Zero Trust Security: Never Trust, Always Verify

By Tanqory Engineering Team

In 2025, the traditional security perimeter is dead. With distributed workforces, multi-cloud deployments, and API-first architectures, the concept of "inside" versus "outside" the network no longer applies. Attackers don't break in—they log in, using stolen credentials, compromised APIs, or supply chain vulnerabilities.

This is why Tanqory adopted Zero Trust architecture three years ago. The results speak for themselves: 99.97% attack prevention rate, zero data breaches, and security that scales with our global commerce platform serving 50+ countries.

This article details how we built our Zero Trust infrastructure and the engineering principles that make it work.

1. The Evolution of Security Threats

Why Traditional Security Fails

The castle-and-moat model assumes:

• Clear network boundaries
• Trusted internal users
• Known, manageable endpoints
• Predictable attack vectors

Reality in 2025:

• 78% of employees work remotely at least part-time
• Average enterprise uses 130+ SaaS applications
• API calls exceed human-initiated requests 10:1
• Supply chain attacks increased 742% since 2020

The Breach Economics

Attack Vector	Average Cost	Detection Time	Recovery Time
Credential Theft	$4.5M	287 days	75 days
API Exploitation	$5.2M	212 days	68 days
Supply Chain	$8.4M	303 days	92 days
Insider Threat	$4.9M	241 days	85 days

Traditional perimeter security fails because it grants excessive trust after initial authentication. Once inside, attackers move laterally with minimal resistance.

The Commerce-Specific Challenge

E-commerce platforms face unique security challenges:

High-Value Targets:

• Payment card data
• Customer PII
• Merchant credentials
• Transaction records
• Pricing strategies

Complex Attack Surface:

• Public-facing storefronts
• Merchant dashboards
• Payment integrations
• Logistics APIs
• Mobile applications

Regulatory Pressure:

• PCI-DSS compliance
• GDPR data protection
• SOC 2 attestation
• Regional privacy laws

2. Zero Trust Principles

Core Philosophy

Zero Trust is built on three fundamental principles:

1. Verify Explicitly Every access request is authenticated and authorized based on all available data points—user identity, device health, location, resource sensitivity, and behavioral patterns.

2. Use Least Privilege Access Users and systems receive minimum permissions required for their specific task, for the minimum duration needed.

3. Assume Breach Design systems assuming attackers are already inside. Segment networks, encrypt everything, and monitor continuously.

The Zero Trust Architecture

┌───────────────────────────────────────────────────────────────────┐
│                      Policy Decision Point                        │
│  ┌─────────────────────────────────────────────────────────────┐  │
│  │    Identity verification          Risk scoring            │  │
│  │    Device posture assessment      Behavioral analytics    │  │
│  │    Context evaluation             Policy enforcement      │  │
│  └─────────────────────────────────────────────────────────────┘  │
└───────────────────────────────────────────────────────────────────┘
                              │
              ┌───────────────┼───────────────┐
              │               │               │
              ▼               ▼               ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│   Identity      │ │   Device        │ │   Network       │
│   Verification  │ │   Trust         │ │   Segmentation  │
│                 │ │                 │ │                 │
│   MFA/Passkeys  │ │   Health checks │ │   Microsegments │
│   SSO/OIDC      │ │   Certificates  │ │   Service mesh  │
│   Risk-based    │ │   Compliance    │ │   mTLS          │
└─────────────────┘ └─────────────────┘ └─────────────────┘
              │               │               │
              └───────────────┼───────────────┘
                              │
                              ▼
┌───────────────────────────────────────────────────────────────────┐
│                       Protected Resources                         │
│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐      │
│  │ APIs    │ │ Data    │ │ Apps    │ │ Services│ │ Infra   │      │
│  └─────────┘ └─────────┘ └─────────┘ └─────────┘ └─────────┘      │
└───────────────────────────────────────────────────────────────────┘

3. Identity: The New Perimeter

Beyond Passwords

Passwords are fundamentally broken:

• 81% of breaches involve stolen credentials
• Average user reuses passwords across 6+ sites
• Credential stuffing attacks run 24/7 globally

Our Identity Stack:

1. Passkeys (FIDO2/WebAuthn)

• Phishing-resistant by design
• No secrets transmitted over network
• Biometric verification on device
• 95% adoption among Tanqory merchants

2. Adaptive Multi-Factor Authentication

• Risk-based step-up authentication
• Device trust reduces friction
• Contextual factors: location, time, behavior
• Hardware keys for privileged access

3. Continuous Authentication

• Session risk scoring in real-time
• Behavioral biometrics (typing patterns, mouse movements)
• Automatic session termination on anomaly detection

Identity Architecture

User Request
      │
      ▼
┌──────────────────┐
│ Initial Auth     │
│ (Passkey/MFA)    │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ Risk Assessment  │──► Low Risk: Grant Access
│ Engine           │
└────────┬─────────┘
         │
         │ Medium Risk
         ▼
┌──────────────────┐
│ Step-Up Auth     │──► Additional Verification
│ Required         │
└────────┬─────────┘
         │
         │ High Risk
         ▼
┌──────────────────┐
│ Block + Alert    │──► Security Review
│ + Investigation  │
└──────────────────┘

Risk Scoring Model

Our identity risk engine evaluates 50+ signals:

Signal Category	Weight	Examples
Device Trust	25%	Known device, certificate valid, OS updated
Location	20%	Expected country, VPN detection, impossible travel
Behavior	25%	Session patterns, action velocity, historical baseline
Authentication	20%	Method strength, recency, failure history
Context	10%	Time of day, resource sensitivity, access pattern

Results:

• 94% of legitimate users: Frictionless access
• 5.9% of legitimate users: Quick step-up verification
• 0.1% of legitimate users: Full verification required
• 99.7% of attacks: Blocked at identity layer

4. Network Microsegmentation

The End of Flat Networks

Traditional networks trust everything inside the perimeter. One compromised system can reach any other system. Zero Trust networks assume every connection is potentially hostile.

Microsegmentation Approach:

• Every workload in its own security zone
• All traffic encrypted (mTLS)
• Policy-based access control
• East-west traffic inspection

Service Mesh Implementation

We use Istio service mesh for Zero Trust networking:

Key Components:

1. Sidecar Proxies

• Intercept all network traffic
• Enforce mTLS encryption
• Apply access policies
• Collect telemetry

2. Certificate Authority

• Automated certificate issuance
• Short-lived credentials (24-hour rotation)
• Workload identity verification
• No shared secrets

3. Authorization Policies

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payment-service-policy
spec:
  selector:
    matchLabels:
      app: payment-service
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/checkout/sa/checkout-service"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/v1/process"]
    when:
    - key: request.auth.claims[scope]
      values: ["payment:write"]

Network Segmentation Results

Metric	Before Zero Trust	After Zero Trust
Lateral Movement Attempts	1,200/month	3/month (all blocked)
Attack Blast Radius	Full network	Single microsegment
Mean Time to Containment	4.2 hours	0.3 seconds (automatic)
Compliance Audit Findings	23	0

5. API Security: The Critical Layer

API Attack Landscape

APIs are the primary attack surface for modern commerce:

• 83% of web traffic is now API-based
• API attacks increased 681% in 2024
• Average commerce platform exposes 200+ API endpoints

Defense in Depth for APIs

Layer 1: Gateway Protection

• Rate limiting (per-client, per-endpoint)
• Request validation (schema enforcement)
• Bot detection and mitigation
• DDoS protection

Layer 2: Authentication & Authorization

• OAuth 2.0 / OIDC token validation
• Scope-based permissions
• Just-in-time access provisioning
• Token binding to client

Layer 3: Runtime Protection

• Behavioral anomaly detection
• Business logic attack prevention
• Injection attack blocking
• Data exfiltration detection

Layer 4: Data Protection

• Field-level encryption
• Tokenization for sensitive data
• Data masking in responses
• Audit logging for compliance

API Security Architecture

                         External Request
                               │
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                          WAF / CDN Edge                              │
│    DDoS mitigation Bot detection Geographic filtering           │
└─────────────────────────────────────────────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                          API Gateway                                 │
│    Rate limiting Schema validation Authentication               │
└─────────────────────────────────────────────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                      Authorization Service                           │
│    Token validation Scope checking Policy evaluation            │
└─────────────────────────────────────────────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                      Runtime Protection                              │
│    Behavioral analysis Anomaly detection Threat intelligence    │
└─────────────────────────────────────────────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────────────┐
│                      Backend Services                                │
│    Business logic Data access Response generation               │
└─────────────────────────────────────────────────────────────────────┘

API Security Metrics

Attack Type	Volume (2025)	Blocked	False Positives
Credential Stuffing	4.2B attempts	99.99%	0.001%
SQL Injection	180M attempts	100%	0%
API Scraping	890M attempts	99.8%	0.02%
Business Logic	45M attempts	98.7%	0.1%
DDoS	2,400 attacks	100%	0%

6. Data Protection

Encryption Everywhere

Zero Trust requires encryption at every layer:

Data in Transit:

• TLS 1.3 for all external connections
• mTLS for all internal service communication
• Certificate pinning for mobile apps
• Perfect forward secrecy enabled

Data at Rest:

• AES-256 encryption for all storage
• Customer-managed keys available
• Hardware security modules (HSMs) for key management
• Envelope encryption for performance

Data in Use:

• Confidential computing for sensitive workloads
• Memory encryption for payment processing
• Secure enclaves for cryptographic operations

Tokenization Strategy

Sensitive data never exists in plaintext outside secure vaults:

What We Tokenize:

• Payment card numbers
• Bank account details
• Social security numbers
• Authentication credentials

Tokenization Architecture:

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│ Application │────►│ Token Vault │────►│ HSM Cluster │
│             │◄────│             │◄────│             │
└─────────────┘     └─────────────┘     └─────────────┘
       │                   │
       │ Token             │ Encrypted
       │ (non-sensitive)   │ (PAN, etc.)
       ▼                   ▼
┌─────────────┐     ┌─────────────┐
│ Database    │     │ Secure      │
│ (tokens)    │     │ Storage     │
└─────────────┘     └─────────────┘

Results:

• PCI DSS scope reduced 85%
• Audit complexity reduced 70%
• Developer access to sensitive data: 0%

7. Continuous Monitoring & Response

Security Observability

Zero Trust requires complete visibility:

Data Collection:

• Every authentication event
• All API requests and responses
• Network flow logs
• System and application logs
• User behavior analytics

Analysis Layers:

1. Real-Time Detection

• Rule-based alerts for known patterns
• ML-based anomaly detection
• Behavioral baseline deviation
• Threat intelligence correlation

2. Investigation Tools

• Full request/response replay
• User session reconstruction
• Attack chain visualization
• Forensic data preservation

3. Automated Response

• Instant session termination
• Dynamic firewall updates
• Automated containment
• Incident ticket creation

Security Operations Metrics

Metric	Industry Average	Tanqory
Mean Time to Detect (MTTD)	287 days	2.3 minutes
Mean Time to Respond (MTTR)	75 days	4.1 minutes
Alert Volume	10,000/day	150/day (high-fidelity)
Alert Fatigue Rate	45%	3%
Automation Rate	25%	94%

Incident Response Automation

Playbook Example: Credential Compromise

Trigger: Anomalous login detected
         │
         ▼
┌──────────────────┐
│ 1. Block Session │ (0.1 seconds)
│    immediately   │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ 2. Revoke all    │ (0.5 seconds)
│    active tokens │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ 3. Reset MFA     │ (1 second)
│    enrollment    │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ 4. Notify user   │ (2 seconds)
│    via backup    │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ 5. Create        │ (5 seconds)
│    incident      │
└──────────────────┘

Total time: 8.6 seconds (fully automated)

8. Supply Chain Security

The Hidden Attack Vector

Modern software relies on thousands of dependencies:

• Average application: 500+ dependencies
• Average dependency depth: 7 levels
• Visibility into transitive dependencies: <20%

Software Bill of Materials (SBOM)

We maintain complete SBOM for all deployments:

What We Track:

• Direct and transitive dependencies
• License compliance
• Known vulnerabilities (CVE)
• Maintainer reputation
• Update frequency

Enforcement:

• Automated dependency scanning in CI/CD
• Block deployment if critical vulnerabilities
• Automated pull requests for updates
• Quarantine of suspicious packages

Build Pipeline Security

Secure Software Development Lifecycle:

1. Code Signing

   • All commits signed with verified keys
   • Merge requires signature verification
   • Branch protection enforced

2. Build Isolation

   • Ephemeral build environments
   • Network isolation during build
   • Deterministic builds for reproducibility

3. Artifact Verification

   • Signed container images
   • Verified checksums
   • Provenance attestation (SLSA Level 3)

4. Deployment Gates

   • Security scanning required
   • Compliance check required
   • Manual approval for production

9. Compliance and Governance

Automated Compliance

Zero Trust architecture simplifies compliance:

Requirement	Traditional Approach	Zero Trust Approach
PCI-DSS 4.0	12 requirements, 300+ controls	Microsegmentation + tokenization
SOC 2	Point-in-time audits	Continuous compliance evidence
GDPR	Manual data mapping	Automated data classification
ISO 27001	Annual certification	Real-time control validation

Governance Framework

Policy as Code:

• Security policies defined in version control
• Automated policy enforcement
• Drift detection and remediation
• Audit trail for all changes

Access Reviews:

• Quarterly access certification
• Automated removal of unused permissions
• Just-in-time privilege elevation
• Segregation of duties enforcement

10. Implementation Roadmap

Phasing Zero Trust Adoption

Phase 1: Foundation (Months 1-3)

• Deploy identity platform with MFA
• Implement API gateway security
• Enable encryption everywhere
• Establish security monitoring

Phase 2: Segmentation (Months 4-6)

• Deploy service mesh
• Implement microsegmentation
• Enable mTLS for all services
• Create authorization policies

Phase 3: Intelligence (Months 7-9)

• Deploy behavioral analytics
• Implement risk-based access
• Enable automated response
• Integrate threat intelligence

Phase 4: Optimization (Months 10-12)

• Fine-tune detection models
• Reduce false positives
• Expand automation
• Continuous improvement

Investment and ROI

Investment Area	Cost	Annual Savings	ROI
Identity Platform	$500K	$2.1M (breach prevention)	320%
Network Security	$800K	$1.8M (incident reduction)	125%
API Protection	$400K	$1.2M (fraud prevention)	200%
Monitoring/Response	$600K	$3.5M (automation)	483%
Total	$2.3M	$8.6M	274%

Key Takeaways

Aspect	Traditional Security	Zero Trust
Trust Model	Trust then verify	Never trust, always verify
Perimeter	Network boundary	Identity is the perimeter
Access	Broad permissions	Least privilege, just-in-time
Network	Flat, trusted	Microsegmented, encrypted
Detection	Perimeter-focused	Continuous, behavioral
Response	Manual investigation	Automated containment

Conclusion

Zero Trust is not a product—it's an architecture and a mindset. It requires rethinking security from first principles: assume breach, verify explicitly, and minimize blast radius.

At Tanqory, our Zero Trust implementation protects billions of transactions across 50+ countries. The investment has paid dividends: zero breaches, 99.97% attack prevention, and security that scales with our platform.

The threat landscape will continue to evolve, but the principles of Zero Trust—never trust, always verify—provide a foundation that adapts to any future challenge.

---

This article is part of our Engineering Series exploring security architecture at Tanqory. For questions or collaboration opportunities, reach out to info@tanq.com.sg

Published by Tanqory Engineering Team | December 2025