Major banks manage up to tens of thousands of information technology (IT) assets, but due to technical limitations in their asset management systems, they struggle to grasp all the information and are concurrently relying on manual work using tools such as Excel.
This has raised concerns that it is difficult to fully understand the composition of IT assets and identify security vulnerabilities, leaving them highly exposed to hacking attacks. While the banking sector acknowledges the need to strengthen IT asset management, opinions suggest that phased implementation is necessary considering current technological capabilities.
According to the banking industry on Wednesday, major software IT assets held by large domestic banks, including servers, WEB/WAS (web/web application servers), DBs (databases), information protection systems, and container virtualization systems, number in the tens of thousands.
The reason banks describe the scale of their total IT assets as "tens of thousands" rather than providing exact figures is that it is difficult to identify every single asset without omission. Banks have developed and operated computer systems for a long period, and frontline business departments and developers have created new programs or added external interfaces to existing systems according to operational needs.
In particular, as assets are frequently introduced, modified, and discarded, accurately estimating the total scale of IT assets is not easy. Consequently, records for some assets are omitted, or a significant number of cases involve manual entry into computer systems using tools such as Excel.
Financial regulators believe that the recent hacking incident occurred because security departments failed to grasp the existence, composition, and security levels of all programs, and are therefore promoting the digitization of IT asset management.
Financial regulators are particularly emphasizing the importance of Software Bill of Materials (SBOM). An SBOM is a list detailing the types, versions, and interdependencies of open-source components and libraries (collections of code) that make up a piece of software. If identifying and managing IT assets is a broad concept for understanding which servers and programs are held, an SBOM is a detailed management tool for verifying what specific software components constitute individual programs.
For example, if a security vulnerability is discovered in a specific open-source component, the SBOM can be used to identify the programs using that open-source component. When linked with an IT asset management system, this allows for the rapid identification of affected servers and business systems, enabling quick selection of targets for security patches.
However, the level of SBOM adoption in the financial sector remains insufficient. Among the four major domestic banks (KB Kookmin, Shinhan, Hana, and Woori), only one has implemented SBOMs in some systems, while the remaining three are at the stage of promoting their adoption.
The banking industry also believes that mandating IT asset identification and management will help reduce security blind spots. This is because ensuring visibility into IT assets allows for a faster grasp of vulnerability checks and targets for security patches.
However, concerns have been raised that centralizing IT asset information in one place could create a "single point of attack" for hackers. There are also differing opinions regarding the direct correlation between this hacking incident and poor IT asset identification and management.
This is because the recent incident involved an attack exploiting an authentication bypass vulnerability in a system already under management, rather than utilizing vulnerabilities in assets that had been omitted from management scope.
Additionally, limitations in building systems at the current technological level are cited as challenges, along with additional costs and personnel burdens.
A senior official at a major bank stated, "At the current technological level, there are not many vendors providing solutions to automate the management of all assets, so it will take a long time to build 100% digitization."
The official added, "Before mandating such measures, internal asset management personnel must be clearly defined and the scope of managed assets specified to avoid confusion."
in FINANCE
