top of page

Zero Trust in Banking: Securing a Distributed Core

  • Writer: WAU Marketing
    WAU Marketing
  • Mar 26
  • 4 min read

Updated: Jun 23

Modernizing the core makes it more powerful. It also makes it more exposed. And almost no one warns you about that second part before you sign.


It's the paradox every institution discovers late. Going from a closed monolith to a distributed core—microservices, cloud, APIs—gives you speed, scale, and openness. But each of those services now talking to one another is a new door. The perimeter you used to protect like a wall—trusted inside, dangerous outside—ceases to exist. And if you keep securing a distributed core with a castle mindset, you're leaving it open.


Why the perimeter no longer protects you


In a monolithic core, security lived at the edge: a strong wall, and everything inside was assumed trustworthy. In a distributed core that's exactly the vulnerability. When your services communicate across clusters, regions, and clouds, assuming internal traffic is safe is—in security architects' words—the trigger of the most serious breaches. The attacker no longer needs to break the wall; it's enough to get in once and move from service to service, with no one asking for ID again.


And the financial sector is the favorite target. According to the International Monetary Fund, financial institutions suffered more than 20,000 cyberattacks with losses exceeding $12 billion over two decades, and attacks have more than doubled since the pandemic, in its April 2024 Global Financial Stability Report. Close to a fifth of all reported cyber incidents hit finance, and banks are target number one. The IMF adds a data point that weighs on the region: only half of countries have a national cybersecurity strategy for the financial sector, and the gap is larger in emerging economies.


What Zero Trust is, in one phrase


The model boils down to three words: never trust, always verify. The reference standard, NIST SP 800-207, formalizes it: no implicit trust is granted to any asset or account based solely on its network location, as NIST itself defines it. A service being "inside" doesn't make it trustworthy. Every access is authenticated, authorized, and re-evaluated, session by session, assuming the network is already compromised. It's no niche: a Gartner survey found that 63% of organizations worldwide have already implemented—fully or partially—a Zero Trust strategy, as Gartner reported.


It's not paranoia; it's risk arithmetic. IBM's 2024 Cost of a Data Breach report put the global average cost at $4.88 million—and in the financial sector, at $6.08 million, 22% above average, the second-most expensive after healthcare—according to IBM's report. Worse still: 40% of breaches involved data spread across several environments—public cloud, private, on-premise—exactly the shape of a distributed core, and those cost more than $5 million each and took longer to detect, per the same report.


How Zero Trust applies to a distributed core


Let's get concrete. Securing a modern core with Zero Trust translates into three concrete moves:


  • Identity for every service, not just every user. Each microservice proves who it is before talking to another, usually via mTLS—certificates on both ends of the connection. Identity becomes the new perimeter.

  • Microsegmentation. The network is divided into isolated segments. If one service falls, the attacker can't jump laterally to the rest: each neighboring segment demands its own authorization. It's what contains a breach's "blast radius" instead of letting it become a catastrophe.

  • Verification on every API call. Each request between services is treated as a critical trust event: context is validated, token reuse and replay attacks are prevented. There's no permanent free pass.


There's an operational upside: organizations that extensively use AI and security automation save, on average, $2.2 million per breach and detect and contain it 98 days sooner, according to IBM. Well-implemented Zero Trust doesn't just prevent; it makes the bad day cheaper.


Mexico's framework already pushes that way


The CNBV doesn't use the "Zero Trust" label, but its Banking Single Circular—with its access-control requirements, third-party management, and Annex 72 of information-security indicators measured continuously—points to the same place: strict control and permanent verification, not trust by default. Modernizing the core without a Zero Trust model isn't just riskier; it moves you away from the spirit of what the regulator already expects.


How we see it at WAU


At WAU we design distributed cores with Zero Trust from the foundation, not as a lock hung on at the end: per-service identity with mTLS, microsegmentation that contains any breach, and verification on every call. Modernizing and securing aren't two projects; in a well-built core, they're the same one.


If you're going to distribute your core—or already did—and want to secure it to the standard a financial system deserves, let's talk. We'll review your attack surface and map the model. 👉 Book a conversation with our team.


Sources


Comments

bottom of page