The Financial Security Institute is moving to provide free security support to about 300 smaller financial companies, following a series of hacking incidents in South Korea's financial sector. The plan would extend security education, cyber response drills and artificial intelligence-based vulnerability screening to firms that are not fee-paying members, in an effort to close security gaps across the industry.
The institute is reviewing the support measures with a target of starting them next year, according to financial industry sources on the 23rd. It is leaning toward offering the services free of charge rather than at cost, given that smaller firms lack both security staff and budgets.
The Financial Services Commission said on the 14th of this month that it would strengthen security management support for smaller financial companies. The issue of security gaps at non-member firms was also raised on the 19th during the parliamentary audit of the Financial Supervisory Service, prompting the institute to draw up specific support plans.
The institute estimates that potential recipients number about 250 companies, mainly fintech firms and online investment-linked finance operators. Including small savings banks that run their own websites and capital firms that handle personal loans, the figure is expected to reach around 300.
Online investment-linked finance operators, commonly known as peer-to-peer lenders, are included in the plan. The 300 figure is an estimate of potential recipients rather than a fixed target, and the institute is considering a model in which it informs companies of the services and then provides them upon application and consent.
The education program would bring together employees of smaller firms to brief them on recent breach cases and response procedures. The aim is to help companies that lack specialized staff learn about new attack methods and basic security management practices.
For drills, the institute is considering having the firms take part in unannounced simulation exercises conducted jointly with the Financial Supervisory Service. It is also weighing a format in which simulated attacks are launched through the institute's cyber training network to test whether a financial company can detect and defend against them.
The AI-based website screening platform is under development with a target of going live in the second quarter of next year. A financial company enters its website address, and the AI identifies vulnerabilities and provides an analysis report, which the company then uses to check and fix weak points.
The institute is pushing to open the platform to non-member firms as well. The goal is to reduce the burden of having staff at each company conduct checks themselves, while allowing more smaller firms to use security screening services.
The institute is also considering opening to non-members an automated drill service in which a financial company logs into the platform, requests a simulated attack and tests its defenses. The plan is to automate exercises that previously required people to carry out each step of the attack and response, widening participation.
The institute's decision to extend free support even to firms that pay no membership fees reflects a judgment that stronger security at smaller companies helps protect the entire financial sector. Because electronic financial business operators and online investment-linked finance operators are connected to banks and credit card companies through payment and lending services and related data, closing their security gaps can also reduce the chance that a breach spreads to other financial firms.
The institute also expects benefits in detecting and sharing signs of attacks at an early stage. "If smaller firms build detection and response capabilities and quickly share the attack information they identify, other financial companies can prepare for similar attacks in advance, which can help the industry respond jointly, including member firms," a financial industry official said.