None of South Korea's 79 savings banks or the four major mutual finance federations, including the National Agricultural Cooperative Federation, have obtained the government's Information Security Management System-Personal (ISMS-P) certification. Hacking attempts using artificial intelligence are spreading across the board, yet the basic infrastructure for data protection remains weak. Industry officials say regulators should move faster on easing rules so that AI can be used to counter AI-driven hacking, while providing support to second-tier financial institutions that lack budgets and staff.
A review by The Seoul Economic Daily on the 5th comparing 274 financial companies across seven sectors — banks, savings banks, insurers, securities firms, card issuers, mutual finance federations and capital firms — against the Korea Internet & Security Agency's list of valid certifications found that only 40 institutions, or 14.6%, held ISMS-P certification.
ISMS-P is a combined certification that adds reviews of how personal data is collected, used, provided and destroyed to the ISMS information security management framework. Obtaining it is not mandatory, but industry officials say the small number of certified firms shows how little attention the issue receives.
By sector, 12 of 20 banks, or 60%, held ISMS-P certification. Excluding foreign-owned banks, the share rises to 66.7%. Among credit card companies, six of eight, or 75%, were certified.
By contrast, life insurers and non-life insurers — including foreign-owned and reinsurance companies — stood at 18.2% and 9.7%, respectively. Only 12 securities firms, or 20%, were certified. Savings banks and the federations of the agricultural, fisheries, credit union and community credit cooperative networks have no ISMS-P certification. Welcome Savings Bank, Acuon Savings Bank and the Korean Federation of Community Credit Cooperatives hold only ISMS certification for their internet banking services. A senior financial industry official said, "You need budget and staff to make security upgrades effective." See page 5.
