Shinhan Bank is setting up a dedicated infrastructure security task force and building an automated server patching system, moving to respond faster to security vulnerabilities as hacking incidents and personal data leaks mount across the financial sector.
The bank has issued a series of tenders in recent weeks for an infrastructure security response task force, an operating system management solution and an automation solution for infrastructure security response, according to financial industry sources on the 18th.
The task force will analyze and quickly remediate security vulnerabilities found in servers and operating systems. Its core mandate is to build a dedicated unit that includes outside specialists, manage the risk of system failures caused by applying security patches, and automate repetitive security work. Shinhan Bank plans to operate the task force for 12 months after signing the contract.
The move comes as rising cyber threats have sharply increased the need to patch software and hardware vulnerabilities. When a new vulnerability is found, patches supplied by manufacturers must be applied, but the process requires checking for possible conflicts with existing systems. The bank intends to use the task force to improve both the stability and the speed of that work.
Shinhan Bank is also pushing to build systems that make security work more efficient. It plans to spend up to 850 million won to automate the operational management of 1,000 systems. The project will automate the inspection and remediation of security vulnerabilities in electronic financial infrastructure and general computing systems, while also tracking the history of repetitive tasks such as patches and upgrades.
The bank will separately adopt a solution that automates security patching for major server operating systems and keeps a record of what has been applied. Together with the task force, the aim is to make fixes for security vulnerabilities faster and more efficient.
The steps are seen as an effort to strengthen the bank's ability to respond to security weaknesses in its computing infrastructure, following a string of hacking incidents and personal data leaks at Shinhan Bank and other financial firms. As of the 14th, 16 financial companies including Shinhan Bank and KB Kookmin Bank had confirmed cyber breaches, with roughly 100,000 records exposed, according to the Financial Services Commission. An emergency review of 555 financial companies by regulators found shortcomings at 130 of them. Failure to apply the latest security patches and poor management of systems no longer supported by manufacturers were singled out as the main problems.
Shinhan Bank is also rebuilding the data loss prevention solution at its overseas branches and developing a system to detect attachments containing personal information on SWING, its internal work portal. At overseas branches, data loss prevention functions that had run as an add-on to the existing digital rights management solution will be shifted to a dedicated solution. On the SWING portal, the bank will tighten internal controls by requiring supervisor approval before files containing personal information can be sent by email.