Augmenting Zero Trust Architecture to Endpoints Using Blockchain: A Systematic Review

With the purpose of defending against lateral movement in todays borderless networks, Zero Trust Architecture (ZTA) adoption is gaining momentum. Considering a full scale ZTA implementation, it is unlikely that adversaries will be able to spread through the network starting from a compromised endpoint. However, the already authenticated and authorised session of the compromised endpoint can be leveraged to perform limited, though malicious activities, ultimately rendering the endpoints the Achilles heel of ZTA. To effectively detect such attacks, distributed collaborative intrusion detection systems with attack scenario-based approach have been developed. Nonetheless, Advanced Persistent Threats (APTs) have demonstrated their ability to bypass this approach with high success ratio. As a result, adversaries can pass undetected or potentially alter the detection logging mechanisms to achieve a stealthy presence. Recently, blockchain technology has demonstrated solid use cases in the cyber security domain. Motivated by the convergence of ZTA and blockchain-based intrusion detection and prevention, in this paper, we examine how ZTA can be augmented onto endpoints. Namely, we perform a systematic review of ZTA models, real-world architectures with the focus on endpoints, and blockchain-based intrusion detection systems. We discuss the potential of blockchains immutability fortifying the detection process, and the identified open challenges as well as the possible solutions and future directions.