## 6 Lab-Built Scenario and Benchmarking
### Quantitative Benchmarking Results
#### 6.3.2 User Interaction with AZTRM-D Implemented System
Each of these final steps is also carefully logged, maintaining a complete and auditable trail of the entire life cycle from development to deployment. This workflow fundamentally enforces a \"secure by default\" approach, preventing insecure code or configurations from entering the system and ensuring accountability at every stage. Figure 11 details the Multi-layered User Authentication and Session Management Flow for accessing a device-hosted server under AZTRM-D's strict Zero Trust policies. This diagram visually demonstrates how every user access attempt is subjected to continuous verification and risk assessment, moving far beyond traditional single-factor authentication and reinforcing the \"never trust, always verify\" principle. The process begins when a user attempts to connect from an 'Assigned Computer', an action immediately 'Audit Logged' to establish a comprehensive and immutable audit trail from the outset. Before proceeding with authentication, the system rigorously checks the 'Account Status'. If an 'Account is Inactive for 10 days', it is automatically 'Suspended', and this event is logged. If this inactivity extends to 30 days, the 'Account is Purged' entirely, with a corresponding audit log, preventing dormant accounts from becoming attack vectors. A 'Suspended' account requires explicit 'Admin Approval' or, in some cases, 'Super Admin Approval' for restoration, ensuring these actions are verified and not unilateral. Assuming the account is active and not suspended, the login sequence commences with a crucial physical security check: ensuring the 'Assigned USB Security Key' is connected during the connection attempt. If the 'Security Key USB' is not connected, the login attempt is logged as \"Audit Logged (attempt to login)\" and the 'Account is Suspended', providing an immediate deterrent and control point. If the key is present, this is logged, and the process moves to cryptographic identity validation. The system then verifies the 'SSH Key'. If 'SSH Key Attempts have Exceeded 3 tries', the account is immediately suspended and logged, providing brute-force protection. An 'Incorrect SSH Key' is logged and counts towards this attempt limit. A 'Correct SSH Key' allows the process to continue after logging. A similar procedure applies to the SSH key'spassphrase: if 'SSH Phrase Attempts Exceeded 3 tries', the account is suspended. An 'Incorrect Entered SSH Passphrase' is logged and counts towards this limit, while a correct one, after logging, permits further progress. Next, multi-stage password authentication is performed. Exceeding '3 Password Attempts' results in immediate 'Account Suspension'. An 'Incorrect Password' entry is logged. If the 'Entered Password is Correct', it's logged, and the system then checks for password freshness. If 'Seven Days have passed since last password change', this is logged, and the user is 'Prompted to select one of the provided new passwords within 30 s'. Failure by the 'Developer to pick new password within 30 s' leads to immediate 'Account Suspension', enforcing strong password hygiene. Successfully changing the password is logged. If seven days have not passed, this check is bypassed after logging, and the flow advances to 'Two-Factor Authentication (2 FA)'. For 2 FA, if '2 FA Attempts have Exceeded 3 tries', the account is suspended. An 'Incorrect 2 FA Password' entry is logged. Only if the '2 FA Password entered is Correctly verified' is this successful step logged. Upon successful completion of all these stringent authentication stages, the user has 'Successfully accessed Assigned Developer Git', and this access is immediately logged. The session is then continuously monitored; if the 'Session time Exceeded 60 min', the session is automatically 'Terminated', with all relevant actions logged. This comprehensive flow ensures that access is not only multi-layered, strictly controlled, and thoroughly audited from initiation to termination but also dynamically adapts to user behavior and time constraints, embodying the core principles of Zero Trust.