How Nawadata Modernized Financial Security with Zero Trust Architecture
As financial institutions accelerate digital transformation, secure and reliable access to critical systems has become a strategic priority. For fintech providers operating in highly regulated environments, traditional security architectures are no longer sufficient to support distributed teams and cloud-driven operations.
PT Nawa Data Solutions (Nawadata), a leading Indonesian fintech and banking technology solutions provider, recently undertook a major security transformation. By replacing its legacy VPN infrastructure with a cloud-native Zero Trust architecture powered by Sangfor Athena SASE, the company successfully strengthened its security posture while improving operational efficiency across its distributed workforce.
The transformation not only eliminated exposed infrastructure but also significantly improved system reliability and regulatory readiness.
About PT Nawa Data Solutions
PT Nawa Data Solutions (Nawadata) is a premier banking and financial technology solutions provider in Indonesia, delivering innovative IT solutions to financial institutions, automotive finance companies, and multinational banking organizations.
With more than 350 certified professionals, Nawadata combines deep expertise in software engineering and banking technology. Its team brings up to 17 years of experience in software development and more than a decade of expertise in the financial services industry. The company specializes in compliance systems, financial risk management platforms, and lending technology solutions.
Nawadata’s consultants frequently work directly at client locations, including bank branches, financial institutions, and remote operational sites. This highly mobile operating model allows Nawadata to provide hands-on support and technology implementation for critical financial systems.
However, this distributed workforce also created significant security challenges. Employees needed reliable and secure access to sensitive financial platforms from various remote environments, including client networks and unmanaged internet connections.
As digital banking adoption accelerated, Nawadata recognized that traditional perimeter-based security models were no longer adequate. The company required a modern security architecture capable of protecting sensitive systems while enabling seamless connectivity for its highly mobile workforce.
The Security and Operational Challenges
Prior to the transformation, Nawadata relied on traditional VPN infrastructure to provide remote access to internal financial systems. While this approach had worked for years, it began to create several operational and security limitations as the organization expanded.
1. Insecure Remote Access
The legacy VPN environment authenticated users once and granted broad network-level access to internal resources. As Nawadata expanded its use of cloud and SaaS applications, VPN policies were managed separately across multiple branch locations.
This decentralized approach led to fragmented security policies, inconsistent access controls, and unreliable connectivity between distributed offices and client sites.
2. Complex Operations and Infrastructure Management
The hardware-centric VPN architecture required security appliances to be installed and maintained across multiple locations. Remote branches often lacked dedicated security personnel, making device management and maintenance difficult.
Bandwidth limitations and manual hardware upgrades frequently caused latency issues and occasional branch downtime. These operational constraints affected consultant productivity and slowed down service delivery to financial clients.
3. High Infrastructure Costs
Maintaining the legacy VPN environment also created ongoing capital and operational expenses. Hardware appliances required regular refresh cycles, and procurement delays made it difficult to scale infrastructure quickly when business demand increased.
Additionally, when technical issues occurred at remote locations, security teams often had to travel from headquarters to perform troubleshooting and maintenance. This significantly increased operational costs and extended mean time to resolution (MTTR).
4. Expanding Attack Surface
Perhaps the most critical concern was the growing security risk associated with traditional VPN architecture. Publicly exposed network ports and implicit trust models increased the potential for lateral movement within internal systems.
For a fintech provider managing sensitive financial data and operating under strict regulatory oversight, this expanded attack surface posed a significant security risk.
Implementing a Zero Trust Security Model
To address these challenges, Nawadata decided to redesign its remote access architecture based on Zero Trust principles.
Instead of relying on traditional network perimeter defenses, the company adopted an identity-driven security model that verifies every access request before granting access to applications.
After evaluating several modern security platforms, Nawadata selected Sangfor Athena SASE to support its Zero Trust transformation. The platform integrates multiple security services including Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), and Firewall-as-a-Service (FWaaS) into a single, cloud-delivered architecture.
The following diagram illustrates how Sangfor Athena SASE enables secure Zero Trust access for Nawadata’s distributed workforce, allowing employees to securely connect to internal financial systems from any location.
This unified platform enables centralized policy enforcement, real-time security visibility, and secure connectivity for employees working from any location.
Ensuring a Smooth Deployment
Before full implementation, Nawadata conducted a comprehensive proof-of-concept (POC) evaluation using Sangfor Zero Trust Guard (ZTG), the ZTNA component within the Athena SASE platform.
The testing phase validated that the solution could meet Nawadata’s stringent security requirements while maintaining the high performance necessary for financial services operations.
Following the successful evaluation, Nawadata deployed several core components of the Athena SASE platform:
Zero Trust Guard (ZTG)
Provides secure application-level access to sensitive financial and regulatory systems, replacing traditional VPN connectivity.
Secured Global Access (SGA)
Protects employees working from client locations and remote environments by securing internet traffic and preventing external threats.
All-in-One Endpoint Agent
A unified SASE agent installed on endpoints to enforce security policies consistently across all devices.
Unified Management Console
Provides centralized policy management and visibility across all users, applications, and locations.
Strengthening Security with Zero Trust
By implementing a Zero Trust architecture, Nawadata fundamentally changed how users access internal systems.
- Instead of granting broad network access, the new model enforces granular, application-level access based on verified identity and device posture.
- Internal systems are no longer visible to the public internet, effectively eliminating exposed network ports previously associated with VPN gateways.
- Access requests are continuously validated using identity verification, device health checks, and contextual risk analysis. If a user's device or access conditions change during a session, the system automatically triggers re-authentication or terminates the connection.
This approach significantly reduces the risk of unauthorized access and lateral movement between internal systems.
Measurable Results
The Zero Trust transformation delivered significant improvements across Nawadata’s security operations and infrastructure management.
| Pain Points | Before Athena SASE | After Athena SASE |
| Insecure Remote Access | Implicit Trust: Authenticates once; trusts forever. Network-Level: Broad access to entire segments. Visible Infrastructure: Network ports are exposed to the web. High Risk: Attackers can jump between internal systems. |
Zero Trust: Never trust, always verify every request. Application-Level: Granular access to specific apps only. Darkened IP: Resources are hidden from the public internet. Prevented: Micro-segmentation keeps users siloed. |
| Complex Operations & Management | • Localized policies via hardware on every branch; • No central management or monitoring – leads to intermittent downtime; • Frequent manual upgrades and patching. |
• Unified security policies for all branches; • Centralized dashboards for monitoring – up to 80% reduction in downtime; • Automatic upgrades – 100% systems are always up to date. |
| High Cost | • Costly and frequent hardware refreshment cycles; • Costly manpower, service delays due to hardware maintenance & downtime. |
• 100% reduction in hardware cost. Zero hardware footprint; • Automatic updates and minimized downtime led to OPEX reduction. |
Security Improvements
• 100% elimination of publicly exposed VPN infrastructure
• Internal financial systems fully hidden from the public internet
• Stronger identity-based access controls
Operational Improvements
• Up to 80% reduction in branch downtime
• Reduced mean time to resolution (MTTR) through centralized monitoring
• Consistent security policies across all locations
Cost Efficiency
• 100% elimination of hardware-based VPN infrastructure
• Lower operational expenditure due to automated updates
• Reduced maintenance and travel costs for security teams
Business Impact for Financial Clients
Beyond the technical benefits, the transformation delivered significant strategic advantages for Nawadata’s business operations.
The new security architecture improved service reliability for financial institutions and strengthened client confidence in Nawadata’s ability to protect sensitive banking systems.
The centralized platform also simplified compliance reporting and audit readiness—an important factor for financial organizations operating under strict regulatory frameworks.
Additionally, the new infrastructure enables Nawadata to onboard new consultants and client branches more quickly, supporting the company’s continued expansion in Indonesia’s fast-growing fintech sector.
Looking Ahead
Following the successful deployment of Athena SASE, Nawadata plans to further expand its Zero Trust architecture by integrating additional security capabilities, including Secure Web Gateway (SWG), advanced threat prevention, and Data Loss Prevention (DLP).
With a unified cloud-based security platform now in place, Nawadata is well positioned to support the next phase of digital banking innovation while maintaining the highest standards of security and compliance.
