Pith. sign in

REVIEW 5 major objections 6 minor 60 references

TrustZero -- open, verifiable and scalable zero-trust

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TrustZero proposes a trust token that turns server signatures into a global, verifiable trust score for users.

desk verdict A web-of-trust signature counter with a ModSecurity demo; the trust score has no defined issuance policy and the paper's own load test contradicts its scalability claims. read the letter →

arxiv 2502.10281 v2 pith:5ZWXL3AJ submitted 2025-02-14 cs.CR cs.NI

Adrian-Tudor Dumitrescu , Johan Pouwelse This is my paper · ORCID
classification cs.CRcs.NI
keywords zerotrustarchitecturetokenwebofdigitalsignaturesself-sovereignidentityModSecurityscoredecentralizedauthentication
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TrustZero argues that zero-trust security can be made portable and global by encoding a user's reputation as a non-revocable self-sovereign identity: a public key signed by every server the user has interacted with. The central claim is that a trust score equal to the number of valid signatures on that key gives a mathematically grounded, verifiable trust attestation that any server can check with public-key operations alone. Because the token travels in an HTTP header and is validated by a reverse-proxy firewall before requests reach the server, the scheme promises to upgrade legacy systems and cross-organizational communication without rewriting server code. The paper backs this with an open-source proof of concept and latency measurements showing small overhead for normal traffic, though sustained flooding degrades response times sharply.

What carries the argument

The load-bearing object is the trust token: an ordered list of signatures $\text{sign}_{S_1} \| \ldots \| \text{sign}_{S_N}$, each a signature by server $S_i$ over the user's public key $pk_U$. A user's trust score is computed as $\sum_i V_f(\text{sign}_{S_i}, pk_{S_i}, pk_U)$, where $V_f$ is a signature-verification function returning 1 for a valid signature and 0 otherwise. The token is carried in the `User-Key-Signatures` HTTP header and checked by ModSecurity, acting as a policy enforcement point in reverse-proxy mode, before the request reaches the server. The protocol's two-step server behaviour—verify all existing signatures, then append one of its own—is what lets trust accumulate across independent servers without a central authority.

What would settle it

Run a Sybil test: spin up a handful of colluding server instances, have a brand-new identity collect valid signatures from all of them within minutes, and check whether that identity is then granted access to a resource reserved for long-standing trusted users; if the score cannot distinguish the colluding identity from a genuinely vetted one, the central claim fails.

Watch

Extended reading notes

Core claim

The paper's discovery claim is that trust can be relocated from organizations to a portable token. TrustZero defines a trust token as a concatenation of digital signatures, one per server that has vouched for the user's public key, and defines the user's trust score as the number of those signatures that verify against the issuing servers' public keys. Servers issue a signature in exchange for a request they deem good and are expected to verify all prior signatures before adding their own, so the token accumulates and carries a verifiable interaction history. This turns a web of servers into a decentralized attestation layer: any participant can recompute the score from public information, and a WAF positioned as a reverse proxy can deny requests with invalid or insufficient tokens before they reach the application. The authors present this as an open-source, reproducible alternative to closed zero-trust deployments such as Google's BeyondCorp.

Load-bearing premise

The protocol assumes that a server's signature on a user's public key is a meaningful attestation of good behavior, but it never defines what makes a request 'good' or shows that the number of signatures correlates with trustworthiness; if servers sign indiscriminately, the score reflects only the willingness to sign.

Editorial extensions

If this is right

  • Any server, without a central authority, can compute a user's trust score from public keys and signatures before granting access.
  • Legacy applications can gain zero-trust checking by inserting the token header and a reverse-proxy rule, leaving the application code untouched.
  • Because reputation is tied to accumulated signatures from distinct servers, building a useful identity takes time and many independent interactions, which raises the cost of Sybil identities.
  • A server can withdraw a user's reputation by refusing to renew signatures or by rotating its key pair, making the system revocable in practice even though the identity itself is non-revocable.
  • The measured latency of a request grows from roughly 0.08 seconds at 200 concurrent users to tens of seconds beyond 1800 users, so the current verification path, not the application, becomes the bottleneck under flooding.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If TrustZero were deployed with the 'good request' criterion left to each server, the trust score would measure a server's willingness to sign rather than the user's actual behavior; a standard for vetting would be needed before the score can be read as a reputation.
  • The architecture could be extended so that organizations, rather than individual servers, act as signing authorities, effectively creating a decentralized public-key infrastructure where the token becomes a passport-level identity for cross-border or cross-organization access.
  • A natural test of the model is to compare TrustZero scores against observed rates of abuse (fraud, spam, policy violations) in a real deployment; the paper does not report such a comparison, but the model's value depends on the correlation holding.
  • The token's linear size growth with each signature could be bounded by capping the number of signatures while letting servers prioritize the most reputable issuers, preserving portability without unbounded headers.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. TrustZero proposes a zero-trust security layer built around a self-sovereign "trust token": a public key with a list of signatures from servers that the user has interacted with. The trust score in Equation (2) counts the number of valid signatures on the user's public key. The paper describes a protocol in which servers verify prior signatures and issue their own, a ModSecurity-based proof-of-concept implementation, latency experiments comparing users with zero and five signatures, a simulated DDoS experiment with up to 2000 concurrent users, and an Android integration app. The abstract and conclusion claim that the framework is a secure, scalable web-of-trust, with minimal latency and practical applicability under denial-of-service conditions.

Significance. If the trust model were sound, the paper would provide a useful open-source reference point for transparent, verifiable zero-trust systems. The authors do ship open-source code, use simple cryptographic primitives, and report reproducible experiments, which is a positive step for a field where detailed public implementations are rare. However, the central security claim is not established: the trust score's semantics are undefined, the evaluation never exercises the score, and the reported DDoS experiment contradicts the scalability claim. These are foundational gaps rather than presentation issues, so the current manuscript does not meet the bar for publication in its present form.

major comments (5)
  1. [Section IV-A / IV-B / Eq. (2)] This is not a cosmetic issue: the abstract, introduction, and conclusion all present the trust score as the mechanism that improves security, yet the score's semantics are not specified and no experiment measures whether the score correlates with honest behavior.
  2. [Section VI, Figure 9] Additionally, the experiment floods the servers from the same host that runs the servers, so the measured latency may be dominated by resource contention rather than by the TrustZero protocol; either way, the data do not support the claimed resilience.
  3. [Section IV-B] If revocation is intended, the authors should explain how it coexists with the non-revocable self-sovereign identity claim; if revocation is not intended, the conflicting text must be corrected.
  4. [Section VI, Figure 5] To support the web-of-trust claim, the paper would need to define an issuance policy and then test whether the score distinguishes honest from dishonest behavior under that policy.
  5. [Section IV-A / IV-C] At a minimum, the authors should specify what prevents an attacker from obtaining many signatures from colluding or compromised servers and explain how the score is meaningful when issuers are heterogeneous.
minor comments (6)
  1. [Abstract / Section II] Please clarify which eIDAS or other assurance level is claimed and how the implementation meets it.
  2. [Section VI] Please report the setup per experiment or explain why the choice does not affect the conclusions.
  3. [Section VI] Additionally, "asses the trust score" should be "assess the trust score".
  4. [Figure 7] Adding labels would improve readability.
  5. [References] Please provide full bibliographic information, including authors and publication venue where available.
  6. [Section VI] A short discussion of the trade-off between token size and verification cost would strengthen the analysis.

Circularity Check

2 steps flagged · score 6.0 of 10

Trust score Eq. (2) is defined as the count of valid signatures, so the experiment labeling signature-valid users 'genuine' and signature-corrupting users 'abnormal' validates the definition rather than any independent trust property.

  1. self definitional [Section IV-C, Eq. (2)]
    "The trust algorithm implemented in TrustZero is score-based, evaluating the trustworthiness of entities and assigning a numerical score that reflects their reliability. The value is computed by verifying the number of valid signatures a user has on its public key. ... trustscore = Vf(signS1, pkS1, pkU) + Vf(signS2, pkS2, pkU) + ..."

    Trustworthiness is never defined independently of the score. Eq. (2) defines the trust score as the number of signatures that pass the cryptographic check Vf. Therefore 'trustworthy' and 'has valid signatures' are the same predicate by construction. The abstract's 'mathematically grounded trust attestations' restates this counting rule rather than deriving a security property. The issuance condition is left undefined ('in exchange for a good request'), so the score carries no independent semantics beyond verifiability.

  2. self definitional [Section VI, first experiment (Fig. 5)]
    "In the second half of the figure, a genuine user is building the maximum trust over time(5) and, even though having a higher average latency, does not encounter a high variability in times and better predictability. In contrast, once a user behaves abnormally, like in the first half of the plot, and sends corrupted signatures he loses his reputation and access to the resources."

    By Eq. (2), a corrupted signature contributes Vf = 0 automatically. So the observed outcome that the 'genuine' user has max trust and the 'abnormal' user loses reputation is forced by the definition of the score, not by an empirical measure of good or bad behavior. The experiment demonstrates that signature verification works; it does not demonstrate that the trust score tracks trustworthiness. The conclusion's claim that experiments 'validated the efficiency of the trust scoring mechanism' is therefore only about latency and rule processing, not about the semantic content of the score.

full rationale

The paper contains no load-bearing self-citation chain: the only project-owned artifact cited is the GitHub repository, and no uniqueness theorem or externally imported result is used to force the design. The central circularity is definitional. Eq. (2) equates trust with the number of passing signature checks, and no independent definition of trustworthiness is provided; servers issue signatures 'in exchange for a good request', but 'good' is never specified. Consequently, the claim that the token provides 'robust, mathematically grounded trust attestations' is a restatement of the counting rule. The experimental section makes this explicit: the 'genuine' user is one whose signatures verify and the 'abnormal' user is one whose signatures are corrupted, so the score difference is guaranteed by Vf. The paper also concedes 'the usage of the score is not implemented in this POC', meaning the experiments measure latency and rule processing rather than the security effect of the score; this is a validation gap, not itself a circularity, but it removes independent evidence that could have broken the definitional loop. The latency and DDoS measurements are independent and non-circular. Separately, the token is called non-revocable in the Abstract and Section IV-B yet is said to be revocable after abnormal access in the same section; that is an internal inconsistency, not a circular step, so it does not change the score. Overall: partial circularity, score 6.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No free parameters are fitted; the central measure is the count of valid signatures, which is not calibrated against any external ground truth. The main axioms are the undefined "good" request policy, the assumption that signature count equals trust, and the assumption that a self-issued key is passport-grade identity. The experiments additionally assume a single-host container setup represents a distributed network.

assumptions (5)
  • domain assumption Servers issue signatures only after "good" requests, where "good" is undefined.
    Section IV-A: "In exchange for a good request, the server will issue a new trust token". Without a definition, the score has no semantic content.
  • domain assumption The number of valid signatures is a valid measure of trustworthiness.
    Section IV-C, Eq. 2 defines trustscore as the count of valid signatures; no independent validation of this proxy is provided.
  • ad hoc to paper Self-sovereign public keys can serve as passport-grade identity without binding to legal identity.
    Abstract and Section II claim passport-level trust; however the token is a self-issued key pair with no proof-of-identity, and eIDAS integration is only mentioned, not implemented.
  • standard math Cryptographic signatures are unforgeable.
    Section IV-A relies on standard digital signatures; this is a standard cryptographic assumption.
  • domain assumption All experiments run on a single host are representative of distributed network behavior.
    Section VI: servers and users are containers/threads on one machine, so network effects and attack patterns are not modeled.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TrustZero -- open, verifiable and scalable zero-trust." pith.science (2026). https://pith.science/paper/5ZWXL3AJ

@misc{pith2026250210281,
  author       = {Pith},
  title        = {Pith review of: TrustZero -- open, verifiable and scalable zero-trust},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5ZWXL3AJ}},
  note         = {Machine review of arXiv:2502.10281}
}
read the original abstract

We present a passport-level trust token for Europe. In an era of escalating cyber threats fueled by global competition in economic, military, and technological domains, traditional security models are proving inadequate. The rise of advanced attacks exploiting zero-day vulnerabilities, supply chain infiltration, and system interdependencies underscores the need for a paradigm shift in cybersecurity. Zero Trust Architecture (ZTA) emerges as a transformative framework that replaces implicit trust with continuous verification of identity and granular access control. This thesis introduces TrustZero, a scalable layer of zero-trust security built around a universal "trust token" - a non-revocable self-sovereign identity with cryptographic signatures to enable robust, mathematically grounded trust attestations. By integrating ZTA principles with cryptography, TrustZero establishes a secure web-of-trust framework adaptable to legacy systems and inter-organisational communication.

Figures

Figures reproduced from arXiv: 2502.10281 by the authors.

Figure 1
Figure 1. EUDI wallet [40] and integrity of digital identities in real-time. This means that identity is treated as the new perimeter, and digital identity verification becomes a cornerstone of security. ZTA helps ensure that only authenticated and authorized users or devices, with minimal privileges, can access critical resources, key requirements to provide passport-grade identity. TrustZero was developed to adhere to these… view at source ↗
Figure 2
Figure 2. TrustZero architecture overview rating with the PEP is the Policy Administrator (PA), which is responsible for granting or denying access based on the PEP’s assessments. Finally, the Policy Engine (PE) functions as the “brain” of the system, making access decisions by applying a trust algorithm to external inputs, in alignment with the organization’s security policies [53]. In a digital identity-focused system, the … view at source ↗
Figure 2
Figure 2. A. Protocol The TrustZero Protocol exemplifies a decentralized ap￾proach to secure trust verification in multi-party systems, ad￾dressing critical challenges in integrity and authenticity. In this protocol, a user generates a public/private keys ((pku ,sku ) ← KGen) and sequentially interacts with multiple servers, each generating its own pair ((pksn,sksn) ← KGen). The user initiates communication by sending message… view at source ↗
Figures from the paper (8 more)
Figure 3
Figure 3. Figure 3: POST Request example 0 20 40 60 80 100 Number of Signatures 0 5000 10000 15000 20000 25000 Total Size (bytes) RSA (2048 bits) ECDSA (P-256) EdDSA (Ed25519) [PITH_FULL_IMAGE:figures/full_fig_p008_3.png]
Figure 4
Figure 4. Figure 4: Signatures size from users deployed alongside a ModSecurity instance acting as a reverse proxy for it. An example of POST request that was used in the experiments against the deployed server is presented in [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 6
Figure 6. Figure 6: Signature latency calculated up to 100 signatures, is presented in [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Box plot signatures latency are created in the same computer(including servers), the CPU and memory usage might influence the request time as more users flood the network. The test measurements were split after every 200 users were added and 3 phases can be identified:…
Figure 8
Figure 8. Figure 8: Latency of 9 Android users 0 200 400 600 800 1000 User request id 0 5 10 15 20 25 30 35 Time (seconds) Request Time (s) Overall Mean: 3.625789816140788 Moving average Latency at 200 users: 0.07836716273912157 Latency at 400 users: 0.6234673092054391 Latency at 600 user…
Figure 9
Figure 9. Figure 9: Latency with up to 2000 users VII. CONCLUSION In an increasingly interconnected and volatile digital landscape, Zero Trust Architecture (ZTA) represents a vi￾tal paradigm shift in cybersecurity. This thesis introduced TrustZero, a scalable zero-trust security framework…
Figure 10
Figure 10. Figure 10: Android app for TrustZero integration [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Android TrustZero experiment 12 [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 59 canonical work pages

  1. [1]

    https://ec.europa.eu/ commission/presscorner/detail/en/ip 24 6243

    Commission, online platforms and civil society increase monitor- ing during Romanian elections — ec.europa.eu. https://ec.europa.eu/ commission/presscorner/detail/en/ip 24 6243. [Accessed 10-12-2024]

    work page 2024

  2. [2]

    https://ec.europa.eu/ commission/presscorner/detail/en/ip 24 6487

    Commission opens formal proceedings against TikTok on election risks under the Digital Services Act — ec.europa.eu. https://ec.europa.eu/ commission/presscorner/detail/en/ip 24 6487. [Accessed 17-12-2024]

    work page 2024

  3. [3]

    https://openziti

    Hardware Security Modules — OpenZiti — openziti.io. https://openziti. io/docs/guides/hsm/#enabling-a-ziti-endpoint-using-an-hsm. [Accessed 04-10-2024]

    work page 2024

  4. [4]

    https://www.audi.com/en/sustainability/people-society/ responsibility-in-the-supply-chain.html

    Responsibility in the supply chain — audi.com — audi.com. https://www.audi.com/en/sustainability/people-society/ responsibility-in-the-supply-chain.html. [Accessed 01-12-2024]

    work page 2024

  5. [5]

    https://www.asml.com/ en/company/sustainability/responsible-supply-chain

    Responsible supply chain - Working with our suppliers to become a sustainable leader in our industry — asml.com. https://www.asml.com/ en/company/sustainability/responsible-supply-chain. [Accessed 12-10- 2024]

    work page 2024

  6. [6]

    https://www.politico.eu/article/romanias-presidential-frontrunner- benefited-from-russia-style-booster-campaign-declassified-docs-say/

    Romania’s presidential front-runner Georgescu benefited from Russia-style booster campaign, declassified docs say — politico.eu. https://www.politico.eu/article/romanias-presidential-frontrunner- benefited-from-russia-style-booster-campaign-declassified-docs-say/. [Accessed 16-12-2024]

    work page 2024

  7. [7]

    https://github.com/AdiDumi/TrustZero

    Trustzero. https://github.com/AdiDumi/TrustZero

    work page

  8. [8]

    https://openziti.io/docs/ learn/introduction/

    What is OpenZiti? — OpenZiti — openziti.io. https://openziti.io/docs/ learn/introduction/. [Accessed 04-10-2024]

    work page 2024

Show all 60 references
  1. [9]

    Advancing macroprudential tools for cyber resilience – Operational policy tools

    European Systemic Risk Board. Advancing macroprudential tools for cyber resilience – Operational policy tools . European Systemic Risk Board, 2024

    2024

  2. [10]

    Tiber-nl programme, 2016

    AFM. Tiber-nl programme, 2016

    2016

  3. [11]

    Sql injection and cross site scripting prevention using owasp modsecurity web application firewall

    Memen Akbar, Muhammad Arif Fadhly Ridha, et al. Sql injection and cross site scripting prevention using owasp modsecurity web application firewall. JOIV: International Journal on Informatics Visualization , 2(4):286–292, 2018

    2018

  4. [12]

    Kulkarni, Noor Ahmad Hazari, and Mo- hammed Y

    Faris Alsulami, Akshay R. Kulkarni, Noor Ahmad Hazari, and Mo- hammed Y . Niamat. Zebra: Zero trust architecture employing blockchain technology and ropuf for ami security. IEEE Access, 12:119868–119883, 2024

    2024

  5. [13]

    Fraud, plot, or collective delusion? social media and perceptions of electoral misconduct in the 2014 scottish independence referendum

    Sarah Birch and Fatma ElSafoury. Fraud, plot, or collective delusion? social media and perceptions of electoral misconduct in the 2014 scottish independence referendum. Election Law Journal, 16(4):470–484, 2017

    2014

  6. [14]

    A security awareness and protection system for 5g smart healthcare based on zero- trust architecture

    Baozhan Chen, Siyuan Qiao, Jie Zhao, Dongqing Liu, Xiaobing Shi, Minzhao Lyu, Haotian Chen, Huimin Lu, and Yunkai Zhai. A security awareness and protection system for 5g smart healthcare based on zero- trust architecture. IEEE internet of things journal , 8(13):10248–10263, 2020

    2020

  7. [15]

    Cyberattacks and threats during covid-19: A systematic literature review

    Joel Chigada and Rujeko Madzinga. Cyberattacks and threats during covid-19: A systematic literature review. South African Journal of Information Management, 23(1):1–11, 2021

    2021

  8. [16]

    Vulnerabilities and limitations of mqtt protocol used between iot devices

    Dan Dinculean ˘a and Xiaochun Cheng. Vulnerabilities and limitations of mqtt protocol used between iot devices. Applied Sciences, 9(5):848, 2019

    2019

  9. [17]

    Beyondcorp: The user experience

    Victor Escobedo, Betsy Beyer, Max Saltonstall, and Filip Zyzniewski. Beyondcorp: The user experience. Login, 42(3):38–43, 2017

    2017

  10. [18]

    Tiber-eu framework, 2018

    European Central Bank. Tiber-eu framework, 2018

    2018

  11. [19]

    A web traffic analysis attack using only timing information

    Saman Feghhi and Douglas J Leith. A web traffic analysis attack using only timing information. IEEE Transactions on Information Forensics and Security, 11(8):1747–1759, 2016

    2016

  12. [20]

    Survivable zero trust for cloud computing environments

    Luca Ferretti, Federico Magnanini, Mauro Andreolini, and Michele Colajanni. Survivable zero trust for cloud computing environments. Computers & Security , 110:102419, 2021

    2021

  13. [21]

    Anarchy or regulation: Controlling the global trade in zero-day vulnerabilities

    Mailyn Fidler. Anarchy or regulation: Controlling the global trade in zero-day vulnerabilities. PhD diss., Freeman Spogli Institute for International Studies, Stanford University , 2014

    2014

  14. [22]

    M2m protocols for constrained environments in the context of iot: A comparison of approaches

    Edielson P Frigieri, Daniel Mazzer, and LFCG Parreira. M2m protocols for constrained environments in the context of iot: A comparison of approaches. In International Telecommunications Symposium , page 5. sn, 2015

    2015

  15. [23]

    Zero trust in zero trust

    Virgil D Gligor. Zero trust in zero trust. Technical report, CMU CyLab Technical Report 22–002 December 17, 2022

    2022

  16. [24]

    Beyond- corp and the long tail of zero trust

    Guilherme Gonc ¸alves, Kyle O’Malley, Max Saltonstall, et al. Beyond- corp and the long tail of zero trust. 2023

    2023

  17. [25]

    An intelligent zero trust secure framework for software defined networking

    Xian Guo, Hongbo Xian, Tao Feng, Yongbo Jiang, Di Zhang, and Junli Fang. An intelligent zero trust secure framework for software defined networking. PeerJ Computer Science, 9:e1674, 2023

    2023

  18. [26]

    A survey on zero trust architecture: Challenges and future trends

    Yuanhang He, Daochao Huang, Lei Chen, Yi Ni, and Xiangjie Ma. A survey on zero trust architecture: Challenges and future trends. Wireless Communications and Mobile Computing , 2022(1):6476274, 2022

    2022

  19. [27]

    The race to the vulnerable: Measuring the log4j shell incident

    Raphael Hiesgen, Marcin Nawrocki, Thomas C Schmidt, and Matthias W¨ahlisch. The race to the vulnerable: Measuring the log4j shell incident. arXiv preprint arXiv:2205.02544 , 2022

    2022 arXiv

  20. [28]

    Framework for web application vulnerability discovery and mitigation by customizing rules through modsecurity

    Trapti Jain and Nakul Jain. Framework for web application vulnerability discovery and mitigation by customizing rules through modsecurity. In 2019 6th International Conference on Signal Processing and Integrated Networks (SPIN), pages 643–648, 2019

    2019

  21. [29]

    An analysis on the revoking mechanisms for json web tokens

    L ´aszl´o Viktor J´anoky, J´anos Levendovszky, and P´eter Ekler. An analysis on the revoking mechanisms for json web tokens. International Journal of Distributed Sensor Networks , 14(9):1550147718801535, 2018

    2018

  22. [30]

    Privatized espionage: Nso group technologies and its pegasus spyware

    Sean D Kaster and Prescott C Ensign. Privatized espionage: Nso group technologies and its pegasus spyware. Thunderbird International Business Review, 65(3):355–364, 2023

    2023

  23. [31]

    Automated ddos mitigation based on known attacks using a web application firewall

    Julik S Keijer. Automated ddos mitigation based on known attacks using a web application firewall. B.S. thesis, University of Twente, 2019

    2019

  24. [32]

    Build security into your network’s dna: The zero trust network architecture

    John Kindervag et al. Build security into your network’s dna: The zero trust network architecture. Forrester Research Inc, 27:1–16, 2010

    2010

  25. [33]

    Experimental studies of the features of using waf to protect internal services in the zero trust structure

    V Lakhno, A Blozva, D Kasatkin, V Chubaievskyi, Y Shestak, D Tyshchenko, and R Brzhanov. Experimental studies of the features of using waf to protect internal services in the zero trust structure. J Theor Appl Inf Technol , 100(3):705–721, 2022

    2022

  26. [34]

    Privacy and security usable security: how to get it

    Butler Lampson. Privacy and security usable security: how to get it. Communications of the ACM , 52(11):25–27, 2009

    2009

  27. [35]

    Trustguard: A flow-level reputation-based ddos defense system

    Haiqin Liu, Yan Sun, Victor C Valgenti, and Min Sik Kim. Trustguard: A flow-level reputation-based ddos defense system. In 2011 IEEE Consumer Communications and Networking Conference (CCNC) , pages 287–291. IEEE, 2011

    2011

  28. [36]

    Analysis of lightweight feature vectors for attack detection in network traffic

    Fares Meghdouri, Tanja Zseby, and F ´elix Iglesias. Analysis of lightweight feature vectors for attack detection in network traffic. Applied Sciences, 8(11):2196, 2018

    2018

  29. [37]

    Tariq Banday

    Saima Mehraj and M. Tariq Banday. Establishing a zero trust strategy in cloud computing environment. In 2020 International Conference on Computer Communication and Informatics (ICCCI) , pages 1–6, 2020

    2020

  30. [38]

    The crowdstrike incident: Analysis and unveiling the in- tricacies of modern cybersecurity breaches

    Iqra Naseer. The crowdstrike incident: Analysis and unveiling the in- tricacies of modern cybersecurity breaches. World Journal of Advanced Engineering Technology and Sciences , 10, 2024. 11

    2024

  31. [39]

    Chapter 4 - network traffic analysis with python

    TJ O’Connor. Chapter 4 - network traffic analysis with python. In TJ O’Connor, editor, Violent Python, pages 125–169. Syngress, 2013

    2013

  32. [40]

    Eu- ropean digital identity

    GitHub Organization of the European Digital Identity project. Eu- ropean digital identity. https://github.com/eu-digital-identity-wallet/ eudi-app-android-wallet-ui, 2024

    2024

  33. [41]

    The shaky foundation of global technology: A case study of the 2024 crowdstrike outage

    Olugbenro Ogundipe and Tejiri Aweto. The shaky foundation of global technology: A case study of the 2024 crowdstrike outage. 2024

    2024

  34. [42]

    Migrating to beyondcorp: maintaining productivity while improving security

    Jeff Peck, Betsy Beyer, Colin Beske, and Max Saltonstall. Migrating to beyondcorp: maintaining productivity while improving security. Login, 42(2):1–7, 2017

    2017

  35. [43]

    Cybersecurity in europe: Cooperation and in- vestment

    Pythagoras Petratos. Cybersecurity in europe: Cooperation and in- vestment. Cyber-Development, Cyber-Democracy and Cyber-Defense: Challenges, Opportunities and Implications for Theory, Policy and Practice, pages 279–301, 2014

    2014

  36. [44]

    Communication compression for byzantine robust learning: New efficient algorithms and improved rates

    Ahmad Rammal, Kaja Gruntkowska, Nikita Fedin, Eduard Gorbunov, and Peter Richt ´arik. Communication compression for byzantine robust learning: New efficient algorithms and improved rates. In International Conference on Artificial Intelligence and Statistics , pages 1207–1215. ...

    2024

  37. [45]

    Modsecurity handbook

    Ivan Ristic. Modsecurity handbook. Feisty Duck, 2010

    2010

  38. [46]

    Cyber officials: Chinese hackers attack ‘anything and everything,’

    Josh Rogin. Cyber officials: Chinese hackers attack ‘anything and everything,’. FCW. com, February, 13:97658–1, 2007

    2007

  39. [47]

    Zero-trust hierarchical manage- ment in iot

    Mayra Samaniego and Ralph Deters. Zero-trust hierarchical manage- ment in iot. In 2018 IEEE International Congress on Internet of Things (ICIOT), pages 88–95, 2018

    2018

  40. [48]

    The security council

    Sebastian Santoni. The security council

  41. [49]

    Schneider

    Fred B. Schneider. Beyond hacking: an sos! In 2010 ACM/IEEE 32nd International Conference on Software Engineering , volume 1, pages 2– 2, 2010

    2010

  42. [50]

    Zero trust: The what, how, why, and when

    Malcolm Shore, Sherali Zeadally, and Astha Keshariya. Zero trust: The what, how, why, and when. Computer, 54(11):26–35, 2021

    2021

  43. [51]

    Impact of paranoia levels on the effectiveness of the modsecurity web application firewall

    Jatesh Jagraj Singh, Hamman Samuel, and Pavol Zavarsky. Impact of paranoia levels on the effectiveness of the modsecurity web application firewall. In 2018 1st International Conference on Data Intelligence and Security (ICDIS), pages 141–144. IEEE, 2018

    2018

  44. [52]

    Trustguard: countering vulnerabilities in reputation management for decentralized overlay net- works

    Mudhakar Srivatsa, Li Xiong, and Ling Liu. Trustguard: countering vulnerabilities in reputation management for decentralized overlay net- works. In Proceedings of the 14th international conference on World Wide Web, pages 422–431, 2005

    2005

  45. [53]

    Zero trust architecture

    V Stafford. Zero trust architecture. NIST special publication , 800:207, 2020

    2020

  46. [54]

    Shah, Arash Shaghaghi, Adnan Anwar, Zubair Baig, and Robin Doss

    Naeem Firdous Syed, Syed W. Shah, Arash Shaghaghi, Adnan Anwar, Zubair Baig, and Robin Doss. Zero trust architecture (zta): A compre- hensive survey. IEEE Access, 10:57143–57179, 2022

    2022

  47. [55]

    Migrating to zero trust architecture: Reviews and challenges

    Songpon Teerakanok, Tetsutaro Uehara, and Atsuo Inomata. Migrating to zero trust architecture: Reviews and challenges. Security and Communication Networks, 2021(1):9947347, 2021

    2021

  48. [56]

    Discriminating ddos attack traffic from flash crowd through packet arrival patterns

    Theerasak Thapngam, Shui Yu, Wanlei Zhou, and Gleb Beliakov. Discriminating ddos attack traffic from flash crowd through packet arrival patterns. In 2011 IEEE conference on computer communications workshops (INFOCOM WKSHPS) , pages 952–957. IEEE, 2011

    2011

  49. [57]

    Access control policy enforcement for zero-trust-networking

    Romans Vanickis, Paul Jacob, Sohelia Dehghanzadeh, and Brian Lee. Access control policy enforcement for zero-trust-networking. In 2018 29th Irish Signals and Systems Conference (ISSC) , pages 1–6. IEEE, 2018

    2018

  50. [58]

    Beyondcorp: A new approach to enterprise security

    Rory Ward and Betsy Beyer. Beyondcorp: A new approach to enterprise security. ; login:: the magazine of USENIX & SAGE , 39(6):6–11, 2014

    2014

  51. [59]

    Dynamic access control and authorization system based on zero-trust architecture

    Qigui Yao, Qi Wang, Xiaojian Zhang, and Jiaxuan Fei. Dynamic access control and authorization system based on zero-trust architecture. In Proceedings of the 2020 1st international conference on control, robotics and intelligent system , pages 123–127, 2020

    2020

  52. [60]

    Flexible zero trust architecture for the cybersecurity of industrial iot infrastructures

    Claudio Zanasi, Silvio Russo, and Michele Colajanni. Flexible zero trust architecture for the cybersecurity of industrial iot infrastructures. Ad Hoc Networks , 156:103414, 2024. APPENDIX A FIRST APPENDIX Fig. 10: Android app for TrustZero integration Fig. 11: Android TrustZer...

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.