2024.08.05. The Fair Economy — Unexpected software (SW) problems can cause system failures at financial companies, and to prevent this, experts suggested that SW updates should not be rolled out company-wide all at once but should instead be implemented gradually, divided by target group. This is a point worth noting not only for the financial sector but for other industries as well.
The Financial Security Institute held a seminar titled "Current State and Future Direction of Korean Financial Security" at the Korea Financial Investment Association (KOFIA) in Yeongdeungpo District, Seoul on the 5th.
Last month, the information security firm CrowdStrike, while distributing its SW product update files to customers, encountered a specific file that conflicted with Microsoft's Windows operating system (MS Windows OS), causing the OS to abnormally halt with a "Blue Screen" symptom. As a result, numerous Windows OS-based systems worldwide that had installed CrowdStrike's SW stopped operating, leading to damage.
At the seminar, experts analyzed the course of the incident and shared opinions on how to prevent similar accidents from occurring in the future.
Before the event, Kim Cheol-ung, head of the Financial Security Institute, said, "This global cyber outage incident showed that a defect in a single SW can have a significant impact on the entire industrial ecosystem. In particular, the financial sector must be thoroughly prepared because digital accidents can directly affect people's financial lives."
About 100 officials from the financial industry, information security industry, and academia attended the seminar, where various financial security issues related to the cyber outage were discussed from diverse perspectives.
The seminar began with a presentation by Lim Gu-rak, head of the Cyber Response Headquarters at the Financial Security Institute, on 'The course of the incident and its impact on the domestic financial sector'. Lim said, "Cyber disasters like the CrowdStrike-triggered outage are likely to occur again in the future. It is necessary to discuss procedures for verifying the stability of security SW among SW developers and financial companies."
In the panel discussion that followed, Yoon Myeong-geun, a professor at Kookmin University, assessed the incident as a software supply chain problem stemming from insufficient verification of security solution patches. He stressed, "Rather than the cloud and network segregation issues that have been raised, the incident should be viewed as a problem with the software supply chain security system, which must verify and respond to the stability of software distribution."
Lee Seong-gwon, CEO of Enki White Hat, pointed out that Korea's unique network separation environment may have helped reduce some of the damage from this incident, but if not careful, failures such as OS conflicts can still occur even in a network separation environment. Lee also said, "Rather than setting institutional grades and comprehensively regulating data within institutions, it is necessary to distinguish the purpose and use of each system and data within an institution and establish and implement security policies appropriate for each."
Lee Jae-yong, CISO of KB Kookmin Bank, said that upon detecting a SW failure, updates should be halted immediately and a rapid rollback should be performed to ensure service safety. He also suggested that cyber resilience should be strengthened through regular disaster recovery drills to prevent similar incidents in the future.
Ji Jeong-ho, CISO of Toss Securities, said it is important for each company to establish and operate a safe SW distribution strategy tailored to its own environment. He said, "A representative method is the gradual SW distribution approach. The distribution order should be determined considering work and business impact." He also suggested systematically establishing rapid recovery strategies suitable for the corporate environment and continuously verifying through drills that recovery proceeds normally in the event of a failure.
The Financial Security Institute announced that, based on the discussions at the seminar, it will explore fundamental response measures for SW supply chain security with financial authorities, including the development of a "Financial Sector SW Supply Chain Security Checklist," to prevent similar incidents in the future.
0 Comments
No comments yet.