Financial regulators have identified the failure to identify and manage information technology (IT) assets as one of the root causes of recent hacking incidents in the financial sector. They are moving forward with a plan to mandate that financial institutions comprehensively track all IT assets they hold through digital systems. As the current Electronic Financial Transactions Act does not explicitly mandate the identification and management of IT assets, regulators have begun reviewing legal amendments.
According to industry sources on the 14th, financial regulators are considering introducing new regulations requiring financial institutions to identify and manage all hardware and software they hold and operate through digital systems. It is expected that this will be implemented by explicitly stating management obligations in the Electronic Financial Supervision Regulations, a subordinate regulation linked to amendments of the Electronic Financial Transactions Act.
Financial regulators cite the fact that banks have failed to properly identify and manage IT assets used internally as a primary cause of the current hacking crisis. However, it was determined that while business support systems for loan solicitors that were hacked were included in the scope of managed IT assets, their management was relatively inadequate compared to major assets such as internet banking.
In particular, some systems lacked systematic management regarding the end-of-service (EOS) timing of software, components, and security patch history. Regulators judge that this made it difficult to quickly determine whether a specific system was subject to patching when new vulnerabilities were discovered.
Article 21 of the current Electronic Financial Transactions Act imposes an obligation on financial institutions to ensure the safety of electronic financial transactions. While the Electronic Financial Supervision Regulations, established based on this provision, include standards for protecting computer systems, there is no clause explicitly requiring the comprehensive identification and management of all IT assets through digital means.
However, the specific method and timing of legal amendments have not yet been determined. Financial regulators are currently focused on preventing the spread of damage from hacking incidents and subsequent response efforts. This is because amendments to the Electronic Financial Transactions Act, which would raise fines for violations of security obligations by financial institutions up to 3% of sales following the Lotte Card hacking incident, have not yet been finalized.
in FINANCE
