Behavior‐based Confidence Scoring to Support Access Management in Zero Trust Systems

Zero Trust architectures for cybersecurity have become the default aspiration for organizations in industry and for the U.S. federal government. A significant change in Zero Trust compared to legacy paradigms is the principle that systems should grant access to resources (devices, internal websites, data, software as a service, etc.) on a per‐session basis after conducting authentication and authorization that is dynamic and strictly enforced. To facilitate this tide of additional scrutiny, Zero Trust strategies also emphasize the need for data science systems that use behavioral signatures to automate elements of the authentication and authorization process. Researchers have proposed a variety of statistical and machine learning approaches for analyzing behavioral data, most often from the perspective of anomaly detection. This work uses simulated data from the CERT Insider Threat Test Dataset to examine two general approaches to using behavior data to support authentication and authorization decisions: deep learning and Bayesian hierarchical models. Though the performance levels of the two approaches are comparable, we find for both user authentication and authorization that Bayesian hierarchical models have higher recall, especially when fewer anomalies are allowed. While deep learning models are likely to remain the dominant approach for large‐scale network monitoring tasks, such as intrusion detection, more structured statistical models could still be a valuable tool for regulating access management under Zero Trust.