A Lightweight Zero-Trust Framework for Small-to-Medium Enterprises on AWS–Azure Hybrid Clouds

Abstract

Small-to-medium enterprises (SMEs) in developing economies are digitizing rapidly while their security capacity lags, leaving credential-based attacks and cross-cloud misconfiguration largely uncontested. Zero Trust Architecture (ZTA) is the recognized response, yet documented implementations assume enterprise budgets and specialist teams that resource-constrained firms cannot match. This study designed and empirically evaluated a four-component lightweight ZTA framework, an identity service using the Open Authorization (OAuth) 2.0 standard, a rule-based Role-Based Access Control (RBAC) policy engine, an access gateway, and an administrative dashboard with an append-only audit log, built entirely from open-source software and free-tier cloud services. A pragmatist, design-science approach combined Agile development, load testing across 5, 25, and 50 concurrent users, threat modelling using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) method, and a structured SME feasibility self-assessment. The prototype achieved 100% access-control accuracy across 500 test requests and a mean end-to-end authentication latency of 187 milliseconds at peak load, within the 200-millisecond target, though the 95th-percentile latency reached 341 milliseconds. The total monthly deployment cost was approximately 43 United States dollars, one to two orders of magnitude below the recurring cost of comparable commercial ZTA platforms. Five of six STRIDE threat categories were fully mitigated. The framework demonstrates that a credible, standards-aligned Zero Trust posture is technically and economically feasible for SMEs without specialist security personnel, contributing a deployable open-source artefact and a validated cost–performance model for similar organizations across emerging economies.