KR — ZDNet Korea
Column on Security: The Fall of Human-Centered Cybersecurity
Security2 min read
This opinion column says that Korean financial companies keep getting hacked, even though they have certificates, equipment, and regular checks. The author argues that the old 'people-driven' defense model no longer works in the AI era, and that companies need a 'zero trust' approach that watches everything inside their networks.
What happened
This autumn, many Korean financial firms were hit by hacks. These included banks, savings banks, capital companies, securities firms, and crypto exchanges. By mid-October, financial regulators had found 16 affected companies. The same attacker appears to have used AI tools to run large-scale automated attacks. A single person with a few servers and AI tools may have done much of this. The attacker even asked an AI where stolen financial data could be sold. The attacker's identity is still unknown.
Key numbers and facts
- 16 financial companies were hacked, according to regulators as of mid-October.
- A card company lost data on about 3 million people one year ago.
- One AI model found more than 10,000 high-risk weak points in one month.
- The average time before attackers used a weak point is 'minus 7 days'. This means attacks can happen a week before a fix is released.
- Some major banks took 15 to 68 hours to notice they had been broken into.
Why old defenses are failing
Most of the hacked companies had security certificates, good equipment, and regular checks. Many security teams have relied on patching holes and adding items to checklists. This works only if a company knows all its assets, blocks every weak point, and does this faster than attackers. AI breaks all three conditions. When one weak point is closed, attackers move to people, systems, shared servers, stolen accounts, or phone scams. The author compares this to a balloon: press one side and the other side bulges out.
Why it matters
The column says that the real goal is to see and check what happens after an attacker gets past the first defenses. This is called 'zero trust'. It means no user or action is trusted just because it is inside the network. The author also says AI can help defenders as much as attackers. Companies should use AI to watch normal behavior inside their systems and quickly cut off strange access. People should shift from checking alerts to making rules and taking responsibility. The author also says leaders should measure security by how fast they detect and stop intrusions, not by how many certificates they hold.
What to watch
- Whether the attacker is identified and how the investigation of the 16 companies develops.
- Whether Korean financial firms change from checklist-based security to zero trust.
- Whether banks restore or cut their spending on information protection.
- Whether regulators start judging companies by how fast they respond, not by what certificates they hold.
Glossary
- zero trust
- A security idea that never trusts a user or action just because it is inside the network, and checks everything all the time.