A string of hacking incidents across South Korea's financial sector is pushing consumer finance lenders to pay closer attention to the security of their IT systems. Firms that lack the staff and capacity to manage computer systems on their own are focusing instead on the security capabilities of outside IT vendors.
Consumer finance companies have recently been reviewing the security levels and incident response frameworks of systems supplied by outside IT vendors, financial industry officials said on the 23rd. These lenders handle customer personal data as well as loan and debt records, but many find it burdensome to build their own security teams and IT management systems. As a result, the information protection capabilities of outside vendors have become a key consideration.
Against that backdrop, Loanprado, which supplies IT solutions tailored to the consumer finance industry, has also moved to strengthen its security management framework. The company was included this month in a cyber crisis response drill conducted by the Korea Internet & Security Agency (KISA). Since April, it has been preparing to obtain certification under the Personal Information & Information Security Management System (ISMS-P), a program that assesses whether a company's information protection and personal data management frameworks meet set standards.
The market for IT solutions for consumer finance firms has been led by incumbents such as Wayne Technology and Crigen Solution. Neither company is known to currently hold ISMS-P certification. Some in the industry say existing vendors have been limited in their ability to reflect the specific business practices and requirements of individual lenders.
Loanprado provides IT solutions that support loan and debt management and the preparation of reports for the Financial Supervisory Service. About 600 consumer finance companies have adopted its system so far, mostly small and midsize lenders that find it costly to build and maintain their own IT systems.
Industry officials say the hacking incidents have made security management, alongside convenience and price, a key criterion in choosing an IT system. Even when system management is outsourced, lenders remain responsible for protecting customer information, so they need to examine vendors' information protection frameworks and incident response capabilities closely, they said.
"Consumer finance companies are also paying attention to the security levels of their IT systems in preparation for hacking incidents," one industry official said. "The harder it is for a firm to build its own security staff and systems, the more closely it has to look at the management capabilities of outside IT vendors."