The financial authorities will expand security vulnerability inspections for major financial companies from once a year to at least twice a year. In response to a series of recent hacking incidents in the banking sector, they plan to strengthen the responsibilities of CEOs and improve the information-sharing system for hacking threats, thereby overhauling the overall security framework in the financial sector.
On October 14, the Financial Services Commission discussed these security management enhancement measures during the second emergency response meeting chaired by Shin Jin-chang, the Secretary General.
The authorities plan to increase the frequency of security vulnerability inspections for major financial companies and establish a basis for conducting ad-hoc inspections as needed. They will comprehensively review the external interfaces and authentication systems of financial companies and clarify the responsibilities of CEOs and Chief Information Security Officers (CISOs).
An integrated monitoring system will be improved to ensure that individual financial companies share detected hacking threat information across the sector. Additionally, the establishment of an AI-based vulnerability detection infrastructure and a joint security monitoring system for small and medium-sized financial companies will be pursued.
Shin stated, "Despite repeated calls for comprehensive inspections and management enhancements, it is very concerning that basic protocols are not being followed by financial companies. We will push for fundamental institutional improvements across the security framework, including ensuring accountability for CEOs and boards of directors."
This response comes after investigations into breach incidents and urgent security inspections revealed widespread damage and management deficiencies across the financial sector. Following an investigation into the damage before and after the Shinhan Bank breach, a total of 16 companies were confirmed to have experienced breaches, with approximately 100,000 personal data records exposed.
The affected institutions include Shinhan, KB Kookmin, Busan, and Hana Banks, as well as Yeogaram, Welcome, DB, and OK Savings Banks, and Hyundai Capital and Korea Development Bank. Other affected entities include PFCT, Mooda, Brightfix, Streamy, Prabank, and the Saemaul Geumgo Central Association. The leaked information includes names, contact details, resident registration numbers, and email addresses, while no account or card numbers were reported as compromised.
As of October 8, inspections of 555 financial companies across 12 categories revealed that 130 companies (23.4%) reported deficiencies. Issues identified included failure to apply the latest security patches, poor management of systems with expired technical support, lack of a 24-hour security monitoring system, and omissions in external system authentication and authorization. The authorities are guiding immediate corrective actions while investigating the correlation between additional damages and incidents.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.