CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary

arXiv:2608.17068 · cs.CR · Submitted 2026-08-17 · Read on arXiv

cs.CR

Submitted: 2026-08-17

Updated: 2026-09-01

Comments: 20 pages. v3: revised manuscript and supplement; added a matched comparison of reactive, periodic, and sequenced preservation; expanded the evaluation and revised the related work; clarified the reference architecture and scope. Includes the IEEE preprint notice

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Provenance — 24× in this paper · explained in 4 episodes
Zero Trust — 21× in this paper
Trace — 10× in this paper · explained in 2 episodes
Actor — 7× in this paper · explained in 3 episodes
Admissibility — 6× in this paper · explained in 2 episodes
Fidelity — 6× in this paper · explained in 2 episodes
Benchmark — 5× in this paper · explained in 2 episodes
Verification — 5× in this paper · explained in 2 episodes
Core — 4× in this paper · explained in 2 episodes
Robustness — 4× in this paper · explained in 5 episodes
Forensic Management Point — 3× in this paper
Internet Engineering Task Force — 2× in this paper
Policy Decision Point — 2× in this paper
Research Questions — 2× in this paper
Abstraction — 1× in this paper · explained in 1 episode
Consistency — 1× in this paper · explained in 3 episodes
Decoupling — 1× in this paper · explained in 2 episodes
Federal Rules of Civil Procedure — 1× in this paper
Introspection — 1× in this paper · explained in 2 episodes
Policy Enforcement Point — 1× in this paper
Resource Constraints — 1× in this paper · explained in 3 episodes

Terminology

Related papers