## 2 Background
In effect, the attack surface for the smart home environment is formed of the home router, the communication layer between the smart device and the home cloud, the home cloud, and the interface application. Figure 2: Example of how attack surface increases with addition of assets. Added complexity derives from the presence of home automation systems and their integration with smart home devices [14]. Due to home automation system integrations, the attack paths now increase multi-fold, as illustrated in Figure 4.  
Figure 4: Increased attack paths with home automation system. Figure 3: Example of smart home environment and attack surface. When used, to provide the required interface and the required value to smart homes, a home automation system connects with most, if not all, smart home devices. Home automation systems have their home cloud too. Home automation systems provide functionalities like setting alarms for re-order when inventory falls below a certain level in a smart fridge or controlling the heating with a smart boiler. These kinds of functionalities require that the homeowner configures settings on the home automation. For example, to take advantage of automatic re-ordering via a smart fridge, the homeowner would need to set an inventory threshold on the home automation. This interfacing leads to a lot more communication lines between the devices than those depicted in Figure 3. The attack surface now increases from the home router, the communication layer, the home cloud and the interface application to include the home automation and the interfaces that the home automation has with other smart home devices. The attack paths increase, and a malicious actor now only needs to compromise the home automation systems and gain access to the interconnected devices. Additional security complications come with the addition and removal of smart wear devices, home assistants and smart devices. These devices are mass-produced and are installed by users and consumers whose security capabilities range from no knowledge to a high level of knowledge. Put in the context of zero trust, smart home devices, home clouds, home routers and home automation systems are assets and applications of a smart home environment that also persist and transmit data. Zero trust, which is implemented using the five-step implementation process [7], includes the identification of Data, Assets, Application, Services (DAAS) elements as the protect surface, which is an important step [2], as it allows the organisation to see how the elements that comprise a business system or an environment cohesively form a group. Any compromise of these elements impacts the delivered value--business or otherwise. Mapping transaction flows [15] is the next step in the implementation process, which involves identifying information flows between DAAS elements--within a protect surface, between protect surfaces and with external elements--and their current security maturity [7]. Zero trust architecture is built to protect key assets by adding/enhancing controls which includes but is not limited to definition and location of Policy Decision Point (PDP), Policy Enforcement Point (PEP), Policy Administrator (PA), etc. [7]. The next step is creation of zero trust policies for the full technical stack--network, applications, sessions, etc. [7]. Zero trust policies implement access controls and are based on considered factors, either allowing or denying access. The final step is monitoring and maintaining the network. Step 5 also involves a feedback process, as any failures noted during monitoring are fed back to Step 4 to ensure that policies are adjusted. Again, this statement should not be taken literally to mean the monitoring of networks only; it includes the monitoring and maintaining of applications and interface components like APIs and so on [7]. The five-step implementation process implements the tenets of zero trust [5]. Table 1 maps the tenets to the technology solutions through which the tenets are realised.