  As the computing landscape evolves towards distributed architectures such as
Internet of Things (IoT),enterprises are moving away from traditional perimeter
based security models toward so called zero trust networking (ZTN) models that
treat both the intranet and Internet as equally untrustworthy. Such security
models incorporate risk arising from dynamic and situational factors, such as
device location and security risk level risk, into the access control decision.
Researchers have developed a number of risk models such as RAdAC (Risk
Adaptable Access Control) to handle dynamic contexts and these have been
applied to medical and other scenarios. In this position paper we describe our
ongoing work to apply RAdAC to ZTN. We develop a policy management framework,
FURZE, to facilitate fuzzy risk evaluation that also defines how to adapt to
dynamically changing contexts. We also consider how enterprise security
situational awareness (SSA) - which describes the potential impact to an
organisations mission based on the current threats and the relative importance
of the information asset under threat - can be incorporated into a RAdAC scheme
