The New Administration Needs a "Cybersecurity Agency" to Escape the "Hacking Republic" [Cover-up 13]

Gave More Power to the NIS,
But Inefficient Structure Burdens Companies
Need for an Integrated Command System
Combining NIS Third Deputy Director, KISA, and Cyber Investigation Unit
The U.S. Changes Programming Languages to Block Hacker Attacks
A "Cybersecurity Agency" Should Take on This Role

When a hacking incident occurs in South Korea, multiple agencies spring into action simultaneously. The National Intelligence Service (NIS), the Ministry of Science and ICT, the Korea Internet & Security Agency (KISA), the Personal Information Protection Commission, and the National Police Agency all become involved at once. Depending on the situation, other related ministries may also respond. However, as incidents such as the SK Telecom hacking crisis have heightened the importance of cybersecurity more than ever, there are growing calls for the establishment of a clear control tower.

This also suggests that the current management system is vulnerable in its response. In the previous administration, the agency wielding the most power was the NIS. In May 2023, former President Yoon Sukyeol, immediately after taking office, announced plans to "respond to cyberattacks at a pan-ministerial level" and empowered the NIS to establish the National Cyber Crisis Management Team (NCCMT).

A senior government official, speaking on condition of anonymity, explained, "Under current law, the NIS is responsible for the public sector, while the Ministry of Science and ICT oversees the private sector. However, former President Yoon, through a presidential decree, allowed the NIS to be involved in private sector incidents when launching the NCCMT." The official added, "Although the Ministry of Science and ICT is currently investigating the SKT incident, if the hacking had occurred before the state of emergency, the NIS would likely have taken the lead." He further noted, "Dividing responsibility between public and private sectors is inherently inefficient, and leaving room for the NIS to intervene in the private sector places a significant burden on companies."

Minister Yoo Sangim of the Ministry of Science and ICT has made similar observations. In a briefing earlier last month, following the SKT hacking incident, Minister Yoo stated, "All of our country's cybersecurity systems are centered around the NIS, with roles scattered across ministries. Now is the time for a nationwide strengthening of cybersecurity."

NIS Security, KISA, and Cyber Investigation Unit Should Be Integrated

Government officials, security industry experts, and academics interviewed by Asia Economy unanimously agreed that the new administration should establish an independent cybersecurity command headquarters. Lee Wontae, former president of KISA, said, "This can only be achieved if the NIS and all relevant ministries abandon the departmental self-interest that has persisted for over a decade and stop fighting over jurisdiction." He continued, "A joint public-private government agency should be created to handle both cybersecurity regulation and promotion simultaneously."

Hyungtaek Lee, Director of the Korea Ransomware Response Center, is giving an interview to Asia Economy on the 9th of last month. (Photo by Dongju Yoon)

Hyungtaek Lee, Director of the Korea Ransomware Response Center, proposed the establishment of a "Cybersecurity Agency" (tentative name). He suggested, "The NIS's third deputy director division responsible for cybersecurity, KISA, and the police cyber investigation unit should be integrated and elevated to the level of an agency." He also emphasized, "This agency should be tasked with training response personnel to minimize damage when hacking incidents occur, as well as raising security awareness among domestic corporate leaders."

Professor Park Chunsik of the Department of Information Security at Seoul Women's University also argued, "KISA, which is responsible for responding to hacking incidents, should be made an independent organization overseeing cybersecurity in both the public and private sectors." Professor Park proposed, "To strengthen its authority, KISA could be given cabinet-level status like the Personal Information Protection Commission, or it could operate as an agency directly under the Prime Minister's Office."

The U.S. Looks 10 Years Ahead, Switching to Programming Languages That Block Hacking Attacks

▲Cover of the "Strategy for Implementing Safe and Trustworthy Software" published in February last year by the Office of the National Cyber Director (ONCD) under the White House. Source: White House website

Some argue that if the new administration establishes a Cybersecurity Agency, it should be tasked with creating a "long-term security roadmap" looking 10 years ahead, similar to the United States. In the U.S., cybersecurity is overseen by the Office of the National Cyber Director (ONCD) under the White House. In February last year, this office announced a ten-year long-term project titled "Strategy for Implementing Safe and Trustworthy Software." The core of this strategy is to replace all programming languages previously used to develop software. For a long time, developers have primarily used C and C++. Vulnerabilities in memory management within these languages account for nearly 70% of all security flaws, making them prime targets for hackers.

However, by using newer languages such as Python and Java, hacking attacks can be minimized. Python and Java automatically manage computer memory, closing off security loopholes that hackers often exploit. Even after the Biden administration was replaced by the Trump administration, the ONCD remains active. The process of gradually changing programming languages, from government systems to the entire industry, continues to this day.

Lee Haemin, a lawmaker from the National Innovation Party, remarked, "It is impressive that the White House is able to develop such a thorough and professional roadmap." He added, "If a Cybersecurity Agency is established by the new administration, it should bring in a large number of capable private-sector experts to devise solutions that were previously impossible within the civil service, and provide long-term support for these efforts."

Editor's NoteIn the real world, when a hostage situation occurs, someone inevitably reports it. Whether the victim does so directly or someone nearby does it on their behalf, notifying the police as quickly as possible is the top priority. However, in cyber hostage situations caused by ransomware, the opposite is true. Victimized companies, having lost all their money and time to hackers, are busy hiding the incident. Hyungtaek Lee, Director of the Korea Ransomware Response Center, who has responded to more than 20,000 ransomware attacks over the past 10 years, said, "When companies like SK Telecom are hacked, it is extremely rare for them to report it. In fact, 9 out of 10 companies that suffer damage never disclose it externally," adding, "The cycle in which hackers simply take the money and leave keeps repeating itself."