In August, the U.S. government issued a joint warning from agencies including the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) about the possibility of hacking targeting Siemens' automated control technology for production facilities. In effect, it alerted the public before any breach occurred that factory lines and energy facilities were exposed to risk. The concern was that a security network breached by hackers could lead to irreversible damage, such as a shutdown of equipment.
What stands out is the method of response. The U.S. government advised companies not only to apply security patches but also to monitor for abnormal access. The government analyzed signs of attack, presented specific response guidelines and had them implemented on the ground. It is one facet of an active response that draws out individual companies' defenses before a threat turns into actual damage.
In Korea, by contrast, the approach has been preoccupied with reacting passively to cyber intrusions. Even after the recent hacking in the financial sector, the government is repeating after-the-fact remedies. It says it will fix this, but the focus appears to be on technology-driven solutions such as the adoption of artificial intelligence security.
What matters most, however, are the systems and governance that enable a rapid defense against hacking. The key is a relationship of trust between companies and the government. A system must function in which companies share their security situations with the relevant authorities, allowing those authorities to detect vulnerabilities across the industry. Concerns are raised that this is hard to achieve under the current approach, in which companies try to hide their weaknesses and the government punishes only after an incident occurs.
AI-driven hacking threats suggest this is not a problem any single company can overcome. As new hacking methods grow more sophisticated, there is an urgent need to build a system that can sound an alarm from the moment of intrusion. The U.S., which has established a preemptive response framework, also granted companies legal immunity so that the government and the private sector can share threat information. The assessment is that this reduces the risk of private-sector cover-ups and activates a system for real-time information sharing between the private sector and the government. It is time for Korea, too, to pursue a fundamental policy shift toward an active response framework on cybersecurity.