In the Netherlands, there has been a growing exposure of discriminatory practices across various domains. Notable instances such as the child benefit allowance scandal (referred to as the "toeslagen affaire") and concerns surrounding student allowance (DUO) have captured public attention. These problems are not confined to public domains; instances of discrimination are also being found within the financial lending markets.

While existing research offers critical discussions, practical analyses, and technical solutions regarding discrimination, there is a lack of well-defined design principles specifically addressing discrimination challenges in financial lending in the Netherlands. This study aims to bridge the gap by providing a concrete set of design principles that architects can utilize to effectively design non-discriminatory financial lending systems, while also recognizing the potential for policymakers to draw inspiration from these principles and develop universal guidelines or other policies to address this issue more broadly.

This study combined the Design Science Research approach and Principle Based Design to derive design principles for a socio-technical topic like non-discrimination. The study started with identifying the factors contributing to financial discrimination in the lending system through desk research and 13 semi-structured interviews with a wide range of scientific experts and industry professionals. To make the concept of discrimination more applicable in the context of financial lending, the study defined specific dimensions which are differential treatment, differential outcome, unequal access, and lack of transparency. This study then identified and categorized various factors that can contribute to one or more dimensions of discrimination into six domains: regulatory, human interaction, user experience, business, data, and technical. These domains help identify the specific areas in which discrimination can arise within the lending context and how different factors may overlap across multiple domains. This also highlighted the complexity of discrimination, demonstrating that discrimination is not limited to one domain, and addressing a single factor can have cascading effects, either reducing or exacerbating discrimination across other domains.

The study proceeded to identify the challenges encountered in realizing a non-discriminatory financial lending system in the Netherlands. This was accomplished through a combination of semi-structured interviews and literature review, which led to the identification of 13
challenges. Design principles were then developed that could address those challenges in collaboration with seven business and IT architects. These principles were also evaluated in two workshops involving another group of architects. Based on the feedback received, efforts were made to improve the structure and consistency of the principles, resulting in a final set of 11 principles. To enhance clarity, the principles were rearranged and grouped into four categories: culture, governance, process, and models.

The study acknowledges that while the identified design principles can contribute to reducing discrimination in the financial lending system, they do not fully resolve the problem. This is because many discriminatory issues are deeply rooted in society. However, the principles are valuable additions to existing practices and tools, providing a framework for organizations to improve their lending practices. In addition, the involvement of regulatory authorities is essential to address discrimination in the lending system. Without regulatory incentives or oversight, organizations are not motivated to proactively implement such principles or other initiatives aimed at promoting non-discriminatory lending practices. Moreover, the design principles have the potential to be applied in other areas, such as governmental financial allowances, extending their impact beyond the financial lending system.

Recent advances in the field of ‘Zero Trust’ security strategies have revealed that there is still much novelty regarding the concept of Zero Trust architecture (ZTA). Zero Trust has recently gained attention as the traditional approach, based on network perimeter security, is being outplayed by sophisticated cyber attacks. This research contributes significantly to the scientific knowledge base, as ZTA is hardly investigated. Moreover, recent developments are causing the perimeter to disappear, such as increasing collaboration between companies, ecosystem connections, and working from home due to Covid-19. As a result, public and private organizations need to rethink how to protect their IT infrastructure, assets and data better.
Several organizations are willing to opt for a Zero Trust approach because of its benefits. These benefits include improved security, reduced complexity, and lower overhead and operational costs. Additionally, innovation in enterprise architecture security is urgently needed as it can reduce data breaches, decrease lateral movement, and avoid ransom payments and a company freeze.

Even though Zero Trust brings many advantages, it has not yet replaced existing perimeter-based security approaches. The complication is that many organizations struggle with the implementation of ZTA due to a lack of knowledge and clarity on how to implement the Zero Trust security strategy. Additionally, “Zero Trust” is one of the most frequently used buzzwords in cybersecurity, making it hard to distinguish an actual ZTA. Complexity and misunderstandings of Zero Trust lead to failed projects and implementations. Furthermore, ZTA implementations are complex, and a predefined one-size-fits-all approach does not exist.

Moreover, organizations willing to transform their traditional architecture to a more advanced ZTA lack guidance in their transformation. However, Zero Trust solutions are marketed by multiple vendors, including Zscalar, IBM, Microsoft, and Palo Alto. There is no clear guidance for Enterprise Architects to support organizations in the transformation to a ZTA. Thus, research is needed to investigate 1) what Zero Trust architectures are, 2) what the challenges are, and 3) what the design principles for a successful ZTA transformation are.