ZTA deployment is possible.

“This awareness forms the foundational state that must be reached before a ZTA deployment is possible.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

These surveys can be conducted in parallel, but both are tied to examination of the business processes of the organization.

“These surveys can be conducted in parallel, but both are tied to examination of the business processes of the organization.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

After the initial inventory is created, there is a regular cycle of maintenance and updating.

“After the initial inventory is created, there is a regular cycle of maintenance and updating.”

Classified as probably not a substantial claim.

This baseline includes having assets, subjects, business processes, traffic flows and dependency mappings identified and cataloged for the enterprise.

“This baseline includes having assets, subjects, business processes, traffic flows and dependency mappings identified and cataloged for the enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This also includes configuration management and monitoring.

“This also includes configuration management and monitoring.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Machine learning tools could use ZTA data to improve detection.

“Information generated in a ZTA may better inform event impact quantification; machine learning tools could use ZTA data to improve detection; and additional logs from ZTA may be saved for after-thefact analyses by incident responders.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This corresponds with the cross-enterprise collaboration ZTA use case.

“This corresponds with the cross-enterprise collaboration ZTA use case (see Section 4.4).”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

ZTA should allow developers and administrators to have sufficient flexibility to satisfy their business requirements while using logs and audit actions to identify access behavior patterns.

“ZTA should allow developers and administrators to have sufficient flexibility to satisfy their business requirements while using logs and audit actions to identify access behavior patterns.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In many legacy security architectures, these accounts may have blanket permission to access all enterprise resources.

“In many legacy security architectures, these accounts may have blanket permission to access all enterprise resources.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There may be times when an organization is asked to fulfill a new responsibility that would require building its own infrastructure.

“However, there may be times when an organization is asked to fulfill a new responsibility that would require building its own infrastructure.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

An enterprise should reach a baseline of competence before it becomes possible to deploy a significant ZT-focused environment.

“An enterprise should reach a baseline of competence before it becomes possible to deploy a significant ZT-focused environment [ACT-IAC].”

• cites ACT-IACNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Users with special privileges, such as developers or system administrators, require additional scrutiny when being assigned attributes or roles.

“Users with special privileges, such as developers or system administrators, require additional scrutiny when being assigned attributes or roles.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

In practice, this is rarely a viable option for federal agencies or any organization with an existing network.

“In practice, this is rarely a viable option for federal agencies or any organization with an existing network.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This means that the enterprise must be able to configure, survey, and update enterprise assets, such as virtual assets and containers.

“This means that the enterprise must be able to configure, survey, and update enterprise assets, such as virtual assets and containers.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Migrating to ZTA requires an organization to have detailed knowledge of its assets (physical and virtual), subjects (including user privileges), and business processes.

“Migrating to ZTA requires an organization to have detailed knowledge of its assets (physical and virtual), subjects (including user privileges), and business processes.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

This updating may either change business processes or not have any impact, but an evaluation of business processes should be conducted.

“This updating may either change business processes or not have any impact, but an evaluation of business processes should be conducted.”

Probably not a substantial claim: may not pass S3 (load-bearing).

How an enterprise migrates to a strategy depends on its current cybersecurity posture and operations.

“How an enterprise migrates to a strategy depends on its current cybersecurity posture and operations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Solutions that require components installed on client assets may limit business processes where nonenterprise-owned assets are used or desired, such as BYOD or cross-agency collaborations.

“This may limit business processes where nonenterprise-owned assets are used or desired, such as BYOD or cross-agency collaborations.”

May combine two claims.

This adds an additional burden on vendors and consumers: vendors need to expend resources to change their products, and consumers need to apply updates to multiple products when one vendor makes a change to its proprietary API.

“This adds an additional burden on vendors and consumers: vendors need to expend resources to change their products, and consumers need to apply updates to multiple products when one vendor makes a change to its proprietary API.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

After the asset or workflow is identified, identify all upstream resources, downstream resources, and entities that are used or affected by the workflow.

“After the asset or workflow is identified, identify all upstream resources (e.g., ID management systems, databases, micro-services), downstream resources (e.g., logging, security monitoring), and entities (e.g., subjects, service accounts) that are used or affected by the workflow.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Studies on how users react to MFA and other security operations that are part of a ZTA enterprise could form the basis of predicting end user experience and behavior when using ZTA workflows in an enterprise.

“There have, however, been studies on how users react to MFA and other security operations that are part of a ZTA enterprise, and this work could form the basis of predicting end user experience and behavior when using ZTA workflows in an enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

This work would need to exist enterprise-or agency-wide before any business process could be (re)designed with a ZTA.

“This work would need to exist enterprise-or agency-wide before any business process could be (re)designed with a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Rather than project the enterprise perimeter into the cloud or bring clients into the enterprise network via a VPN, enterprise clients can request cloud services directly.

“Rather than project the enterprise perimeter into the cloud or bring clients into the enterprise network via a VPN, enterprise clients can request cloud services directly.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The enterprise's PEPs ensure that enterprise policies are followed before resource access is granted to a client.

“The enterprise's PEPs ensure that enterprise policies are followed before resource access is granted to a client.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Cloud Security Alliance (CSA) has produced a framework for Software Defined Perimeter (SDP) that may also be useful in ZTA.

“The Cloud Security Alliance (CSA) has produced a framework for Software Defined Perimeter (SDP) [2] that may also be useful in ZTA.”

• cites [2] 2. Anderson B, McGrew D (2017) Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non- Stationarity. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (ACM, Halifax, Nova Scotia, Canada), pp 1723-1732. https://doi.org/10.1145/3097983.3098163 sourceNot checked — no full text of the source

May combine two claims.

The problem with relying on proprietary APIs is that these APIs are proprietary and single-vendor controlled.

“The problem with this approach is that these APIs are proprietary and single-vendor controlled.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The tenets of ZTA aim to reduce the exposure of resources to attackers and minimize or prevent lateral movement within an enterprise should a host asset be compromised.

“The tenets of ZTA aim to reduce the exposure of resources to attackers and minimize or prevent lateral movement within an enterprise should a host asset be compromised.”

Probably not a substantial claim: may not pass S3 (load-bearing).

If a change occurs to the workflow, the operating ZT architecture needs to be reevaluated.

“However, if a change occurs to the workflow, the operating ZT architecture needs to be reevaluated.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Security fatigue is the phenomenon wherein end users are confronted with so many security policies and challenges that it begins to impact their productivity in a negative way.

“Security fatigue [3] is the phenomenon wherein end users are confronted with so many security policies and challenges that it begins to impact their productivity in a negative way.”

• cites [3] 3. Department of Defense CIO (2007). Department of Defense Global Information Grid Architecture Vision Version 1.0 June 2007. Available at http://www.acqnotes.com/Attachments/DoD%20GIG%20Architectural% 20Vision,%20June%2007.pdfNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

This requires close partnerships between communities of vendors to ensure early notification of modifications within APIs, which may affect compatibility between products.

“This requires close partnerships between communities of vendors to ensure early notification of modifications within APIs, which may affect compatibility between products.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

These programs must be designed to be expandable and adaptable to changes in the enterprise, not only when migrating to ZTA but also when accounting for new assets, services, and business processes that become part of the enterprise.

“These programs must be designed to be expandable and adaptable to changes in the enterprise, not only when migrating to ZTA but also when accounting for new assets, services, and business processes that become part of the enterprise.”

Classified as probably not a substantial claim.

The lack of large ZTA use cases available for analysis is the main reason there has not been a rigorous examination of end user behavior in ZTA.

“This is mainly due to the lack of large ZTA use cases available for analysis.”

May combine two claims.

The controlling vendor can change the API behavior, and integrators are required to update their products in response.

“The controlling vendor can change the API behavior, and integrators are required to update their products in response.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

An enterprise may wish to start with a low-risk business process for the first transition to ZTA as disruptions will likely not negatively impact the entire organization.

“An enterprise may wish to start with a low-risk business process for the first transition to ZTA as disruptions will likely not negatively impact the entire organization.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Agencies may also have a list of ZTA candidate processes that involve High Value Assets (HVA) that have been identified as key to the agency mission.

“Agencies may also have a list of ZTA candidate processes that involve High Value Assets (HVA) [M-19-03] that have been identified as key to the agency mission.”

• cites M-19-03Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A key component of ZT is the collection and use of data related to the process flow that feeds back into the PE when making access decisions.

“A key component of ZT is the collection and use of data related to the process flow that feeds back into the PE when making access decisions.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

There is an opportunity for a set of open, standardized protocols or frameworks to be developed to aid organizations in migrating to a ZTA.

“This indicates that there is an opportunity for a set of open, standardized protocols or frameworks to be developed to aid organizations in migrating to a ZTA.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

This information is not only used for access decisions (as collaborator and BYOD assets may need to contact PEPs) but also for monitoring and forensics logging by the enterprise.

“This information is not only used for access decisions (as collaborator and BYOD assets may need to contact PEPs) but also for monitoring and forensics logging by the enterprise.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

This also includes both its physical (as best estimated) and network location.

“This also includes both its physical (as best estimated) and network location.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The process of identifying a candidate service or business workflow depends on several factors: the importance of the process to the organization, the group of subjects affected, and the current state of resources used for the workflow.

“The process of identifying a candidate service or business workflow depends on several factors: the importance of the process to the organization, the group of subjects affected, and the current state of resources used for the workflow.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Most of the knowledge gaps arise from a lack of time and experience with mature zero trust deployments.

“These are gray areas in knowledge about operational ZTA environments, and most arise from a lack of time and experience with mature zero trust deployments.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

This may include whatever is visible by the enterprise (e.g., MAC address, network location) and augmented by administrator data entry.

“This may include whatever is visible by the enterprise (e.g., MAC address, network location) and augmented by administrator data entry.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Agencies that have established CDM program capabilities, such as HWAM and SWAM, have a rich set of data to draw from when enacting a ZTA.

“Agencies that have established CDM program capabilities, such as HWAM [HWAM] and Software Asset Management (SWAM) [SWAM], have a rich set of data to draw from when enacting a ZTA.”

• cites HWAMNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites SWAMNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Once enough experience is gained, more critical business processes can become candidates.

“Once enough experience is gained, more critical business processes can become candidates.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Systemic gaps could slow the adoption of ZTA in agencies or result in fragmentation of the ZTA component industry.

“These gaps could slow the adoption of ZTA in agencies or result in fragmentation of the ZTA component industry.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Operating the new ZT business workflow in reporting-only mode for some time allows the enterprise to gain an understanding of baseline asset and resource access requests, behavior, and communication patterns.

“This also allows the enterprise to gain an understanding of baseline asset and resource access requests, behavior, and communication patterns.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Many federal agencies have already begun identifying enterprise assets.

“Many federal agencies have already begun identifying enterprise assets.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Shadow IT presents a special problem in that these resources are enterprise-owned but not managed like other resources.

“Shadow IT presents a special problem in that these resources are enterprise-owned but not managed like other resources.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Significant changes to the system-such as new devices, major updates to software (especially ZT logical components), and shifts in organizational structure-may result in changes to the workflow or policies.

“Significate changes to the system-such as new devices, major updates to software (especially ZT logical components), and shifts in organizational structure-may result in changes to the workflow or policies.”

Probably not a substantial claim: may not pass S4 (based).

A properly implemented ZTA for an enterprise will improve the enterprise's cybersecurity posture over traditional network perimeter-based security.

“A properly implemented ZTA for an enterprise will improve the enterprise's cybersecurity posture over traditional network perimeter-based security.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The value of the asset or workflow based on risk to the asset or workflow can be evaluated using the NIST Risk Management Framework.

“The value of the asset or workflow based on risk to the asset or workflow can be evaluated using the NIST Risk Management Framework [SP800-37].”

• cites SP800-37Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Certain ZTA approaches (mainly network-based) may even cause shadow IT components to become unusable as they may not be known and included in network access policies.

“Certain ZTA approaches (mainly network-based) may even cause shadow IT components to become unusable as they may not be known and included in network access policies.”

Classified as probably not a substantial claim.

The perception that ZTA conflicts with existing federal cybersecurity policies is based on a misconception of ZTA and how it has evolved from previous cybersecurity paradigms.

“This gap is based on a misconception of ZTA and how it has evolved from previous cybersecurity paradigms.”