  Third-party software components like Log4J accelerate software application
development but introduce substantial risk. These components have led to many
software supply chain attacks. These attacks succeed because third-party
software components are implicitly trusted in an application. Although several
security defenses exist to reduce the risks from third-party software
components, none of them fulfills the full set of requirements needed to defend
against common attacks. No individual solution prevents malicious access to
operating system resources, is dependency-aware, and enables the discovery of
least privileges, all with low runtime costs. Consequently, they cannot prevent
software supply chain attacks.
  This paper proposes applying the NIST Zero Trust Architecture to software
applications. Our Zero Trust Dependencies concept applies the NIST ZTA
principles to an application's dependencies. First, we assess the expected
effectiveness and feasibility of Zero Trust Dependencies using a study of
third-party software components and their vulnerabilities. Then, we present a
system design, ZTDSYS, that enables the application of Zero Trust Dependencies
to software applications and a prototype, ZTDJAVA, for Java applications.
Finally, with evaluations on recreated vulnerabilities and realistic
applications, we show that ZTDJAVA can defend against prevalent vulnerability
classes, introduces negligible cost, and is easy to configure and use.
