Survey of financial firms’ security controls to be followed by improvement measuresClarifying roles, responsibilities, and decision-making procedures for CEOs, CIOs, and CISOs”Strict accountability for delaying action despite knowing of vulnerabilities”… Strengthening the accountability framework
In response to a series of hacking incidents in the financial sector, financial authorities are pursuing measures to codify the security responsibilities of executives, including chief executive officers (CEOs), and the procedures for reporting and decision-making in financial companies’ internal regulations. The aim is to review the entire internal control system, from incident prevention to response after a hack, and ultimately hold CEOs accountable if necessary security measures were neglected.
According to financial authorities on October 15, the Financial Supervisory Service (FSS) plans to review how financial companies design and operate their security-related internal controls, including through a comprehensive survey of their external-facing systems, and draw up improvement measures.While an emergency checklist review conducted earlier at 555 financial companies focused on preventing further breaches, this time the authorities will examine whether procedures are working properly from the identification of vulnerabilities through reporting, follow-up measures, and final decision-making. On October 14, financial authorities announced that they had confirmed breaches involving the leakage of about 100,000 personal information records at 16 companies around the time of the Shinhan Bank incident, and unveiled follow-up measures.The key to strengthening internal controls is to clarify the division of roles and responsibilities among the CEO, chief information officer (CIO), and chief information security officer (CISO). At financial companies, the CISO is currently responsible for information security, while the CIO oversees IT system operations and stability. Even when a CISO identifies a security vulnerability and calls for it to be fixed, the actual system upgrades are handled by an organization under the CIO, so delays in taking action could lead to an incident. Financial authorities believe it is particularly important to establish clear procedures for the CEO to resolve conflicts and make the final decision when the CISO’s demands for stronger security, such as security patches or system shutdowns, clash with the CIO’s judgment on maintaining service continuity. The authorities also recognize that CIOs involved in building and operating external-facing systems, which have become a focus of controversy in this case, cannot be exempt from responsibility for hacking incidents.A financial authority official said, “To respond quickly to a breach, the roles and responsibilities of not only the CISO but also the CIO and, ultimately, the CEO must be clear.” The official added, “This can be seen as a way to improve the effectiveness of the existing responsibility maps by making executives’ decision-making and accountability more specific.”The FSS plans to assess how each financial company identifies, inspects, and addresses external vulnerabilities before drawing up improvement measures. It is considering developing guidelines and requiring financial companies to incorporate them into their internal regulations. The authorities may also pursue measures to address areas where the responsibilities set out in existing responsibility maps are not being put into practice. In November 2025, Yoo Dong-soo, a lawmaker from the Democratic Party of Korea, also introduced a bill to amend the Electronic Financial Transactions Act that included provisions to clarify CEO responsibility for information security and strengthen the CISO’s authority.If future regulatory improvements specify financial executives’ security responsibilities, whether they properly fulfilled their obligations is also expected to become a key consideration for financial authorities when imposing sanctions following a hacking incident. Depending on the circumstances of an incident and the extent to which responsibilities were breached, sanctions could extend to executives, including the CEO. However, rather than holding companies uniformly responsible simply because an incident occurred, financial authorities intend to take a comprehensive view of efforts to prevent incidents in advance, whether security measures were implemented, and how the company responded afterward.A financial authority official stressed, “Security is a critical task that CEOs must recognize as important themselves and oversee responsibly, from prevention through incident response, so internal controls need to be strengthened further.” The official added, “If the necessary measures to prevent breaches were implemented diligently, that will be taken into account. But if an incident occurs because executives knew of a serious vulnerability and neglected to address it, they should be held strictly accountable.”
[Exclusive] “Why secretly import it from abroad when it’s sold in Korea too?”… ‘This drug’ detected in 5,515 illegal import cases
Meanwhile, according to financial authorities, breaches have been confirmed at a total of 16 financial companies around the time of the hack of Shinhan Bank’s access system for loan agents. The companies span all sectors, including banks, savings banks, mutual finance institutions, specialized credit finance companies, electronic financial businesses, online investment-linked finance businesses, and virtual asset service providers. The information leaked so far is estimated at about 100,000 records, including names, contact details, and resident registration numbers. No leakage of information that could directly enable fraudulent transactions, such as account passwords or card numbers, has been confirmed.
This content was produced with the assistance of AI translation services.
© The Asia Business Daily. All rights reserved. Unauthorized AI training and use prohibited.
Click Here For The Original Source
——————————————————–
