Hackers cross industries...Government responses vary

Hackers cross the boundaries between supply chains and industries, but the government divides response agencies by sector—such as IT, telecommunications, and finance—making it difficult to coordinate. The security industry points out that initial response is inevitably delayed because inter-agency coordination and information sharing take time. An ATM in downtown Seoul on October 7. /News1 According to industry sources on the 12th, private cyber incident response is divided between the relevant ministries and dedicated agencies by sector.

The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) will oversee the IT and telecommunications sectors. The financial sector is overseen by the Financial Services Commission, the Financial Supervisory Service, and the Financial Security Institute. The medical sector is handled by the Ministry of Health and Welfare, the Korea Social Security Information Service, and medical institutions.

The education sector is managed by the Ministry of Education and the Korea Education and Research Information Service (KERIS). The security industry points out that a system divided by ministries and agencies is insufficient for effectively responding to hacking. The argument is that hackers cross multiple domains, while defense agencies respond according to their respective jurisdictions, making it difficult to keep up with the attacks.

An industry insider pointed out, “When a hack occurs, initial response is delayed due to legal and administrative coordination procedures among the responsible agencies, creating a gap in accountability; structural inefficiency is also repeated, as each agency reviews whether to issue an incident alert.” It is reported that the problems with response systems being divided among institutions were also revealed during the recent handling of hacking incidents at financial institutions such as Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. It is known that the relevant agencies held a separate phone consultation while assessing the crisis alert level and the situation. There have also been cases where information sharing was delayed due to silos between agencies, leading to conflicts over jurisdiction.

The investigation process into the SK Telecom hacking incident that occurred in April last year is a prime example. According to People Power Party lawmaker Shin Sung-bum, the Ministry of Science and ICT did not immediately accept the National Intelligence Service’s request to share SK Telecom’s investigation materials and instead asked the Ministry of Government Legislation for a legal interpretation. At a parliamentary audit last October, Representative Shin pointed out, “According to the responses submitted by the NIS to lawmakers’ offices, it was stated that there were cases where cooperation enhancement did not function, such as being unable to participate in accident response due to opposition from the Ministry of Science and ICT,” adding, “There is talk that the Ministry of Science and ICT did not want the NIS’s involvement because it feared losing the lead in the SK Telecom investigation.” Ryu Je-myung, the 2nd Vice Minister of the Ministry of Science and ICT, explained, “We are sharing the necessary information immediately.” The security industry proposes merging private incident response agencies as an alternative.

The aim is to reduce the time spent on inter-agency consultations by dividing the internal organization by field to secure specialization.