Augmenting Zero Trust Architecture to Endpoints Using Blockchain: A Systematic Review. (arXiv:2104.00460v2 [cs.CR] UPDATED)

With the purpose of defending against lateral movement in todays borderless
networks, Zero Trust Architecture (ZTA) adoption is gaining momentum.
Considering a full scale ZTA implementation, it is unlikely that adversaries
will be able to spread through the network starting from a compromised
endpoint. However, the already authenticated and authorised session of the
compromised endpoint can be leveraged to perform limited, though malicious
activities, ultimately rendering the endpoints the Achilles heel of ZTA. To
effectively detect such attacks, distributed collaborative intrusion detection
systems with attack scenario-based approach have been developed. Nonetheless,
Advanced Persistent Threats (APTs) have demonstrated their ability to bypass
this approach with high success ratio. As a result, adversaries can pass
undetected or potentially alter the detection logging mechanisms to achieve a
stealthy presence. Recently, blockchain technology has demonstrated solid use
cases in the cyber security domain. Motivated by the convergence of ZTA and
blockchain-based intrusion detection and prevention, in this paper, we examine
how ZTA can be augmented onto endpoints. Namely, we perform a systematic review
of ZTA models, real-world architectures with the focus on endpoints, and
blockchain-based intrusion detection systems. We discuss the potential of
blockchains immutability fortifying the detection process, and the identified
open challenges as well as the possible solutions and future directions.