## 3 Literature Review
### IoT
#### 3.3.6 Addressing Authentication Issues in Supply Chain with Zero Trust  
[PERSON] et. al. [73] used zero trust in supply chain management. Using a process adapted from [PERSON] and [PERSON] 2000 [73], the authors arrived at a strategy to move from perimeter-based security to zero trust security. The propositions made by the authors are closer to zero trust principles. They researched the impact of zero trust on other components in the ecosystem, the logical point at which the implementation of zero trust may not yield any returns, and the influence of zero trust on other factors like regulation and in turn the influence of other factors on zero trust implementation. The authors concluded that supply chain management in an organisation is critical to its competitiveness. Managing the supply chain addresses its risks, improves the quality of service and reduces disruptions. They provide exemplary cases which demonstrate that the usage of zero trust has secured organisations against safety and health concerns, from financial losses and from poor farming practices. The semiconductor supply chain industry and the alignment of semiconductor development with zero trust is the focus of [74]. The authors focused on securing intellectual property because of IP's competitiveness and the security required around it. The authors mention that the confidentiality of proprietary information is impacted by malicious insiders. By using the zero-trust approach, they consider all the entities in the design process to not be trusted, avoiding any trust anchors in the process. They propose a framework, Assuring Confidential Electronic Design Against Insider Threats (ACED-IT), to address this supply chain risk. The authors elaborate the design process for a typical semiconductor product and threat model for insider threats. The system-on-chip design process involves many entities, including external entities. The authors consider the original system-on-chip specifications, the role of a system administrator and the tools that are used in software to be trusted. The ACED-IT tool creates an emulated environment that defines requirements for engineers to access tools and carry out required operations. The system administrators create accounts for engineers with required permissions. The software wrapper contains scripts to process the entire designs through system-on-chip (SoC) processes and to perform action logging. The authors evaluated the security of ACED-IT and concluded that their framework provides solutions to prevent intellectual property (IP) theft by applying zero trust principles. [PERSON], [PERSON]. [75] researched the shared responsibility between the original equipment manufacturers (OEM) of the different layers (perception layers, network layer, processing layers and application layers) of IIoT and how it can impact the security of these devices. The author discusses using zero trust to address the prevalent challenges with many OEMs and end users to improve security. The shared responsibility model considers the aspects of (a) segregation of responsibilities; (b) IIoT lifecycle management; (c) multi-layer supply chain defence; (d) security underpinning business requirements, i.e., security costs not overrunning the business requirements; and (e) compliance with standards like those of the NIST. ZTA reduces the attack surface and fosters faster detection of compromises, as it advocates monitoring of devices and the technology stack. The author concludes that ZTA and the shared responsibility model bring visibility to security requirements and secure the design and early detection of compromises to secure IIoT devices. The applicability of zero trust for IoT as per the guidance from the NIST was studied by [76]. The authors studied the definition of \"zero trust\", the inconsistencies in NIST's guidance of ZTA and the lack of support of ZTA for legacy IT and OT. They mention that because of ZTA, delays will be introduced.