Network Segregation Protected Banks Even Against AI Cyberattacks

Even as AI-powered cyberattacks surged, network segregation protected banks' core IT systems and customer deposits. The framework, made mandatory after the March 20, 2013 IT system crisis, is credited with serving as the first line of defense.

The system's origins date back to 2013. When the IT networks of several banks and broadcasters were paralyzed by malware attacks, financial authorities moved to strengthen security frameworks. In the second half of that year, guidelines for segregating financial IT networks were drawn up, and following revisions to the Electronic Financial Transactions Supervision Regulations, the measure became mandatory across the financial sector.

The new threat is AI. AI can automate the search for vulnerabilities and the analysis of attack paths, increasing the speed and scope of attacks. However, in the recent financial sector incident, it remains to be confirmed through the ongoing investigation by relevant authorities whether attackers actually used AI-based tools and which vulnerability they exploited to breach the systems. Park Sang-won, president of the Financial Security Institute, said, "Since cases of AI agents being used in cyberattacks have been confirmed, it is important for the financial sector to build systems capable of responding swiftly to AI threats."

Cautious voices were raised about the pace of deregulation. Financial authorities are pushing to temporarily ease network segregation rules so that financial companies can use AI for security purposes. On the easing of these rules, Kim Sung-woong, head of the Financial AI Security Research Institute at the Financial Security Institute, said, "If everyone rushes in at once just because the door has opened, there will be no way to turn back if an incident occurs," adding, "No matter how good something is, it can have side effects."

Lee Chan-jin, governor of the Financial Supervisory Service, said at a National Assembly Political Affairs Committee audit on the 19th, "A full overhaul is difficult at this point, as system restructuring requires not only budget but also enormous time, creating a security gap during that period," adding, "We must stay grounded in the fundamentals while transitioning in stages to an AI security framework."