Tving, a domestic online video service (OTT), announced on September 24 that it is strengthening its security by rebuilding its system based on a Zero Trust framework.
Zero Trust is a security principle that does not inherently trust any access and continuously verifies users, devices, and permissions. Tving has established principles of thorough access verification, least privilege, breach assumption, and continuous validation, applying these across its services and cloud environments.
To ensure 'thorough access verification,' Tving has implemented authentication token verification across all app and web segments. For older versions of the app, mandatory updates have been enforced.
The company is also considering technologies to detect and block tampered apps.
In line with the 'least privilege' principle, Tving has segmented access permissions for systems and services based on job functions. The access control system is being strengthened through systematic management of permission scopes and validity periods.
Based on the 'breach assumption' principle, Tving is reviewing its incident response system by scenario and refining its response procedures.
For 'continuous validation,' Tving has established a system to detect abnormal activities in the cloud environment in real-time and receive alerts for any unauthorized access.
Tving is also pursuing follow-up measures to continuously enhance its security system. Plans include verifying the introduction of credential management tools, source code analysis, and vulnerability management solutions. The scope of penetration testing and vulnerability assessments will be expanded to include cloud accounts and permission areas. Additionally, the incident response system will be further developed, and the introduction of a bug bounty program is under consideration.
Furthermore, Tving is accelerating the establishment of a next-generation security relationship system. The company plans to strengthen its integrated cloud security inspection system and apply AI-based security threat detection and blocking technologies to continuously improve its real-time response capabilities against security threats.
Enhancements have also been made in key security areas. Sensitive information within the code has been transferred to a dedicated management system, and an automatic blocking and abnormal access detection system has been established at the source code storage stage. Next-generation endpoint security solutions (EDR) have been applied to all employee PCs.
To protect customer information, Tving has completely replaced app signing keys and enhanced the login and session verification structure, while also transitioning its password storage algorithm to improve the level of customer information protection.
A Tving representative stated, "We prioritize customer information protection and are continuously reviewing our security system to ensure that it leads to actual measures to enhance security levels. We will further develop access and permission management based on Zero Trust principles and continue investing in next-generation security technologies such as AI-based threat detection to create a safer service environment."
In June, Tving experienced a personal information leak incident. A government investigation in September revealed that 39.54 million accounts had been compromised.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.