Korea plans stronger financial cyber controls after 130 firms report gaps

South Korea’s Financial Services Commission plans stronger security testing and threat sharing after 130 of 555 financial firms reported weaknesses in a sector-wide self-assessment. The results were discussed at its 14 October emergency meeting. The FSC separately counted 16 institutions with confirmed incidents.[1]

The exercise followed instructions issued on 2 October after attacks on major financial institutions. Firms were told to inventory all externally reachable IT assets, regardless of whether they served customers, and check authentication and access controls. That scope reaches supporting systems as well as customer applications.[2]

Reported gaps included missing patches, unsupported systems and inadequate monitoring. The follow-up programme envisages at least twice-yearly vulnerability reviews for large firms and sharing firms’ own threat intelligence through the industry system. Detailed scope and timing will be settled with the sector.[1]

For platform operators and technology suppliers, the immediate task is to establish which services are exposed, who can reach them and how suspicious access is detected. That review includes supporting infrastructure that may expose information outside the customer interface.[2]

Report an error or submit an update