Repeated Security Incidents... "Need to Shift Perception from Cost to Investment"

Ministry of Science and ICT Holds Cybersecurity Field Forum
Emergence of ChatGPT and Deepfake... Importance of Building Security Systems Increases

[Asia Economy Reporter Oh Su-yeon] Amid a series of security incidents such as the recent LG Uplus personal information leak and attacks by Chinese hacker groups, the government has collaborated with security experts to devise effective countermeasures. With the emergence of ChatGPT and deepfake technologies lowering the barriers to hacking, voices have called for the government to expand support for the security industry and for companies to proactively treat security-related expenditures as investments rather than costs. Requests for government support in cultivating security personnel have also continued.

On the 9th, the Ministry of Science and ICT announced that it held the 3rd on-site meeting of the 2023 Digital National Agenda series, titled “Cybersecurity Crisis Field Discussion with the People,” at the Jiranjigyo Security headquarters in Seongnam, Gyeonggi Province. The meeting was attended by cybersecurity experts from specialized companies such as Jiranjigyo, Genieon, and Onapeople, as well as representatives from the Korea Internet & Security Agency, the Korea Information Security Industry Association, general citizens, students, and active-duty military personnel.

Park Yoon-gyu, the 2nd Vice Minister of the Ministry of Science and ICT, is delivering a greeting at the "Cybersecurity Crisis Field Discussion with the People" held at Jiranjigyo Security on the 9th.
[Photo by Ministry of Science and ICT]

Cyber intrusion incidents, including the recent LG Uplus personal information leak, continue to occur. Lee Dong-beom, chairman of the Korea Information Security Industry Association and a presenter at the event, pointed out that "LG Uplus announced a 100 billion KRW investment only after experiencing a security incident, and a manufacturing company that recently suffered ransomware damage spent 10 million KRW solely on incident investigation," criticizing companies’ reactive security investments. He added, "Currently, the Ministry of Science and ICT’s guidelines are recommendations, but it would be better if they were applied more strictly. That way, companies can refer to them, and on-site personnel can use the guidelines to persuade customers."

A citizen whose family was victimized by smishing also attended the discussion, urging for active preventive measures and victim protection plans. Yoon Doo-sik, CEO of Jiranjigyo Security, stated, "With the recent lowering of hacking technology barriers, attacks have become easier using ChatGPT or deepfake technologies," emphasizing that establishing a proper security system requires three types of responses: technical, managerial, and policy-based. He further said, "If hackers move at 100 km/h, technology moves at 90 km/h. Technology alone cannot block all attacks; managerial responses are necessary. Continuous promotion and education are needed to raise awareness," and added, "Additionally, the security industry itself must be grown through increased security budgets and personnel."

The chairman of the association said, "The problem is becoming too large to be addressed by smishing prevention education for citizens alone. Security companies, the government, and telecommunications companies need to research smishing blocking technologies. It is definitely achievable."

Ways to shift corporate awareness of cybersecurity and expand security investments were also discussed. Kim Ji-hoon, a specialist at the law firm Sejong, said, "Changing perceptions is important. Security investments are often seen only as costs, but there needs to be a shift in recognizing that stable service provision thanks to security is a company’s competitive advantage," adding, "As the security market grows, talent will naturally gravitate toward it, creating a virtuous cycle." Additionally, participants discussed voices from the field, including the activation of existing systems such as the Ministry of Science and ICT’s information protection disclosure system and the designation and operation of Chief Information Security Officers (CISO), as well as mandatory vulnerability inspections for companies with security incidents and the need to expand multi-factor authentication for major digital services.

Opinions on the necessity of cultivating personnel tailored to field demands were also expressed. Captain Lee Hee-won said, "There is a policy to cultivate 100,000 cybersecurity talents, but quality is more important than quantity. One person who knows 100 is more useful than 100 people who know 1," emphasizing the need for a professional certification system. Won Yoo-jae, president of the Korea Information Security Association, stated, "Basic computer literacy largely determines security capabilities. It is best to study computer subjects properly in university and receive security education at the graduate level," adding, "It would be good if educational projects proceed in this direction."

The Ministry of Science and ICT pledged to support education for cultivating talents immediately applicable in the industry, announcing plans to newly establish corporate-led talent cultivation programs such as the 'Security Academy,' the White Hacker School, and the 'S-Developer' program to nurture top-level developers.

Ways to help domestic cybersecurity specialized companies grow into innovative enterprises were also explored. Jo Ah-young, CEO of the startup Onapeople, said, "Even if startups develop products, there are few demonstration spaces," adding, "To sell products to large companies, demonstration experience is necessary, which creates a barrier."

Park Yoon-gyu, 2nd Vice Minister of the Ministry of Science and ICT, said, "The high cybersecurity capabilities of the private sector will become a strong pillar for citizens’ daily lives and the national economy, leading to the overall cybersecurity competitiveness of the country," and added, "We will strive to ensure that government cybersecurity policies naturally permeate citizens’ daily lives and industrial sites, producing tangible effects by fostering cooperation among industry, academia, research, and government."