Banks' Security Perimeter Expands to External Touchpoints
As AI cyber attack technology advances rapidly, it has emerged as a new threat to the financial sector, pushing the front line of bank security beyond core computer networks to externally linked systems. Banks have long protected customer deposits through 'network separation,' isolating internal systems from external networks. However, recent personal data breach incidents have shown that the operational support systems used by loan brokers and outsourced contractors can serve as pathways to customer data, confirming the limits of network separation alone in controlling such channels.
In line with the latest security technology trends, financial companies are pursuing the adoption of 'zero trust' security frameworks while maintaining their network separation systems. Zero trust is a security principle that departs from the traditional model of trusting networks based on internal versus external boundaries, instead verifying users, devices, connection environments, and permissions at every access and permitting access only to necessary systems and information. In particular, since AI agents can automate attacks by scanning externally exposed services, accounts, and connected systems to analyze attack routes, security frameworks are being redesigned around access permissions and account management. Kim Byeong-mu, head of SK Shielders' Cyber Business Division, said, "AI is not a panacea for discovering new vulnerabilities but a tool that amplifies the scale and speed of attacks. Therefore, companies must secure thorough visibility into their assets and drastically strengthen control over externally exposed touchpoints, including APIs."
Financial authorities are also calling for tighter control of external touchpoints. On the 14th, the Financial Services Commission held a 'second emergency response meeting' with relevant agencies and agreed to conduct a comprehensive review of financial companies' security frameworks and management systems, as well as to establish a joint response framework for the financial sector. It also proposed starting vulnerability assessments with large financial companies that have broad external touchpoints and many customers, and extending the assessment cycle to at least twice a year. Shin Jin-chang, Secretary General of the FSC, said, "Trust and safety are paramount in finance, making security management essential, so it is deeply regrettable that cases were found where basic practices were not properly observed at financial companies." He added, "Using this incident as a turning point, we will do our utmost to ensure a thorough reassessment and fundamental institutional improvements across the entire security framework, from attack surface management such as financial companies' external touchpoints and authentication management to security monitoring systems across the financial sector and accountability measures involving CEOs and boards of directors." He also stated, "We will also swiftly pursue institutional improvements, such as easing network separation regulations, to establish a security framework that defends against AI attacks with AI."
The institutional foundation is already in place. There is a set of model standards that requires managing loan brokers through measures such as restricting customer data access and data breach prevention, and regularly verifying their contractual qualifications. Credit information laws also require that when customer data is outsourced, the scope, purpose, and duration of its provision must be disclosed in advance, with a credit information management and protection officer regularly reviewing the management system. However, a gap remains between regulatory standards and actual practice. Company-specific operational data—such as whether external personnel's accounts are immediately revoked after contract termination or staff turnover, and exactly what customer information loan brokers can view—is not publicly disclosed.
