Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki / Archive / Issue of Journal № 4, Vol. 28, 2025 / Zero Trust assessment across the software product development lifecycle

Zero Trust assessment across the software product development lifecycle

DOI: 10.21293/1818-0442-2025-28-4-144-151

Download article in PDF format

JATS xml

Abstract: This paper focuses on the Zero Trust concept as a modern approach to information security. It analyzes existing methods for assessing the implementation of Zero Trust Maturity models, identifying their key features and limitations. The study demonstrates that current approaches have a number of drawbacks that restrict their practical applicability. A Zero Trust assessment framework is proposed, based on the secure software development lifecycle and identification of factors influencing Zero Trust at each stage. Within the proposed approach, a comprehensive system of criteria is established to provide a more objective and thorough evaluation of the implementation of Zero Trust principles.

Keywords: Zero Trust assessment, Zero Trust, assessment criteria, secure software, software development lifecycle

For citation:
Derkach E. A., Shelupanov A. A., Novikov S. N., Bragin D. S. Zero Trust assessment across the software product development lifecycle. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2025, vol. 28, no. 4, pp. 144–151. DOI: 10.21293/1818-0442-2025-28-4-144-151

Authors and copyright holders:

Derkach E. A. , Tomsk State University of Control Systems and Radioelectronics (Tomsk, Russia)
Shelupanov A. A. , Tomsk State University of Control Systems and Radioelectronics (Tomsk, Russia)
Novikov S. N. , Siberian State University of Telecommunications and Informatics (Novosibirsk, Russia)
Bragin D. S. , Tomsk State University of Control Systems and Radioelectronics (Tomsk, Russia)

1. Kingervag J., Balaouras S., Coit L. Build Security Into Your Network’s DNA: The Zero Trust Network Architecture. Cambridge, United States, Forrester Research Inc., 2010, 26 p.
2. Buck C., Olenberger C., Schweizer A., Voelter F., Eymann T. Never trust, always verify: A multivocal literature review on current knowledge and research gaps of zero trust. Computers & Security, 2021, vol. 110, p. 102436.
3. Zero Trust Maturity Model. Cybersecurity and Infrastructure Security Agency, 2023. Available at: https://www.cisa.gov/zerotrust (Accessed: 12.11.2025).
4. Yeoh W., Liu M., Shore M., Jiang F. Zero trust cybersecurity: Critical success factors and a maturity assessment framework. Computers & Security, 2023, vol. 133, p. 103412.
5. Marushevskiy V.E. [Evaluation of the Effectiveness of the Implementation of Zero Trust in Russian E-commerce]. Bulletin of the Voronezh Institute of High Technologies, 2025, vol. 19, no. 2, pp. 1–5 (in Russ.).
6. Slepynina M.M., Evdokimov I.V. Metod realizatsii printsipa nulevogo doveriya v sovremennykh informatsionnykh sistemakh [A method for implementing the Zero Trust principle in modern information systems]. Rossiya molodaya: Proceedings of the XIV All-Russian Scientific and Practical Conference of Young Scientists, 2022, pp. 31670.1–31670.9 (in Russ.).
7. Mushtaq S., Mohsin M., Mushtaq M.M. A systematic literature review on the implementation and challenges of Zero Trust architecture across domains. Sensors, 2025, vol. 25, no. 19, art. 6118.
8. Kesarpu S. Zero-trust architecture in Java microservices. International Journal of Networks and Security, 2025, vol. 5, no. 1, pp. 202–214.
9. Casola V., De Benedictis A., Mazzocca C., Orbinato V. Secure software development and testing: A model-based methodology. Computers & Security, 2024, vol. 137, pp. 1–16.
10. Howard R. Kiberbezopasnost: glavnye printsipy [Cybersecurity: core principles]. Saint Petersburg, Piter Publ., 2024, 320 p. (in Russ.).
11. Devyanin P.N. Modeli bezopasnosti kompyuternykh sistem. Upravlenie dostupom i informatsionnymi potokami [Security models of computer systems. Access control and information flows]. Moscow, Goryachaya liniya – Telekom Publ., 2011, 320 p. (in Russ.).
12. Olifer V.G., Olifer N.A. Bezopasnost kompyuternykh setey [Computer network security]. Moscow, Goryachaya liniya – Telekom Publ., 2020, 644 p. (in Russ.).