Ministry of Science and ICT: "Top Information Security Investors are Samsung Electronics, KT, and Coupang"

Analysis of Funds and Workforce in 650 Mandatory Disclosure Companies

[Asia Economy Reporter Minyoung Cha] Among companies required to disclose their information security status, Samsung Electronics in manufacturing, KT in information and communication, and Coupang in retail invested the most funds and personnel.

On the 19th, the Ministry of Science and ICT announced that it analyzed the information security investment status of 648 companies that disclosed their information security status either mandatorily or voluntarily, and these three companies were selected as the top information security companies in their respective three major industries.

In manufacturing, Samsung Electronics invested the most in information security, with an investment amount of 693.9 billion KRW and 526.6 personnel deployed. In information and communication, KT invested 102.1 billion KRW and 335.8 personnel, while in retail, Coupang invested 53.5 billion KRW and 170.6 personnel in information security.

As of the morning of the day, the market capitalization of these three companies was Samsung Electronics 398.8 trillion KRW, KT 7.3 billion USD (9.5 trillion KRW), and Coupang 28.6 billion USD (37.3 trillion KRW). The size of the company and the scale of information security investment were not proportional, and KT, an information and communication company, had a relatively large investment scale compared to its market capitalization.

Looking at the proportion of information security investment relative to information technology investment for these three companies, Samsung Electronics was the highest at 9.55%, followed by Coupang at 7.13%, and KT at 5.24%.

By industry, the second and third highest information security investment amounts in the information and communication sector, where KT belongs, were SK Telecom with 62.7 billion KRW and Naver with 35 billion KRW, respectively. In manufacturing, following Samsung Electronics, SK Hynix invested 52.6 billion KRW and LG Electronics 45.5 billion KRW in information security.

The highest information security investment ratios by service were Kakao platform at 3.91% (14.1 billion KRW), the three major telecom companies with KT at 5.24% (102.1 billion KRW), game company Nexon Korea at 8.02% (13.6 billion KRW), and e-commerce Coupang at 7.13% (53.5 billion KRW).

Meanwhile, in the financial and insurance sector, Woori Bank; in construction, Samsung Engineering; in healthcare, Seoul Asan Medical Center; and in transportation, Korean Air were identified as the companies with the highest information security investment in their respective major industries.

The Ministry of Science and ICT amended the Information Security Industry Act in December last year to reflect mandatory disclosure of information security. This aims to create a safe online environment against hacking and personal information leaks and to expand corporate information security investment. Accordingly, some companies are required to disclose their information security status starting this year.

The targets include 598 companies such as Internet Service Providers (ISP), private data centers (IDC), tertiary general hospitals, cloud computing service providers, and companies obligated to designate a Chief Information Security Officer (CISO) with sales exceeding 300 billion KRW and daily average users exceeding 1 million. Including voluntary disclosure companies, the current status of 648 companies was announced in this survey.

The total information security investment of the analyzed companies was 2.0285 trillion KRW, with an average investment per company of 3.2 billion KRW and an average of 9.3 dedicated personnel. The average proportion of information security investment relative to information technology investment was 9.13%. By industry, financial and insurance, information and communication, and manufacturing sectors were active in information security investment.

The Ministry of Science and ICT suggested that in manufacturing, compared to other industries, information security activities such as education, simulated breach training, and information security insurance subscription were below average, requiring attention and effort from Chief Information Security Officers and management. It also pointed out that construction, healthcare, and social welfare service industries need to expand efforts in information security investment and dedicated personnel deployment.