Quality Attributes for Zero Trust Architecture-Based Systems

Zero trust architecture (ZTA) is a novel security approach to building secure systems. For ZTA-based systems, several quality attributes (QAs) are critical given the challenges presented by its principles such as continuous verification, least privilege, and network micro-segmentation. Although several studies have contributed to the analysis the quality of ZTA-based systems, a systematic understanding of their QAs and the scope of these according to a well-established quality model is still missing. This article presents the results of a systematic literature review to identify most reported QAs for ZTA-based systems and their coverage, according to the well-known ISO/IEC 25010 quality model. The review of 22 primary studies shows that (i) 17 QAs were identified, but security and performance are the most frequently reported; (ii) only 8 QAs are mentioned in ISO/IEC 25010; and (iii) ZTA-based systems have complex QAs interdependencies, like resiliency, that are only partially covered in ISO/IEC 25010. These preliminary findings on ZTA-based systems quality are essential for researchers and practitioners, offering theoretical and practical perspectives to enhance understanding and implementation of this novel security approach.