# A Proposal for a Zero-Trust-Based Multi-Level Security Model and Its Security Controls
## 2 Related Works and Their Analysis
### Zero Trust and Its Architecture  
Zero Trust is a new security paradigm designed to protect organisational resources by continuously validating access requests to the resources. It is based on the principle of \"never trust, always verify\", and eliminates the concept of a trusted network inherent in traditional perimeter-based security models [15]. Zero Trust was initially introduced as a concept within cybersecurity, but, over time, it has evolved into a comprehensive and advanced security model through various studies and practical applications. Since the early 2000s, the limitations of static defences in perimeter-based security models have been identified. The Jericho Forum addressed these issues by publishing research on de-perimeterisation [25], and, in 2010, the concept was further developed by [PERSON], a researcher at Forrester [26]. [PERSON]'s research highlighted that implicit trust within a network \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Questions** & **Korea** & **US** \\ \hline \multirow{3}{*}{Policy and Regulation} & - National Information Security Basic Guidelines [20] & - E-Government Act of 2002 (Public Law 107-347) [22] & - E-Government Act of 2002 (Public Law 107-347) [22] \\  & - National Cloud Computing Security Guidelines [21] & - Federal Information Security Management Act of 2002 (FISMA) [10] \\ \hline \multirow{3}{*}{Purpose} & Enhancing security by applying different levels of security based on the importance of business information and information systems while fostering conditions for the utilisation of AI, cloud technologies, and public data in the public sector. & Providing criteria for classifying information systems and determining security levels to consistently apply the federal government’s security policies and procedures within the RMF (Risk Management Framework) \\ \hline \multirow{2}{*}{Applicable Target} & Central Government, Local Government, Public Institutions & Federal agencies \\ \hline \multirow{3}{*}{Security categorisation} & The sensitivity of the data stored, used, and processed by the system - Classified, Sensitive, Open & Information and information system potential impact - Low, Moderate, High \\ \hline \multirow{3}{*}{Base document} & National Network Security Framework Guidelines (Scheduled for publication in February 2025) [24] & FIPS 199 (Standards for Security Categorisation) [19] \\ \cline{1-1} \cline{2-4}  & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison analysis of the Republic of Korea and the United States’ MLS. increases vulnerabilities to lateral movement and insider threats. He proposed adopting a security framework that continuously validates access requests at all points of interaction. Zero Trust is a security model based on the principle of \"never trust, always verify\", requiring continuous authentication and validation for all access requests. The NIST SP 800-207 [27], Zero Trust Architecture (ZTA), provides a framework for implementing these tenets and defines ZTA as \"an enterprise cybersecurity architecture designed based on Zero Trust principles, aiming to prevent data breaches and restrict lateral movement within networks [15]\". NIST SP 800-207 outlines seven tenets that serve as Zero Trust principles, including treating all data and computing services as resources, securing all communications regardless of network location, and applying dynamic access policies based on contextual attributes. These tenets support the logical architecture design for access control through key components such as the Policy Enforcement Point (PEP), Policy Decision Point (PDP), and Policy Information Point (PIP). Furthermore, based on the theoretical principles outlined in NIST SP 800-207, NIST SP 1800-35 [28] provides practical guidance for implementing ZTA in enterprise environments [29]. This document expands the applicability of ZTA through security technologies such as Enhanced Identity Governance (EIG), Software-Defined Perimeters (SDP), and micro-segmentation.