Internet banks bolster security after detecting IP access attempts

Following a series of hacking incidents at commercial banks, server access attempts from external IPs have been identified at internet-only banks. A financial sector inspection on the 6th revealed that some of the Internet Protocol (IP) addresses used in the hacking of commercial banks also attempted to access the servers of the three internet banks: KakaoBank, K Bank, and Toss Bank.

KakaoBank experienced a total of six access attempts in January and March of this year, and one attempt in September to find vulnerabilities. K Bank saw four attempts starting from July, while Toss Bank recorded 14 attempts between January and August. However, no leakage of customer information or system breaches resulting from these attempts have been identified.

As hacking incidents in the financial sector have emerged as a major issue during the National Assembly's audit of state affairs, attention is turning to the security responses of these internet banks. An Invest report based on direct coverage of the three internet banks on the 26th found that each bank is strengthening its security systems through AI-driven vulnerability checks and verification by external experts. However, differences were observed among the banks regarding the scale of information security investment and the operation of dedicated personnel.

Meanwhile, during the Financial Supervisory Service audit by the National Assembly Political Affairs Committee on the 19th, the heads of the five major commercial banks were questioned regarding hacking incidents and promised to expand security investment and implement measures to prevent recurrence.

Lee Hwan-ju, president of KB Kookmin Bank, stated, "We will secure sufficient security budget and personnel and respond to AI-driven hacking with AI security systems." Jung Sang-hyuk, president of Shinhan Bank, said, "We will make information security investments at a level that the public can accept," and Lee Ho-sung, president of Hana Bank, also replied, "We will expand security budget and personnel to prepare for AI hacking."

Using AI for vulnerability checks and external expert verification

KakaoBank is strengthening its security system based on zero trust and AI-driven vulnerability checks to prevent hacking incidents. This method uses AI to identify system vulnerabilities and paths external attackers might take in advance, while continuously verifying the authority of users and devices when they access the system.

Alongside preemptive inspections, the bank is also preparing a response system to minimize damage in the event of an actual breach. The focus is on separating and isolating services and systems so that even if some systems are hacked, the damage does not spread to other areas.

The bank is also responding to new threats that exploit AI technology. It is monitoring threats related to AI models and supply chains, including prompt attacks that induce unintended AI behavior through malicious commands.

Research is also underway to increase the safety of AI services provided to customers. The bank is conducting joint research with KAIST on "AI Guardrail" technology that can be applied to the financial environment. AI Guardrail is a technology that controls AI to prevent it from generating dangerous or inappropriate responses.

K Bank is focusing on security inspections that assume external attacks. In relation to recent hacking incidents in the financial sector, the bank has completed blocking measures for suspicious IPs and inspected access records for major security systems, such as firewalls, Intrusion Prevention Systems (IPS), and Web Application Firewalls (WAF).

The bank normally manages vulnerabilities by identifying servers and systems that can be accessed from the outside. In particular, it is checking for security loopholes through "black-box penetration testing" using AI. This method reproduces hacking situations from the perspective of an external attacker who does not know the internal information of the system to find vulnerabilities.

A K Bank official explained, "In the future, we plan to continuously advance our vulnerability management automation for IT assets and our threat detection and response systems using AI."

Toss Bank is adding verification by external experts to its internal security inspections. Its information security organization reviews and inspects security across all banking services, and access authority to customer information is limited to the minimum scope necessary for business. All access history is also recorded and inspected. To supplement internal inspections, the bank also operates the "Toss Bug Bounty Challenge," which rewards external security researchers for finding and reporting vulnerabilities.

Before launching new financial services, the bank conducts its own mock hacking, and it regularly inspects vulnerabilities in services currently in operation. The company explained that based on hacking and personal information leakage cases occurring at other financial companies, it is comprehensively re-inspecting services with similar risks and immediately improving areas that require supplementation.

Security investment continues, but scale and personnel management differ

While the three internet banks are strengthening their security technology and response systems, they are also working to secure information security investment and dedicated personnel. However, the scale of investment, personnel management, and future plans varied by bank.

According to the voluntary information security disclosure that KakaoBank participated in for the first time this year, the information security investment last year was 26.1 billion won, accounting for 12.4% of the total information technology (IT) investment of 211.3 billion won. Dedicated information security personnel numbered 78.5, which is 9.1% of the total IT workforce of 865.1.

This is a higher proportion than that of major commercial banks. During the same period, the information security investment proportions were 9.1% for Woori Bank, 9.0% for Hana Bank, 8.2% for KB Kookmin Bank, and 8.0% for Shinhan Bank.

K Bank's information security budget for this year is 16.8 billion won. Security-related personnel have remained at a similar level of approximately 34 people both last year and this year.

Toss Bank has steadily increased its information security investment since its launch. The investment grew from 6.6 billion won in 2022 to 8.8 billion won in 2023, 9.5 billion won in 2024, and 12.7 billion won last year. This represents an increase of approximately 1.9 times over three years. Last year, the information security investment proportion relative to IT investment was 11.9%, and the dedicated information security personnel proportion was 7.8%. The bank also maintains four certifications: ISMS-P (information security and personal information management system), international standards ISO27001 and ISO27701, and the payment security standard PCI-DSS.

A Toss Bank official said, "Security investment is intended to proactively build capabilities beyond mere regulatory compliance. We plan to continue expanding investment and personnel in line with the growth of the organization."

Read the original (Korean)