# A Proposal for a Zero-Trust-Based Multi-Level Security Model and Its Security Controls
## 4 Proposed Security Controls for the Zero-Trust-Based MLS Model and Its Robustness
### Robustness of Proposed Model Based on Attack Scenarios  
This section introduces representative attack scenarios based on the risks identified in Section 3 and explains how the proposed security model in Section 4 defends against these risks through specific security controls. The two scenarios presented are based on a case attributed to attacks by North Korea's APT group [45] and an attack scenario disclosed by the National Security Agency (NSA) in the United States [46]. For each scenario, four significant risks are analysed, and the methods by which the proposed model's security controls address and mitigate these risks are described. 1. Attack Scenario 1 A practical case related to Attack Scenario 1 is linked to North Korea's Andariel hacking group. Starting in October 2022, they launched attacks targeting the Republic of Korea's defence companies and contractors by stealing user credentials, infecting systems with malware, and exfiltrating data. Figure 6 illustrates the attack scenario and it involves an attacker compromising the credentials and device of an authorised user to install malware on the organisation's internal systems and exfiltrate Sensitive data, which is C-level data. - If the attacker uses the credentials of an authorised user with legitimate access to the organisational network, MFA (Multi-Factor Authentication) requires additional authentication. Furthermore, under the Zero Trust model, the access attempt would be detected as anomalous behaviour, since it is not originating from the user's usual device, enabling the system to defend against the attack (AC-1, AC-2, AC-8, AC-9, CA-1, IA-2). - If the attacker uses the authorised user's device to access the organisational network, MFA would demand additional authentication, such as biometric veri \begin{table}
\begin{tabular}{l l} \hline \hline
**Security Solutions in Real World** & **Controls** \\ \hline \multirow{2}{*}{Network Access Control (NAC)} & AC-6: Remote Access (AC-17) \\  & CM-3: Configuration Settings (CM-6) \\ \hline \multirow{2}{*}{Intrusion Detection System (IDS)} & CA-1: Continuous Monitoring (CA-7) \\  & RA-2: Vulnerability Monitoring and Scanning (RA-5) \\ \hline \multirow{2}{*}{Intrusion Prevention System (IPS)} & AC-6: Remote Access (AC-17) \\  & AC-9: External Systems (AC-20) \\ \hline \multirow{2}{*}{Security Information Event Management (SIEM)} & CA-1: Continuous Monitoring (CA-7) \\  & CA-2: Impact Analysis (CM-4) \\  & RA-1: Risk Assessment (RA-3) \\ \hline \multirow{2}{*}{Firewall} & AC-6: Remote Access (AC-17) \\  & AC-9: External Systems (AC-20) \\ \hline \multirow{2}{*}{Virtual Private Network (VPN)} & SC-3: Transmission Confidentiality and Integrity (SC-8) \\ \hline \multirow{2}{*}{DB Crypto Solution} & SC-5: Cryptographic Protection (SC-13) \\  & SI-5: Software, Firmware, and Information Integrity (SI-7) \\ \hline \multirow{2}{*}{Patch Management System (PMS)} & SI-1: Flaw Remediation (SI-3) \\  & CM-1: Baseline Configuration (CM-2) \\  & CM-6: Signed Components (CM-14) \\ \hline \multirow{2}{*}{Anti-Virus (AV)} & SI-1: Flaw Remediation (SI-3) \\  & SI-2: Malicious Code Protection (SI-3) \\  & CM-6: Signed Components (CM-14) \\ \hline \multirow{2}{*}{Data Loss Prevention (DLP)} & SC-3: Transmission Confidentiality and Integrity (SC-8) \\ \hline \multirow{2}{*}{Identity and Access Management (IAM)} & CM-4: Software Usage Restrictions (CM-10) \\  & CM-5: User Installed Software (CM-11) \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Security control use cases in security solutions. fication, providing strong authentication measures to defend against the attack (AC-1, AC-2, AC-9, IA-2). If malware is installed on critical systems after gaining access to the organisation's internal network, the Zero Trust principle prevents lateral movement, and the principle of least privilege ensures that unauthorised users cannot execute or modify data or files. This effectively prevents the propagation and installation of malware (AC-1, AC-2, AC-3, AC-5, AC-12, CA-1).