## 4 Discussion and Open Issues  
In today's environment, traditional perimeter-based security does not work well, as demonstrated by the breaches that regularly take place and the revenue generating business that data breaches have become [84; 85]. Zero trust offers a viable alternative to address security by verifying the requestor of access before granting access to a resource. Zero trust has gained a lot of attention in the past few years and continues to gain attention. As with any other computing environment, the tenets of zero trust are applicable to smart environments. However, the nuances of smart environments should be factored in. One of the nuances is the presence of disparate devices in such environments. For example, a smart television offers a very different functionality to a smart boiler. Any physical damage caused to a smart television may not result in damage to a smart boiler. When the zero trust five-step implementation process is applied to smart devices, each device could be considered a protect surface, as a device owner would want to secure each one of them [86]. In the above example the smart homeowner would want to secure both devices, the smart television and the smart boiler. The communication between these devices is also limited, but due to the centralising administration and integrating devices for visibility, for example, the development of smart home automation systems like Alexa, Google home, etc., device-to-device communication between a smart device and hubs has gained in prevalence [87]. Communications between smart devices and home clouds and applications continue. This development brings into focus the other steps of the zero trust implementation process, namely, mapping transaction flows, creating zero trust policies, and monitoring and maintaining the network. Nonetheless, as this survey has uncovered, the current state of the art in both academia and industry seems to omit these interactions and their respective flows. Though research has been conducted to apply zero trust to smart homes and IoT, the whole paradigm of zero trust has not been investigated and focused on in the literature. For example, zero trust is not a technology or a tool or a standard or an architecture on its own [37]. Zero trust is a security strategy, which is described as a journey. Zero trust has its tenets in the form of pillars and cross-cutting capabilities [5; 7; 26] and it has its implementation process [7], which have not been considered in the past literature. Existing research mainly considers identities as a part of the zero trust tenets/pillars and uses zero trust architecture to address security issues with identities. Zero trust has other pillars like devices, data, application and workloads and network [7; 26]. Moreover, as discussed in Section 1 and summarised in Tables 2-7 and Tables 3-7, none of the surveyed papers researched the adoption of the zero trust five-step implementation process for smart environments. Researchers have studied the implementation of zero-trust architectures [12; 36; 39; 40; 41; 47; 48; 49; 50; 53; 55; 56; 57; 57]. The authors identified security issues with authentication and authorisation that were addressed with the zero trust principle of \"never trust, always verify\", which essentially addresses implicit trust. The zero trust architecture (PEP, PDP, PIP, PA and PE) as defined by NIST, was also used to address identified access control issues, lateral movement, intellectual property and misinformation. There is one paper that has studied the applicability of the definitions of the protect surface and mapping transaction flows [77]. Applying NIST 800-207's zero trust core architecture components (PDP, PEP, PA, etc.) is a good starting point. However, the past literature has not considered protect surfaces. In the absence of a defined protect surface, the studies may have applied zero trust architecture to devices that are not critical to the environment [86]. It is worth mentioning here that in theory there is a possibility that any threat may materialise.