Zero Trust Should Not Become an Empty Slogan
IT DAILY ·
✦ AI Summary
On the 14th of last month, the financial authorities announced that they had confirmed breach incidents at 16 companies, including banks and savings banks, and found that about 100,000 items of information had been leaked.
It was later additionally revealed that customer information from Daishin Securities had also been leaked, and the financial authorities ordered security frameworks to be shifted to zero-trust principles.
However, because companies lack compliance obligations, standards, guidelines, and support, calls to adopt zero trust are not leading to implementation.
As hacking damage spread across the financial sector, the financial authorities announced on the 14th of last month that they had confirmed breach incidents at 16 companies, including banks and savings banks. The incidents were found to have leaked a total of about 100,000 items of information. Afterward, it was also newly revealed that customer information from Daishin Securities had been leaked.
The financial authorities pointed to zero trust as the solution. They ordered the financial sector to shift its security framework to one based on zero-trust principles. The zero-trust principle means never trust and always verify.
This response pattern is similar to what was seen during last year's domestic hacking incidents. At the time, telecom companies and e-commerce firms suffered hacking damage. Zero trust was also widely cited then as a way to improve security, and some companies promised to use the incidents as a lesson and establish a zero-trust-based security framework.
Incidents have recurred in the financial sector this year. The causes of the latest incidents were identified as failure to manage the external attack surface and inadequate authentication and authorization management. Both issues had already been pointed out before, and despite the emphasis on zero trust, the breakdown of basic security controls has resurfaced.
Observers say the background behind calls to adopt zero trust as a one-off slogan lies in a lack of an execution framework. Companies are under no obligation to comply with zero trust, and no system requires zero-trust compliance. Even when companies strengthen security on their own, there are no visible results or benefits, weakening the case for viewing security as an investment rather than a cost. In addition, even if there is a willingness to push ahead with zero trust, it is difficult to decide where to begin, and there is also a lack of agreed-upon standards for what level of protection should count as zero trust.
This perception in the field was also confirmed in a survey of participants in the '2026 Information Security Solution Conference' held by this newspaper in September. Of the 94 respondents, 39, or 41.5%, cited a lack of guidelines and reference cases as the biggest difficulty in implementing zero trust.
Government support is presented as a necessary condition for zero trust to take root. In 2023, the government announced a policy to drive the broad spread of zero trust by 2027 through its 'Strategy to Secure Global Competitiveness in the Information Security Industry.' However, with the target date now approaching, whether that promise will be fulfilled remains uncertain. The guidelines serving as the benchmark have stalled since the 2.0 version released in 2024, and the pilot projects that have continued for 3 years have seen their budgets cut.
The system for assessing the extent of zero-trust adoption is also insufficient. In materials submitted to the National Assembly Research Service, the Ministry of Science and ICT used 'number of pilot applications supported' as a performance management indicator for the spread project. However, there is no field survey in place to determine how many companies have actually shifted their security frameworks. For that reason, managing only by the number of support cases makes it difficult to verify the actual level of transition.
Follow-up systems are also showing no progress. At the end of last year, an amendment to the Telecommunications Business Act, seen as central to making zero trust mandatory, was proposed, but it has since seen no progress. Preferential treatment in public procurement is also absent, and tax incentives are likewise absent. As legal revisions, procurement preferences, and tax incentives have not followed, claims that zero trust offers an alternative are being criticized as lacking substance.
Zero-trust rules are not some grand cyber security strategy, and the nature of zero trust can be understood as a warning to reexamine even the small points that are easy to overlook. Zero trust is becoming the new baseline, and simply emphasizing its adoption is not enough. A foundation for making it a reality is needed.
The same alternative is being proposed every time an incident occurs, but the conditions for execution have not changed. If those conditions remain unchanged, it is hard to expect different results. Therefore, the systems needed to make zero trust a reality and the support needed to make zero trust a reality must be overhauled. If the gap between declaration and execution is not closed, zero trust could become an empty slogan, and the same refrain could be repeated after each hack.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242658
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.