Category: Information Security

To ensure the confidentiality, integrity, and availability of WT information assets, as well as to comply with relevant laws and regulations and mitigate operational risks caused by internal and external threats, an information security policy has been established based on business needs. This policy applies to WT and its subsidiaries that are 100% directly or indirectly owned, controlled, or provide sales and services for the group. It also applies to all personnel within these organizations, including outsourced service providers, interns, and visitors. Information security clauses are incorporated into external contracts accordingly. 

Establishing a dedicated department to strengthen information security management

According to the World Economic Forum (WEF) Global Risks Report 2024, “misinformation and disinformation” rank as the number one global risk over the next two years and fifth over the next ten years. The widespread dissemination of false information makes it difficult for individuals and organizations to make accurate decisions and may increase the cost of verifying information. Meanwhile, “cyber insecurity” ranks fourth and eighth over the next two and ten years, respectively. Increasingly complex cyber espionage and cybercrime activities, such as loss of privacy, data fraud, or data theft, pose significant threats. A failure in information security defenses could lead to data breaches and ransomware attacks, or in more severe cases, disruptions to core systems that result in major operational losses and reputational damage.

In view of the growing importance of information security and the proliferation of cyber-attacks, WT Information Security Department is overseen by a Vice-President-level Chief Information Security Officer (CISO). The department is staffed with two dedicated managers and five full-time specialists. Their responsibilities, including security-risk management, incident investigation, vulnerability disclosure, and the assessment and implementation of security architectures, were reported to the Board of Directors on 5 November 2024.

During 2024, no major information security incidents involving the leakage of sensitive data or interruptions to information services occurred, and no financial losses were incurred by customers or suppliers because of security events.

To continually enhance professional capabilities in information security, the company uses the acquisition of security certifications as a performance-review mechanism.In 2024, the team earned four internationally recognized credentials – CCSP, Google CyberSecurity, CEH, and intermediate-level iPAS, covering cloud security, penetration testing, and auditing.In addition to its existing memberships in cooperative defense groups such as the Taiwan CERT/CSIRT Alliance and the Taiwan Chief Information Security Officer Alliance, the company joined the Information Service Industry Association of the R.O.C. (CISA) to share intelligence on security trends and threats, thereby strengthening its joint-defense ecosystem.

Ongoing enhancement of employee cyber-security awareness 

As traditional perimeter defenses lose effectiveness, employee awareness has become pivotal to cyber-security management. Since 2021, WT has conducted monthly social-engineering drills using random phishing templates. Employees who click on suspicious links undergo retraining and their immediate supervisors are notified; results are regularly tracked to reduce awareness-related threats. Beginning in 2024, the scope of our security-awareness training and phishing-simulation exercises was expanded to cover employees from both Excelpoint and Future Electronics.

Strengthening the security framework to build corporate resilience

Guided by ISO 27001 and the NIST Cybersecurity Framework, WT applies defense-in-depth and secure-by-design principles across eight layers: governance, data, endpoints, applications, networks, third-party supply, business continuity & incident response, and threat intelligence & joint defense. Residual risks are continuously monitored. External ISO 27001 audits and red-team exercises validate our controls. WT holds ISO/IEC 27001:2013 and CNS 27001:2014 certificates, valid through 2025. Key 2024 actions mapped to the NIST CSF 2.0 functions are:

Strengthening cyber-security governance and network protection 

WT follows a “defense-in-depth” and “security-by-design” approach. Guided by Continuous Threat Exposure Management (CTEM), we proactively identify assets with vulnerable attack paths and apply risk-management controls to reduce both the likelihood and impact of incidents. Our 2024 cyber-security controls include the following:

Addressing customers’ cyber-security concerns

WT’s transactions throughout the supply chain rely heavily on IT systems and online platforms. Customers and original-equipment suppliers regularly evaluate us through cyber-security self-assessment questionnaires and hold ad-hoc discussions on specific security topics. To meet customer requirements, third-party security service providers engaged by the customers carry out host vulnerability scanning and penetration testing to safeguard supply-chain information security.

Sources of Cyber-Security Information
1. Customers	5. Cyber-security service providers
2. Original-equipment suppliers	6. Cyber-security news outlets or specialist websites
3. Cyber-security information-sharing alliances / ISACs	7. Zero-day exploit intelligence and similar alerts
4. IT hardware & software vendors	8. External risk-management platforms

 

Business continuity and emergency response  

24/7 cybersecurity monitoring without interruption

WT has established a dedicated cybersecurity email inbox to receive diverse external threat intelligence, using it to reinforce internal safeguards. The company has also entered into managed-service agreements with third-party providers for a Security Operation Center (SOC) and Managed Detection and Response (MDR). This always-on, 24 × 7 mechanism enables continuous, real-time monitoring of cybersecurity threats.

Regular cybersecurity-incident drills to ensure the fastest possible recovery

To strengthen corporate resilience and maintain high availability of information systems, WT carries out at least one test and drill each year under the Cybersecurity Management System’s Business Continuity Plan. The exercise simulates a primary-system failure, switches the main data center to a remote site, records results in detail, and folds lessons learned into continual-improvement tracking.

Between April and June 2024, unplanned power outages increased by roughly 50 % compared with the same period the previous year. WT therefore continues to run power-failure drills that simulate sudden blackouts, ensuring emergency generators start promptly and all facilities and systems remain operational. Post-exercise reviews confirmed that the response procedures are appropriate and that every facility and system functioned normally throughout the test.

Establishing cybersecurity reporting tiered management & rapid response

WT has issued a Security-Incident Management Procedure that defines four severity levels and the associated escalation flow. When an incident occurs, the person who discovers it reports the details or security staff perform an incident determination; notifications are then sent in line with the assigned level. If the incident is classified as “major”, it must be reported immediately to the Chief Information Security Officer (CISO), who in turn briefs the General Manager for follow-up emergency-response management.

The IT department must eliminate and resolve cybersecurity incidents within the target resolution time. After closure, it conducts a post-incident review and implements improvement actions to prevent recurrence. If an incident results from an individual employee’s behavior, the root cause and impact are assessed and disciplinary measures are imposed in accordance with work rules.

In 2024, five cybersecurity incidents occurred. All were classified as non-major and involved credential leakage; each was handled and contained immediately, resulting in no impact. None of the incidents led to any compromise of core services or leakage of sensitive data.

---

In order to ensure the confidentiality, integrity and availability of WT’s information assets, to comply with the requirements of relevant laws and regulations, to protect them from internal and external deliberate or accidental threats, and to meet business needs, information security policies have been formulated as a basis for compliance to effectively and reasonably mitigate operational risks. The policies are applicable to WT and its affiliates, subsidiaries that are 100% directly or indirectly owned, controlled by WT, subsidiaries that sell or provide services for the Group, all personnel of the mentioned organizations, outsourcing service providers, student workers, and visitors, etc. In addition, information security clauses have been added to external contracts.

According to the 2023 World Economic Forum (WEF) Global Risk Report, “Widespread cybercrime and cyber insecurity” is ranked as the 8th risk within 2 years and 10 years. With increasingly complex cyber espionage or cyber crimes, such as loss of privacy, data fraud or data theft, compromised information security protection may lead to data leakage and blackmail risks, and even core system disruptions, causing serious business losses and damaged goodwill.

In view of the growing importance of information security and increasingly rampant cyber attacks, WT’s Information Security Department is headed by Chief Information Security Officer at the level of deputy general manage. The Department, composed of one dedicated director and two dedicated personnel, is responsible for information security risk management, incident investigation, system vulnerabilities disclosure, and information security system evaluation and introduction, etc. Following the establishment of the Sustainable Development Committee, information security management strategies and results will also be presented to the Sustainability Development Committee before being submitted to the Board. There were no major information security incidents involving sensitive information leakage or information service disruption in 2023, and no financial losses were caused to customers or suppliers due to the information security incidents.

Information security certificates are used as a mechanism to check and continuously improve information security professional capabilities. In 2023, a total of six international certificates in information security governance, information security management and auditing were obtained, including CEH Master, CISA, and ISO 27001 Lead Auditor. In addition, WT has joined joint information security defense organizations such as Taiwan CERT/CSIRT Alliance and Taiwan Chief Information Security Officer Alliance to strengthen the joint information security defense system by identifying relevant information security trends and sharing threat intelligence. At a meeting of the Taiwan Chief Information Security Officer Alliance in 2023, WT shared its supply chain security practices, explaining how to help vendors improve their information security capabilities and strengthen overall supply chain security protection.

Regular refresher training to raise employee safety awareness

While conventional information security protection boundaries are no longer effective, employee security awareness has become an important part of information security management. From 2021, randomly selected phishing templates are sent out every month for social engineering exercises. For employees who click on phishing emails, there is a system in place to require refresher training, notify their direct supervisors, and keep track of the training results, in order to reduce information security threats caused by employees lacking information security awareness.

 

Implementing information security management system to upgrade corporate information security resilience

Based on ISO 27001 and NIST CSF, WT introduced and strengthened its security control measures, constantly evaluates its information security protection mechanism from point, line and plane, and develops different technical combinations. It also adopts defense-in-depth approach and security-by-design principles to further strengthen multi-layer security in eight aspects, which are management, data, endpoint, application, network, third-party supply, business continuity and emergency response, intelligence integration and joint defense, so as to reduce impact of information security risks to acceptable levels and continuously monitor residual risks. In addition, ISO 27001 verification and red team exercises were performed by third-party institutes to verify the effectiveness of management mechanisms and system security protection, and strengthen information security resilience. WT is ISO/IEC 27001:2013 and CNS 27001:2014 verified via TCIC, with certificates valid until 2025. The information security measures it took in 2023 with regard to the five NIST CSF core functions were as follows:

Five major measures to improve information security control and network protection

WT adopts defense-in-depth approach, security-by-design principles, and continuous threat exposure management (CTEM) concept to identify assets that are vulnerable to attack paths. WT manages risks to reduce the probability and impact of threats. Its information security control measures in 2023 include :

Response to customers’ information security concerns

WT relies heavily on information systems and online transactions to conduct business with its upstream and downstream partners. WT regularly returns information security self-assessment questionnaires to customers and vendors, and communicates with them on specific information security issues from time to time. In addition, to meet customer requirements, a third-party information security service provider is commissioned by a customer to perform host vulnerability scanning and penetration testing to ensure supply chain information security.

Business continuity and emergency response

24/7 information security monitoring

WT has a dedicated information security mailbox to receive information security notifications from external sources to inform internal security improvement.

Regular information security incident exercises to ensure recovery in the shortest possible time

To enhance corporate resilience and maintain high availability of the information system, tests and exercises are conducted at least once a year according to the business continuity plan of the information security management system. The exercise involves a simulated incident in the main system, switch of the main data center operation to offsite, detailed record of the exercise and results, and subsequent review and follow-up of continuous improvement.

In 2023, the number of unexpected power outages decreased by 25% relative to 2022. Nevertheless, WT continued to conduct a power supply abnormality exercise to ensure that emergency generators can be activated immediately and normal operation of the facilities and systems can be maintained. The exercise proved that the emergency response procedures were appropriate and all the facilities and systems were in normal operation.

Setting up information security notification system for hierarchical management and rapid response

WT has security incident management procedures in place, which classify information security incidents into four levels and specify notification procedures accordingly. The individual who spots an information security incident reports it to IT or information security personnel who then determines whether it is an incident and its level before forwarding accordingly. A critical incident will be immediately reported to the Chief Information Security Officer, who will pass it on to the General Manager for emergency response.

The information department must remove and resolve information security incidents within the target time, and conduct reviews and improvement measures after the incident is concluded to prevent its recurrence. If the assessment of the incident cause and impact find that the incident was caused by an employee’s behavior, he or she will be punished in acordance with the work rules.

 

A total of four information security incidents occurred in 2023, all of which were non-critical. Three of them involved leaked passwords, which were all responded to and handled immediately and caused no impact; and the other involved an external network anomaly experienced by WT’s network service provider, and the traffic was instantly redirected to the backup route. No core services, confidential or sensitive data, or confidential information related to transactions with customers or vendors were leaked in these incidents.