Financial Supervisory Service and Korea Deposit Insurance Corporation Conduct Mock Hacking Training for Secondary Financial Sector

From October 28 to November 8
Targeting Securities, Insurance, and Cards... Conducted Unannounced

On the 22nd, the Financial Supervisory Service (FSS) announced that, together with the Korea Financial Security Institute, it will conduct a blind cyber mock hacking (attack and defense) training for the secondary financial sector (securities, insurance, cards) from the 28th of this month to the 8th of next month. This is the second training this year, following the one conducted for the banking sector in February.

The blind cyber mock hacking training is conducted unexpectedly without prior notice of the hacking date and the target financial company. Unlike the traditional tabletop training method, which is based on a pre-agreed scenario including the training target, date, and attack details to check the response system, this training does not disclose the content in advance. Instead, it involves an unannounced attempt of actual hacking by white hackers (KFSI RED IRIS team), and the financial company defends against it.

The training involves the Korea Financial Security Institute acting as a virtual attacker targeting secondary financial sector companies. White hackers attempt server hacking and DDoS attacks, and the financial companies detect and defend against these attacks. In the case of DDoS attacks, traffic is redirected to an emergency response center to maintain business continuity as part of the response process.

Additionally, this time, as part of the recently announced "Financial Sector Network Separation Improvement Roadmap," the training will include a security measure check related to generative AI, which the financial sector will adopt, to prepare for the safe application of new technologies in the financial IT environment.

Lee Bok-hyun, Governor of the FSS, emphasized, “Cyber attacks are evolving in unpredictable ways, so we must prepare through realistic training.” He added, “I hope this training will strengthen the response and prevention systems of financial companies and raise employees’ security awareness.”