Search papers, labs, and topics across Lattice.
This paper introduces CUSTOS, a forensic-ready Zero Trust (ZT) architecture that enhances evidence capture and decision provenance in environments with ephemeral workloads and automated remediation. By implementing a Forensic Management Point (FMP) that orchestrates telemetry and identity-linked reconstruction, the authors demonstrate that their approach can effectively recover volatile evidence, achieving a 100% success rate in trials when using a sequenced SIGKILL command. The findings highlight the necessity of maintaining an evidentiary floor in ZT systems, revealing limitations in traditional reactive capture methods and the importance of structured decision records.
Forensic-ready Zero Trust architectures can recover volatile evidence with 100% success when employing sequenced commands, challenging conventional reactive capture methods.
Zero Trust (ZT) replaces implicit trust with continuous verification, but mutual TLS, ephemeral workloads, identity-centric control, and automated remediation reduce payload visibility, weaken IP-based attribution, and shrink the window for acquiring volatile evidence. We propose CUSTOS, a forensic-ready ZT reference architecture centered on a Forensic Management Point (FMP) that coordinates tiered capture, identity- and policy-linked reconstruction, telemetry orchestration, and ZT-controlled investigative access. We evaluate a composed, component-level prototype using a live enforcement gateway plus separate runtime and orchestrator experiments. An always-on decision record is captured and hash-chained on the gateway at a 1.9-3.0\% throughput cost on in-process policy engines, preserving decision provenance outside the monitored workload under stated trust assumptions. Reactive checkpointing (about 65 ms) precedes seconds-scale defender-routed eviction but loses to unsequenced direct SIGKILL (about 9 ms), in-kernel enforcement, and adversarial self-destruction, producing the forensic shredder effect. On a real container, concurrent capture and SIGKILL recovered the planted secret in 0/1000 trials; sequencing SIGKILL behind the FMP barrier recovered it in 1000/1000. The primary integrated single-node Kubernetes race checkpoints an FMP-controlled process; container-memory capture is evaluated separately and was unavailable in the managed-Kubernetes configuration. Across five public benchmark datasets and a synthetic schema reference, identity-oriented telemetry populates 64-75\% of the decision-record schema against 18-30\% for network-oriented, while rate limiting bounds the full-memory admission ceiling. These results show that forensic-ready ZT requires both an always-on evidentiary floor and bounded reactive capture, while identifying where volatile evidence remains unrecoverable.
