## 2 Background
### Related Work
They discuss the essential characteristics of IoT, the architectural layers (applications, network and perceptions) and attacks against the layers. The authors discuss IoT issues like the lack of standardisation, network issues, scalability, availability and reliability, including security and privacy. They present a comparative study of vulnerable IoT devices. As current research trends, the authors discuss a potential solution using blockchain to implement zero trust tenets to address security and privacy issues of IoT devices. Blockchain can facilitate trust-less environments that supports zero trust's principle of \"never trust, always verify\". They conclude that the results of their survey indicate that although research on IoT and cybersecurity is extensive, there is lack of research on blockchain and zero trust, along with other challenges like lightweight security and decision-based security techniques. Studies of various models of zero trust based on four principles (the principle of separating trust from location, the principle of least privilege, treating data and services as resources, and continuous monitoring and evaluation) are conducted by [36], whose authors make deductions by surveying zero trust literature. The models that they focus on are--Cloud Security Alliance's Software Defined Perimeter, Google's BeyondTrust and NIST's Zero Trust Architecture. They present an overview of the various publications in the zero-trust space along with an abstract of the contents. The authors then expand on how zero trust is applied in cloud environments and IoT environments. They analyse the application of zero trust, explaining the definition of \"trust\" in the context of zero trust. The authors then conclude that the literature review indicates that implicit trust can no longer be relied upon. [PERSON], [PERSON] [37] has studied zero-trust architecture and their paper includes references to the five-step implementation method, including defining the protect surface and not the attack surface. The author documents the software defined perimeter (SDP) defined by CSA, BeyondCorp, Adaptive Security Architecture (ASA), continuous adaptive risk and trust assessment (CARTA), zero trust network access (ZTNA) and Zero Trust eXtended (ZTX) to explain the various implementations of zero trust. The author studies the manner in which the principles of ZTA are potentially bent by vendors to suit their products. The author deduces that the adoption of zero trust is on the rise and enables security teams to make the shift from perimeter-based architecture to verification-based access environment where all access is by default denied. The author concludes that although zero trust solutions today are often based in marketing hype or as a technology or as a tool, the solutions will improve and mature over time and zero trust will become the security strategy standard as zero trust solutions become more automated and smarter. The authors of [38] review NIST SP 800-207 and discuss the non-feasibility of zero trust architecture in real life. The authors argue that real life systems do not exist without trust. They point out that zero trust as a concept is not very well defined. The authors quote other researchers saying that the main tenets of zero trust are not practical and are challenging to implement technically, ill-advised and inconsistent. The authors argue that it may be economically and/or technically not possible for an organisation to uplift legacy systems to systems that are zero trust aware. They are concerned that zero trust architecture has gained momentum in recent times without the organisations' required understanding of zero trust architecture. The authors touch upon \"certification\" based on zero trust principles. They also conclude that the implementation of zero trust would be made easier by moving to cloud.