A Study on the Problems and Limitations of the Zero Trust Security Model

doi:10.22716/sckt.2025.13.1.008

All Issue

2025 Vol.13, Issue 1 Preview Page Next Page

Research Article

A Study on the Problems and Limitations of the Zero Trust Security Model 제로 트러스트 보안 모델의 문제점과 한계점에 관한 연구: Jeong Hoon Jeon¹
전정훈¹; ¹Associate Professor, College of Natural Information Sciences, Computer Science Major, Dongduk University

¹동덕여자대학교 자연정보과학대학 컴퓨터학전공 부교수

30 March 2025. pp. 87-96

PDF

Abstract

최근 사이버 공격은 개인, 기업, 정부 기관의 내·외부 네트워크를 구분하지 않고 발생하는 추세이다. 이러한 가운데 제로 트러스트(ZT:Zero Trust) 보안 모델은 모든 사용자에 대해 재인증 및 지속적인 관리, 상시 모니터링을 통해 내부 비정상적인 접근에 대응하는 것을 주요 원칙으로 하고 있어, 이를 필요로 하는 관련 기관 및 기업들에게 많은 관심이 집중되고 있다. 그러나 다른 보안 모델과 달리 제로 트러스트 보안 모델은 시스템 및 내부 네트워크 보안 강화에 따른 여러 문제들이 예상되고 있는 가운데, 제로 트러스트 보안 모델의 활성화와 표준화를 위해서는 이에 따른 보완이 필요하다. 따라서 본 연구는 제로 트러스트 보안 모델의 주요 원칙으로 인한 문제점과 한계점을 웹 자료와 문서를 통해 고찰하고, 국내 제로 트러스트의 상황을 고려한 몇몇 한계점들을 구축 사례를 통해 여러 관점으로 해결 전략을 모색해 봄으로써, 향후 안정적인 구현 및 구축과 표준화에 기초 자료로 활용될 수 있을 것으로 기대한다.

Recently, cyber attacks tend to occur regardless of internal and external networks of individuals, companies, and government agencies. Among these, the main principle of the Zero Trust security model is to respond to internal abnormal access through re-authentication, continuous management, and constant monitoring for all users, and is attracting a lot of attention to related organizations and companies that require it. However, unlike other security models, the zero trust security model is expected to face problems due to strengthening system and internal network security, and it is judged that supplementation is necessary to activate and standardize the zero trust security model. Therefore, this study examines the problems and limitations caused by the main principles of the zero trust security model through web materials and documents, and explores solutions to several limitations from various perspectives through construction cases considering the situation of domestic Zero Trust, and is expected to be used as basic data for stable implementation, construction, and standardization in the future.

Keywords

ZT(Zero Trust)

ZTA(Zero Trust Architecture)

Security Model

Micro-Segmentation

Soft Define Perimeter

Enhanced ID Governance

References

R. Scort, B. Oliver, M. Stu, C. Sean, "Zero Trust Architecture", NIST Special Publication, 800-207, pp. 4-8, 2020.
https://www.redhat.com/en/topics/security/what-is-zero-trust
H. Yuanhang, "A Survey on Zero Trust Architecture: Challenges and Future Trends", Wireless Communications and Mobile Computing, Vol. 2022, No. 1, pp. 1-13, 2022.
10.1155/2022/6476274
이후기, "제로 트러스트 보안기술 동향과 적용 방안", 문화정보 이슈리포트, 제2022-6호, 한국문화정보원, pp. 4-5, 12-14, 2022.
https://www.ibm.com/topics/zero-trust
박춘식, "Weekly ICT Trends 주간 기술동향", 정보통신 기획평가원, 제2098호, pp. 2-14, 2023.
D. L. V. Bossuyt, B. Hale, R. Arlitt, N. Papakonstantinou, "Zero-Trust for the System Design Lifecycle", Journal of Computing and Information Science in Engineering, Vol. 23, pp. 1-7, 2023.
10.1115/1.4062597
M. Campbell, "Beyond Zero Trust: Trust Is a Vulnerability", Computer, Vol. 53, pp. 110-113, 2020.
10.1109/MC.2020.3011081
R. Cheng, S. Chen, B. Han, "Toward Zero-Trust Security for the Metaverse", IEEE Communications Magazine, Vol. 62, pp. 156-162, 2023.
10.1109/MCOM.018.2300095
https://www.samsungsds.com/kr/insights/zerotrust-0424.html
H. Liu, M. Ai, R. Huang, R. Qiu, Y. Li, "Identity authentication for edge devices based on zero‐trust architecture", Concurrency and Computation - Practice and Experience, pp. 1-12, 2022.
10.1002/cpe.7198
M. Shore, S. Zeadally, A. Keshariya, "Zero Trust: The What, How, Why, and When", Computer, Vol. 54, pp. 26-35, 2021.
10.1109/MC.2021.3090018
Z. A. Collier, J. Sarkis, "The zero trust supply chain: Managing supply chain risk in the absence of trust", International Journal of Production Research, Vol. 59, pp. 3430-3445, 2021.
10.1080/00207543.2021.1884311
M. Lei, H. Daochao, A. Jiahang, Z. Xianwei, L. Fuhong, "A continuous authentication protocol without trust authority for zero trust architecture", China Communications, Vol. 19, pp. 198-213, 2022.
10.23919/JCC.2022.08.015
D. Suparna, B. Indranil, "Securing IoT Devices Using Zero Trust and Blockchain", Journal of Organizational Computing and Electronic Commerce, Vol. 31, pp. 18-34, 2020.
10.1080/10919392.2020.1831870
N. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, R. Doss, "Zero Trust Architecture (ZTA): A Comprehensive Survey", IEEE Access, Vol. 10, pp. 57143-57179, 2022.
10.1109/ACCESS.2022.3174679
https://www.nutanix.com/kr/info/what-is-microsegmentation
https://www.ibm.com/kr-ko/think/topics/privileged-access-management
이진용, 조원배, 장형진, "제로트러스트 아키텍처 기반의 정보보호체계 구축에 관한 연구," 한국정보처리학회, 제29권, 제2호, pp. 210-212, 2022.
https://www.dailysecu.com/news/articleView.html?idxno=153900
https://www.vanta.com/products/automated-compliance
https://www.kisa.or.kr/1050602

Information

Publisher :The Society of Convergence Knowledge
Publisher(Ko) :융복합지식학회
Journal Title :The Society of Convergence Knowledge Transactions
Journal Title(Ko) :융복합지식학회논문지
Volume : 13
No :1
Pages :87-96
DOI :https://doi.org/10.22716/sckt.2025.13.1.008

[1] R. Scort, B. Oliver, M. Stu, C. Sean, "Zero Trust Architecture", NIST Special Publication, 800-207, pp. 4-8, 2020.

[2] https://www.redhat.com/en/topics/security/what-is-zero-trust

[3] H. Yuanhang, "A Survey on Zero Trust Architecture: Challenges and Future Trends", Wireless Communications and Mobile Computing, Vol. 2022, No. 1, pp. 1-13, 2022.
10.1155/2022/6476274

[4] 이후기, "제로 트러스트 보안기술 동향과 적용 방안", 문화정보 이슈리포트, 제2022-6호, 한국문화정보원, pp. 4-5, 12-14, 2022.

[5] https://www.ibm.com/topics/zero-trust

[6] 박춘식, "Weekly ICT Trends 주간 기술동향", 정보통신 기획평가원, 제2098호, pp. 2-14, 2023.

[7] D. L. V. Bossuyt, B. Hale, R. Arlitt, N. Papakonstantinou, "Zero-Trust for the System Design Lifecycle", Journal of Computing and Information Science in Engineering, Vol. 23, pp. 1-7, 2023.
10.1115/1.4062597

[8] M. Campbell, "Beyond Zero Trust: Trust Is a Vulnerability", Computer, Vol. 53, pp. 110-113, 2020.
10.1109/MC.2020.3011081

[9] R. Cheng, S. Chen, B. Han, "Toward Zero-Trust Security for the Metaverse", IEEE Communications Magazine, Vol. 62, pp. 156-162, 2023.
10.1109/MCOM.018.2300095

[10] https://www.samsungsds.com/kr/insights/zerotrust-0424.html

[11] H. Liu, M. Ai, R. Huang, R. Qiu, Y. Li, "Identity authentication for edge devices based on zero‐trust architecture", Concurrency and Computation - Practice and Experience, pp. 1-12, 2022.
10.1002/cpe.7198

[12] M. Shore, S. Zeadally, A. Keshariya, "Zero Trust: The What, How, Why, and When", Computer, Vol. 54, pp. 26-35, 2021.
10.1109/MC.2021.3090018

[13] Z. A. Collier, J. Sarkis, "The zero trust supply chain: Managing supply chain risk in the absence of trust", International Journal of Production Research, Vol. 59, pp. 3430-3445, 2021.
10.1080/00207543.2021.1884311

[14] M. Lei, H. Daochao, A. Jiahang, Z. Xianwei, L. Fuhong, "A continuous authentication protocol without trust authority for zero trust architecture", China Communications, Vol. 19, pp. 198-213, 2022.
10.23919/JCC.2022.08.015

[15] D. Suparna, B. Indranil, "Securing IoT Devices Using Zero Trust and Blockchain", Journal of Organizational Computing and Electronic Commerce, Vol. 31, pp. 18-34, 2020.
10.1080/10919392.2020.1831870

[16] N. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, R. Doss, "Zero Trust Architecture (ZTA): A Comprehensive Survey", IEEE Access, Vol. 10, pp. 57143-57179, 2022.
10.1109/ACCESS.2022.3174679

[17] https://www.nutanix.com/kr/info/what-is-microsegmentation

[18] https://www.ibm.com/kr-ko/think/topics/privileged-access-management

[19] 이진용, 조원배, 장형진, "제로트러스트 아키텍처 기반의 정보보호체계 구축에 관한 연구," 한국정보처리학회, 제29권, 제2호, pp. 210-212, 2022.

[20] https://www.dailysecu.com/news/articleView.html?idxno=153900

[21] https://www.vanta.com/products/automated-compliance

[22] https://www.kisa.or.kr/1050602

The Society of Convergence Knowledge Transactions ISSN:2287-8920(Print) 융복합지식학회논문지

All Issue