Korea's Financial Security Institute Widens Cloud Provider Checks

From consoles to exposed assets

Since 2023, the FSI has probed cloud providers' virtual resource management systems for security weaknesses. It did this to make up for the limits of paper-based reviews such as evidence submissions, on-site inspections and demonstrations. That technical assessment has centered on portals and consoles.

The institute plans to develop a new methodology for reducing attack surface. It will also use artificial intelligence to identify which assets to inspect and to spot vulnerabilities most likely to be exploited. The aim is to make inspections more efficient and more consistent.

Why now

The institute points to increasingly sophisticated cyberattacks that exploit flaws in externally exposed assets. It also notes that financial firms rely more and more on cloud services. A weakness at one provider could therefore cause chain damage across many financial companies. The goal is to find a provider's latent vulnerabilities in advance so they can be fixed.

This year the FSI ran a pilot assessment with some cloud providers. It detected security flaws that could have led to personal data leaks. The institute says this confirmed that the method works.

The CSP safety assessment works as follows. The FSI checks cloud providers' security and operating systems on behalf of financial firms, and the financial sector then shares the results. A draft Digital Financial Safety Act is due next year, in the first quarter. It is meant to extend security rules to cloud providers and similar companies.