Understanding and Building Trust in Software Systems

Abstract

Integrating crosscutting concerns into the software development and sustainment lifecycle effectively to realize them fully in software systems is an enduring challenge in software engineering. This challenge is exacerbated when the crosscutting concerns have overloaded meaning, and their scope changes as new attributes and technologies emerge. Trust is one such crosscutting concern. Developing software systems with trust today increasingly also implies moving from a trust approach where the philosophy is trust but verify to one focused on the continuous assessment of trust across every device, user, application, and data, where the philosophy is never trust, always verify, denying access by default, also referred to as zero trust. The zero trust concept is mostly referred to in the context of network security, and the zero-trust architecture approach is used to describe the network architecture to enable it.1