Zero-Trust Security Architecture for Protecting Cloud-Based Digital Systems: A Risk-Aware Framework

Abstract

Cloud-based digital systems distribute applications, identities, data and services across public, private and hybrid environments, weakening the usefulness of traditional network-perimeter assumptions. Zero trust addresses this change by removing implicit trust based on network location and requiring verification before access to protected resources. This paper proposes a risk-aware zero-trust architecture that combines identity verification, device posture, contextual risk assessment, policy-based authorization, least-privilege access, continuous monitoring and adaptive re-authentication. The architecture evaluates each request using current context rather than treating an authenticated session as permanently trusted. A conceptual risk-scoring mechanism supports adaptive decisions, while a policy engine maps risk conditions to normal access, step-up authentication, restricted access or denial. The paper presents a simple architecture, research methodology, evaluation metrics and controlled experimental scenarios suitable for cloud environments. No fabricated experimental performance results are presented; the numerical risk scale is explicitly illustrative. The framework provides a practical basis for future empirical testing of security, performance, usability and auditability in cloud-based digital systems.