## 2 Background
### History of Zero Trust  
The concept of trust as a computational concept was put forward by [PERSON] [16] in his doctoral thesis at the University of Stirling. He formalised the definition of trust in the context of Distributed Artificial Intelligence (DAI) or Multi-Agent Systems (MAS), where the discussion is about two aspects of general trust--zero trust and distrust. The author has discussed how the two are not the same. With this perspective, it is important to note that while the phrase \"zero trust\" was coined in 1994, it was not used to define zero trust in the manner it is defined today. In 2001, the authors of the OSSTMM manual [17] included \"trust\" as a concept which depends on authentication and authorisation, non-repudiation, data confidentiality and data integrity of the system. The manual discusses testing \"trust\" in various contexts. In 2010, the OSSTMM published version 3.0 of their manual, where the authors documented trust as a problem and a solution [18]. The authors also mentioned that, from an authentication perspective, trust is often placed in the credentials that are authenticated when an entity enters the environment and the entity is not authenticated again. Then came the concept of \"de-parameterisation\", which was elaborated by the authors of [19]. They focused on how the early Internet was designed for a small group of people and that a trusted perimeter was implementable. They discussed the challenges of this concept posed in the early 2000s. The thoughts of a group of UK-based senior security leaders were formalised in 2003 by an interest group called the Jericho Forum [20]. The Jericho Forum researched and produced a body of literature to reveal the inadequacy of the perimeter in the face of the increasing digitisation of the economy and modernisation via digitisation. They also mentioned that the perimeter was increasingly turning into a sieve. The authors further documented their findings before the Jericho Forum formally closed in 2013. In 2009 Google created BeyondCorp [21] by implementing the principles of zero trust. They did this by not depending solely on user credentials for authentication. Google included devices used for entering credentials and the security state of the device. They further included monitoring of the endpoints, logging all traffic and only communicating over encrypted channels, with multi-factor authentication. They thus eliminated using just static credentials for authentication. In 2010 [PERSON], an analyst with Forrester Research, published two technical reports which set the tone for the formalisation of zero trust, i.e., [22; 23]. In these reports the author focused on the lack of verification in the phrase \"trust, but verify\" and gave a different thought process by bringing into focus the internal environment. Network packets on the internal environment cannot be trusted as if they were people. Access to \begin{table}
\begin{tabular}{p{128.0 pt} p{128.0 pt} p{128.0 pt}} \hline \hline
**Tenet \#** & **Tenet Description** &
\begin{tabular}{} \end{tabular} \\
4 & Access to resources is determined by dynamic policy—including the observable state of the client identity, the application/service and the requesting asset—and may include other behavioural and environmental attributes \\ \hline
5 & The enterprise monitors and measures the integrity and security posture of all owned and associated assets \\ \hline
6 & All resource authentications and authorisations are dynamic and strictly enforced before access is allowed \\ \hline
7 & The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._resources must be secured, irrespective of where the network traffic comes from, with least privilege access and strict access control. The author did not recommend role-based access control (RBAC) and pivoted from \"trust, but verify\" to \"verify and never trust\".