ZETA: A Zero-Trust Security based Forensic-Ready Solution for Perimeter-less Enterprise Networks

Enterprises are adopting software-defined perimeter (also known as perimeter-less network) due to factors such as cloud computing, remote work, and mobile devices. Software-defined perimeter creates a large attack surface that is spread across the Internet via Virtual Private Network (VPN). Continuous monitoring and logging of security events using the Zero-Trust (ZT) cyber security framework enables real-time detection and response to potential cyber security threats.However, Network Address Translation (NAT) routers at the network perimeter provide incomplete flow logs, and hardly any Virtual Private Network (VPN) router provides any flow logs. Moreover, each of the flow logs should be traceable to the identity of users to respond to incidents from Law Enforcement Authorities (LEAs). Insufficient traceability of flow logs back to users might lead to penalties enforced by LEAs. Often such traceability is not quantifiable. This paper provides a measurable zero-trust forensic-ready solution for perimeter-less enterprise networks.