Bank of Korea to Run Mock Hack on Its AI-Ready Office Network

The Bank of Korea will run a penetration test in November and December that assumes an outside attacker has taken over an employee's work device. The aim is to check whether its revised network-separation system, redesigned to make AI use easier, can withstand a real cyberattack.

According to financial industry sources, external security specialists will carry out the vulnerability assessment and simulated hacking. The test starts from the premise that a legitimate work laptop or tablet has been compromised. Testers will then try to break into internal systems, extract data or disrupt operations. They will also probe external access routes, internal wired and wireless networks, and the bank's dedicated enterprise 5G network.

Zero trust under test

The central question is whether internal systems stay safe now that looser network separation has widened external connectivity. Even if an attacker gets past the first line of defense, the bank wants to know whether further intrusion and spread of damage can be stopped. That includes testing its zero trust model, which continuously verifies users and devices and controls access rights.

The exercise uses a black-box approach, so testers get no advance information about internal systems. It covers 246 targets, including servers, network and security equipment and administrator screens. Testers will also look for paths that let an ordinary user account gain administrator privileges. If flaws turn up, the bank will change security settings and consider adopting new security systems where needed.

Why it matters now

The test coincides with a company-wide rollout of the new work network. The bank is moving away from physically separate PCs for internal work and internet use, toward a single PC that handles both. It piloted the setup with about 200 employees last year and is now extending it to all staff.

Recent incidents raise the stakes. According to the Financial Services Commission, breaches had been confirmed at 16 financial firms as of October 14, including Shinhan, KB Kookmin, Hana and BNK Busan Bank, with roughly 100,000 personal records leaked. In an emergency inspection of 555 financial firms, 130 reported weak security management. Regulators pointed to poor authentication and access control on exposed systems, and have stepped up security checks across the sector.

The result will serve as an early gauge of whether relaxed network-separation rules can work safely in finance.