"Security Networks Vulnerable Even to Low-Cost AI... Financial Sector Needs a 'Joint Shield'"

[AI Targeting the "Weak Links" in Finance] ②
Small and Midsized Firms Struggle with Limited Security Personnel and Budgets
Joint Security Monitoring via the Financial Security Institute as an Alternative
Large Firms and Partners Must Streng

Editor's NoteRecently, security threats in the financial sector have been intensifying, as evidenced by card information leaks at electronic payment gateway firms such as Toss Payments and KoeM Payments. Last year, there were major security incidents at Lotte Card and SGI Seoul Guarantee Insurance, and more recently, hacking incidents have spread beyond the financial sector, affecting organizations such as Sogang University, the Korea National Diplomatic Academy, TVING, and Gangnam Unni, regardless of industry or institution. As such attacks become more widespread, the financial sector is paying attention to the possibility that generative artificial intelligence (AI) has lowered the barrier for potential attackers. There are also warnings that small and medium-sized financial institutions, which lack the ability to invest in security, could become the new "weakest link." The recent information leak by a payment gateway provider is a case in point, demonstrating the "third-party risk" whereby a breach at one location connected to the financial network can cause a chain reaction affecting large financial institutions and their customers. This article explores the security gaps and blind spots in the financial sector in the era of AI, as well as potential countermeasures.

As hacking attacks utilizing artificial intelligence (AI) become more sophisticated, there are calls for the financial sector to shift its security response to AI-based defense systems. In particular, since small and mid-sized financial institutions lack the budget and security personnel to independently acquire expensive equipment and specialized staff, there is a growing demand for a unified response system at the industry level. It is suggested that security costs should be reduced through joint security monitoring and inspections by professional financial security institutions, and that large companies should work to simultaneously raise the security standards of their partner firms.

Narrowing the AI Security Capability Gap... Authorities to Share Vulnerability Information with the Financial Sector

Professor Chae Sangmi of Ewha Womans University’s School of Business said on September 14, “Attackers are already using generic AI APIs, which cost only tens of thousands of won, to generate malicious code and exploit vulnerabilities, while small financial institutions on the defense side are restricted by network segregation and cannot use such generic AI tools for defense—it’s like trying to stop bullets with a stone axe. For small and mid-sized firms that cannot afford expensive security equipment, it is absolutely essential to use generic AI for source code analysis and vulnerability assessment,” she said.

As the speed of attacks through generative AI increases, it is argued that a regulatory framework must be established to allow small and mid-sized financial institutions to utilize external security services such as vulnerability detection and source code inspection based on AI and Software-as-a-Service (SaaS).

She pointed out that the standards for easing network segregation regulations should not simply be determined by company size (over 2 trillion won), but should be segmented according to risk and connectivity (such as the amount of data held, API traffic), and the company's actual security capabilities. Professor Chae said, “If minimum technical safety devices, such as data masking and security gateways, are in place to prevent leakage of core personal information or critical assets, it is necessary to allow even small and mid-sized companies to use AI defense tools. Easing network segregation should be approached not as a mere means for operational efficiency for large corporations, but as a way to strengthen the defense capacity of small and mid-sized financial institutions.”

However, expanding external connections could become a new attack avenue for companies lacking robust security capabilities. An official from the Financial Services Commission stated, “Rather than applying the relaxation of network segregation uniformly, we need to take into account each company’s security competence and level of risk. Companies lacking sufficient security capabilities or technical know-how should utilize external vulnerability assessments or seek support from professional institutions.”

The authorities plan to incorporate information about vulnerabilities, attack methods, and response measures identified in ongoing AI security testing into their guidelines, and share these across the entire financial sector. By assessing the potential for AI-based attacks at firms that already meet a certain level of security capability, they aim to accumulate case studies and response experience to collectively narrow the security capability gap between institutions.

Limits to Individual Survival of Small and Mid-Sized Firms... Need for 'Joint Security Monitoring' in the Financial Sector

The issue is that small and mid-sized financial institutions have limited security personnel and budgets, and insufficient capacity for independent responses. Jeon Deokjo, CEO of cybersecurity firm CQV Star, explained, “Even if we support or help small and mid-sized financial firms introduce expensive security solutions, often there’s no specialized staff to operate them, or CEOs and employees lack awareness, so they don’t voluntarily reinforce security. Simply supporting each company with security equipment or government vouchers has its limits. We need a system that provides joint monitoring and vulnerability response across small and mid-sized firms.”

This means that, alongside government voucher and matching fund support for vulnerability assessments and penetration testing equipment, a system is needed to jointly monitor the security of multiple small and mid-sized financial institutions and support them all the way through incident response.

One suggested approach is to utilize professional financial security institutions. Instead of small and mid-sized financial companies introducing expensive equipment or hiring specialists, the Financial Security Institute would provide security inspections and technical support for multiple firms. This year, the Financial Security Institute is performing vulnerability analysis and assessment for 178 financial institutions via comprehensive, individual, and public website inspections. The penetration testing team has also expanded from 6 to 20 dedicated members.

It’s also necessary to strengthen security in the entrusted and partnership processes where large financial companies and providers like payment gateways and merchants are interconnected. Attackers may first breach a vulnerable partner and use that as a pathway to the systems or customer information of large companies. In the case of Toss Payments, the authentication keys for payment integration platforms used by certain affiliated merchants were exposed externally, resulting in third parties accessing payment transaction records. A total of 4,131 transaction records and the personal information of 2,671 subjects were exposed.

Professor Yeom Heungyeol of Soonchunhyang University’s Department of Information Security said, “Attackers can access the systems or customer information of large companies via relatively insecure partners. Therefore, it is necessary to minimize access rights, introduce multi-factor authentication, maintain network separation and isolation, detect abnormal activity, and regularly conduct supply chain security assessments.”

Large Firms Are No Exception... Building a 'Joint Shield' including Partners

There are also calls for large and small-to-mid-sized financial institutions to work together to build a 'joint shield.' This involves the large firms preparing industry-wide joint funds to support member firms’ security inspections and infrastructure establishment. Because financial companies exchange data with several businesses—such as card companies, insurers, and payment gateway providers—an incident in one location could spread to other companies or customer data.

Professor Yeom said, “Small and mid-sized institutions find it challenging to independently enhance their own security, so support for joint security monitoring, security solution implementation costs, professional staff and training, and incident response drills is essential. Large financial companies should expand collaborative support to raise the security standards of their partner firms as well. The government, in turn, should establish minimum security standards and a collective response system suitable for small and mid-sized financial companies.”

There is also the suggestion that industry associations could entrust member security inspections to the Financial Security Institute. For example, savings bank, card company, consumer finance, and fintech associations could share some costs, while professional financial security organizations inspect websites and source codes to proactively identify and resolve vulnerabilities. According to a representative of the Financial Security Institute, “If individual financial companies jointly utilize AI-based inspection services from a professional institution, instead of each securing costly solutions or specialized personnel, they can ease their costs and personnel burdens while enhancing security.”

Joint response efforts are also being attempted overseas. The Society for Worldwide Interbank Financial Telecommunication (SWIFT) has conducted a demonstration with 13 global banks, employing federated learning to collaboratively advance fraud detection models without having to transfer individual bank data externally.

This content was produced with the assistance of AI translation services.