The Financial Security Institute (FinSec) has established standards for penetration testing (mock hacking) in the financial sector that reflect actual attack scenarios, in response to increasingly sophisticated cyber attacks such as those exploiting generative AI.
On the 3rd, FinSec published the 'Guidelines for Conducting Penetration Testing (Mock Hacking) in the Financial Sector' to enable financial institutions to conduct penetration tests from the perspective of actual attackers.
These guidelines were developed in response to expanding regulatory requirements, including the addition of mock hacking items to continuous personal information evaluations and the introduction of penetration testing into technical audits for Information Security Management System-Private (ISMS-P).
This comes as attacks exploiting generative AI have become more sophisticated and intrusions linking multiple vulnerabilities have increased, heightening the need to assess how well financial institutions can respond to actual attacks.
The guidelines outline four procedural stages of penetration testing: pre-preparation, inspection execution, result reporting, and post-management, and include a checklist composed of three categories and six items.
Notably, the guidelines incorporate the 'Cyber Kill Chain' developed by U.S. defense contractor Lockheed Martin and widely used internationally, as well as the MITRE ATT&CK framework. Unlike simply identifying vulnerabilities as before, they require financial institutions to verify their response systems by simulating actual hacker attack processes—from information gathering and initial intrusion to internal spread and access to core assets—in scenario form.
FinSec operates 'RED IRIS,' a specialized penetration testing organization composed of domestic white-hat hackers, and supports mock hacking in the financial sector. Moving forward, it plans to continuously improve the guidelines by reflecting on-site application results and feedback from financial institutions.
Park Sang-won, president of FinSec, stated, "In a situation where attacks exploiting AI are rapidly becoming more sophisticated, it is not optional but essential for financial institutions to independently verify their capacity to respond to actual attacks," adding, "We will actively support financial institutions in safely and reliably conducting penetration tests and continuously improve the guidelines by reflecting on-site feedback."
in FINANCE
