- Author: Brandon Fang
- Translator: Fran Chen
Zero Trust Unveiled: The Architecture and the Benefits for Businesses
In August 2022, during the visit of Nancy Pelosi to Taiwan, numerous websites of governmental entities such as the Presidential Office, Ministry of National Defense, and Taiwan Power Company were subjected to large-scale Distributed Denial of Service (DDoS) attacks, while convenience stores and Taiwan Railway billboards were also subjected to content replacement (Deface) attacks. These attacks posed threats and challenges to the information security of both government and corporate networks.
Facing information security challenges, by the end of year 2023, the Ministry of Digital Affairs had implemented the Zero Trust Architecture (ZTA) in 20 A-level security agencies, including the Ministry of Economic Affairs, Bureau of Labor Insurance, and Highway Bureau, with plans to complete the implementation for other agencies by 2024. Moreover, not only in Taiwan but also in the United States, the development of the Zero Trust architecture is being actively advocated by the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Defense.
What is Zero Trust?
Zero Trust is a security concept built on the core principle of “never trust, always verify”.
The foundation of a Zero Trust architecture lies in the acknowledgment that “threats can emerge from any source, and users and devices should not be trusted by default”. Consequently, every system request should undergo encryption, authentication, and authorization processes to guarantee access solely for authenticated users, thereby safeguarding sensitive data. Additionally, meticulous activity logging is essential to track and monitor system interactions effectively.
A Zero Trust architecture is like setting up a second layer of password protection for sensitive data such as instant messaging (IM) apps and photo albums on a mobile phone, in addition to the startup password. This is aimed at preventing unauthorized access to private messages or photos even when the phone is unlocked.
The Zero Trust architecture can prevent the escalation of information security damage. For example, even if a thief successfully breaks into a house, if the wallets, passbooks, ATM cards, and identification documents are all stored in separate safes, the thief still cannot steal important data without the passwords for each safe, thereby minimizing the damage.
Implementing Zero Trust Architecture: Enhancing Security and Maximizing Protection
The 3A security framework is the concept of a Zero Trust security architecture, which includes Authentication, Authorization, and Accounting. “Authentication” does not assume that the login user is the genuine user, but rather using methods such as FIDO, biometric authentication, or two-factor authentication (2FA) to verify the user’s identity; “Authorization” grants users the least privileges to prevent data from being improperly accessed and to block lateral threats in the event of a breach; “Accounting” involves keeping track of user actions so that they can be traced when necessary.
For enterprises, firewalls and antivirus software are no longer sufficient to defend against increasingly sophisticated cyberattacks. In addition to mitigating the risk of information security attacks, a Zero Trust security architecture can also reduce the threat of lateral movement by hackers within corporate networks.
Take the financial industry as an example: if logging into online banking only requires a username and password, when these credentials are leaked, user data will also be compromised. A Zero Trust architecture operates under the assumption that the login user may not be the genuine user, incorporating biometric verification methods such as fingerprints or iris recognition, as well as utilizing SMS verification codes to confirm the user’s identity and device association. For instance, during online bank transfers, users often receive SMS verification codes, aligning with the Zero Trust principle that the default sender may not be the authentic user, thus confirming whether the transaction is initiated by the device owner.
With Zero Trust security architecture, enterprises bolster their defenses against data security threats by enforcing strict authentication and authorization protocols. This approach minimizes the impact of security breaches. By embracing Zero Trust, businesses not only mitigate risks but also ensure compliance with regulations. However, implementing Zero Trust architecture involves various technologies and complexities, so enterprises should plan comprehensively before implementation.
Best Practices for Implementing a Zero Trust Security Architecture - digiRunner
digiRunner, developed by TPIsoftware, implements a Zero Trust security architecture, ensuring robust identity authentication and authorization for transaction and data security. Compliant with international standards and regulatory requirements for the financial, insurance, and government sectors, digiRunner guarantees 100% adherence to inspection standards.
Furthermore, digiRunner manages the API lifecycle holistically, categorizes APIs and easily configures permissions to monitor the security of the API environment in real time, ensuring backend data is protected against malware and hacking.
In 2023, the Legislative Yuan passed the 48th article of the Personal Information Protection Act, increasing fines for violations. For serious breaches, fines ranging from NT$150,000 to NT$15,000,000 may be imposed. If a company leaks personal information due to an information security vulnerability, it will not only damage its reputation but also face hefty fines.
Protecting user data, strengthening data security defenses, and reducing the risk of hacking are critical issues for enterprises. If you need to establish a high-security Zero Trust security architecture, please feel free to contact TPIsoftware, and we will provide you with professional consultation free of charge.