English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Zendy Plus

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Zendy Tools

Zendy Open

Third-party libraries like Log4j accelerate software application developmentbut introduce substantial risk. Vulnerabilities in these libraries have led toSoftware Supply Chain (SSC) attacks that compromised resources within the hostsystem. These attacks benefit from current application permissions approaches:thirdparty libraries are implicitly trusted in the application runtime. Anapplication runtime designed with Zero-Trust Architecture (ZTA) principlessecure access to resources, continuous monitoring, and least-privilegeenforcement could mitigate SSC attacks, as it would give zero implicit trust tothese libraries. However, no individual security defense incorporates theseprinciples at a low runtime cost.  This paper proposes Zero-Trust Dependencies to mitigate SSC vulnerabilities:we apply the NIST ZTA to software applications. First, we assess the expectedeffectiveness and configuration cost of Zero-Trust Dependencies using a studyof third-party software libraries and their vulnerabilities. Then, we present asystem design, ZTD$_{SYS}$, that enables the application of Zero-TrustDependencies to software applications and a prototype, ZTD$_{JAVA}$, for Javaapplications. Finally, with evaluations on recreated vulnerabilities andrealistic applications, we show that ZTD$_{JAVA}$ can defend against prevalentvulnerability classes, introduces negligible cost, and is easy to configure anduse.

ZTD$_{JAVA}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies