2024.08.06. The Fair Economy — "Home network devices such as in‑home terminals (wall pads) are supposed to meet the security requirements stipulated by relevant laws, but there are no concrete criteria to verify compliance. In effect, the government is forcing the use of only products that have received 'Internet of Things (IoT) Security Certification.'" This is the statement of a client official who required that only products with IoT security certification be proposed in housing construction projects.
In several newly built apartment complexes, home network equipment is being installed, yet there is no concrete standard to verify whether the equipment meets the security requirements mandated by law. Consequently, some in the information and communications technology (ICT) sector argue that the government is taking a passive approach to promote 'IoT security certification.' Obtaining the certification for home network devices can require fees of up to 20 million won. Critics say the government is over‑regulating and ignoring the burden on equipment manufacturers.
Legislation to strengthen security in response to mass hacking of apartment resident households
Three ministries, including the Ministry of Science and ICT, the Ministry of Trade, Industry and Energy, and the Ministry of Land, Infrastructure and Transport, revised the joint announcement 'Installation and Technical Standards for Intelligent Home Network Facilities' in December 2021 to strengthen the security of home networks installed in apartments and officetels, implementing it from July 2022, the following year.
This is seen as a measure taken after an incident in October 2021 in which interior video footage of apartment resident units was illegally disseminated, aiming to prevent similar occurrences.
At that time, home network devices in numerous apartment units were simultaneously hacked, and their cameras captured and distributed interior living spaces without consent.
As citizens' anxiety grew over the fact that cyber threats have become not someone else's problem but their own, the government rushed to amend the notice to strengthen home network security.
The main contents of the revised notice, prepared within three months of the hacking incident, include: ▲ providing a maintenance and management manual for home network equipment to the apartment management entity ▲ separating home networks by household through physical or logical methods ▲ installing home network equipment that meets security requirements such as confidentiality, authentication, and access control, and ▲ recommending the installation of devices that have received information security certification under the Information and Communications Network Act.
Among these, the security requirements for home network equipment are specifically stipulated in 'Appendix 1' of the notice. The security requirements consist of five areas: data confidentiality, data integrity, authentication, access control, and transmission data security.
'Data confidentiality' requires the application of encryption technologies such as cryptographic algorithms and key generation and management, and access control management technologies for user identification information, authentication information, and personal data, so that malicious hackers or unauthorized persons cannot view the data content. However, workgroup switches that handle only simple transmission, not data processing (creation, reading, writing, modification, deletion, storage, etc.), are excluded from the confidentiality requirement.
'Data integrity' means that technologies such as hash functions and digital signatures must be applied to user identification information, authentication information, and personal data to prevent tampering. This also does not apply to workgroup switches that handle only simple transmission.
'Authentication' means that identity verification and authentication functions must be implemented using electronic signatures, ID/password, and one-time passwords (OTP).
'Access control' means that technologies such as asset and user identification, IP management, and terminal authentication must be implemented to classify user types and grant or restrict access rights, thereby ensuring that only authorized users can access the system.
'Transmission data security' means that data transmitted between authorized home network equipment must not be leaked, stolen, or subject to flow redirection.
The government requires home network devices such as wall pads to meet the security requirements stipulated in the notice, and it recognizes wall pads that have obtained the 'IoT security certification'—the information security certification under Article 48‑6 of the Act on Promotion of Information and Communications Network Utilization and Information Protection—as having satisfied those requirements.
The government applied this requirement to cases where a housing construction business plan approval is applied for on or after the implementation date of the revised notice, July 1, 2022.
Specific criteria for verifying compliance with security requirements are missing
Recently, in both private and public housing construction projects, procuring agencies have restricted proposals and deliveries to wall‑pad products that have received 'IoT Security Certification,' effectively forcing what should be a voluntary certification to function as a de‑facto mandatory one.
According to Fair Economy reporting, many institutions and companies currently promoting housing construction have required in their RFPs that home network devices such as wallpads be proposed only if they have received the 'IoT security certification'.
In the case of municipality A, the 'Public Rental Housing Youth Village Construction' project stipulated that wall‑pad products must be devices that have obtained certification in accordance with relevant laws.
Energy‑related agency B also imposed, for the 'New Construction of Official Residence Home Network Equipment Purchase' project, the condition that the products must have 'IoT Security Certification.' Specifically, wall pads must have at least a 'Basic+' level certification. IoT Security Certification is fundamentally divided into three grades—Light, Basic, and Standard—and if additional security technologies or functions are applied beyond the evaluation items of each grade, a plus (+) can be awarded. In total, the certification can be subdivided into six levels.
C, an institution conducting public housing construction in the metropolitan area, also demanded that wallpads and other equipment be accompanied by a certificate proving they have received the 'IoT security certification' in the 'apartment information and communication construction within a city development project area' project.
Major domestic construction firm D has also adopted a policy of using only home network equipment that has obtained 'IoT Security Certification,' and is applying this policy to its multifamily housing construction sites.
Representatives from these companies and agencies said, 'Although the notice stipulates that home network devices such as wallpads must meet the security requirements, the government has not established concrete criteria to verify compliance. Consequently, they have no choice but to restrict proposals and deliveries to products that have received the IoT security certification.'
In response, a Ministry of Science and ICT official answered, 'The notice does not force the use of only home network equipment that has received the IoT security certification. If a non-certified product is to be introduced on site, it is sufficient to verify whether it meets the security requirements of the notice.' Specifically, the official said that communication supervisors at each site would prepare a construction status evaluation report, conduct an inspection of the 'intelligent home network equipment', and thereby confirm whether the home network equipment meets the security requirements of the notice.
The government, which imposes obligations, is passive in preparing verification measures
However, the opinions of the construction sites are different from those of the Ministry of Science and ICT.
A municipal official overseeing home network installation projects said in a call, "It is inappropriate to ask communication auditors in housing construction projects to determine whether home network devices meet the security requirements. This means that compliance is not verified at the proposal stage but is checked retroactively on site, which could extend the construction period if the equipment is found not to meet the requirements."
Another agency official pointed out that 'the act of imposing on frontline agencies and companies the responsibility to verify compliance with the notice's security requirements, without the government establishing concrete verification criteria, is effectively a measure that forces the IoT security certification.' He further speculated that 'perhaps the government created a kind of 'escape loophole' by including a provision to verify security requirement compliance, in order to avoid criticism of overregulation.'
From the perspective of home network equipment manufacturers such as wallpad producers, the 'IoT security certification' is also considered burdensome.
A staff member from a home network device manufacturer, requesting anonymity, said, "The government has emphasized that the 'IoT Security Certification' is a statutory certification but a voluntary one, yet people working on the front lines of apartment construction do not trust that claim. The notice merely lists abstract security requirements without specifying what technologies, functions, or measures each product must implement to meet them."
He explained, "To obtain the 'IoT Security Certification,' manufacturers must pay certification fees ranging from 6 million to 20 million won per model. The government promised to reduce the burden by lowering fees for 'derived models'—those with minor changes from a base model—to about 700,000 to 1.4 million won. However, when the government urges active firmware updates to patch security vulnerabilities, any software‑induced 'configuration drift' requires re‑certification. Consequently, the burden has only increased and cannot be reduced."
The industry anticipates that unless a checklist-style verification standard equivalent to the evaluation items of the IoT security certification is established, sites will have no choice but to use only certified products. Moreover, they worry that project owners, aiming to introduce safe products, will increasingly demand equipment with higher-level security certifications, ultimately increasing the burden on home network equipment manufacturers.
Information security non-experts find it difficult to verify security requirements
Criticism has arisen over asking communication auditors without information‑security expertise to verify whether home network devices installed on site meet the notice’s security requirements.
It is pointed out that ICT has now been subdivided into various specialized fields, and it is questionable whether it is appropriate to ask communication supervisors without information security expertise to verify compliance with the notice's security requirements.
A CEO of a company providing ICT consulting said, "In the past, telecommunications meant services like voice calls or Morse‑code telegraphy. Today, thanks to technological advances, we have a variety of wired and wireless communication means—mobile networks, Wi‑Fi, Bluetooth, optical communication, satellite communication—and protocols, infrastructures, and systems are categorized into countless types depending on their purpose. Consequently, national ICT technical and professional qualifications have become highly specialized, with dozens of distinct certifications."
He added, "It is no longer realistic for a single ICT professional to be expert in every field. Yet the government’s policies for training and deploying communication engineers remain stuck at a decades‑old level. Isn’t it odd that the current situation permits non‑security specialists to handle specialized information‑security tasks for intelligent home network equipment?"
There are also reports that communication supervisors at front-line sites are even requiring construction contractors to obtain ICT-related certifications.
A staff member of a construction firm currently building apartments said, "A communication auditor told us that if we obtain a preliminary certification from the Korea Association for ICT Promotion (KAIT) for the Ultra‑High‑Speed Information and Communications Building Certification, the audit will be passed. I’ve also heard that, given the recent home‑network issues, they are now asking for KAIT’s preliminary home‑network building certification as well."
However, the Ultra‑High‑Speed Information and Communications Building Certification and the Home‑Network Building Certification run by KAIT are merely private voluntary certifications. Since they are not statutory certifications, they have no legal effect, yet auditors are using them to evade responsibility.
A professor of an ICT‑related department at a university in the Seoul metropolitan area said, "It is now an era where even communication engineers must be distinguished by specialty. In medicine, physicians obtain general licensure and then specialize. In the ICT industry, information‑security tasks should be handled by information‑security experts."
Proposal for a checklist and an accredited test‑report issuance system
The industry proposed that the government should establish specific measures to verify whether home network equipment meets security requirements.
First, they propose creating a checklist-style standard to verify security requirement compliance. The industry commonly states that the five security requirements stipulated in the current notice are merely abstract concepts, making it difficult to assess the security of home network equipment on site.
Since the 'IoT Security Certification' already defines information‑security criteria for each certification domain, some suggest converting these into a checklist for on‑site verification of compliance.
Additionally, just as the IoT security certification differentiates certification criteria by level, it is also suggested that on-site verification levels should be tiered according to the type or purpose of home network equipment.
Furthermore, there is an opinion to establish a system for accredited testing institutions to issue test certificates confirming that home network equipment meets the security requirements.
A similar case occurred in 2020 in the government's public Wi-Fi project and school wireless network construction project, where the 'Wi-Fi Alliance certification' requirement became an issue. At that time, the National Information Society Agency (NIA), which was entrusted with project execution by the government and provincial education offices, imposed a specification restriction requiring Wi-Fi equipment manufacturers to propose only WAPs that had received the certification.
The industry protested, noting that obtaining the certification required exorbitant fees of tens of millions of won per model, and the government later withdrew the certification requirement.
Instead, 'accredited test certificates' attracted attention as a means to demonstrate the performance and functional stability of WAPs. The Telecommunications Technology Association (TTA) establishes test items and procedures through consultation with clients for IEEE 802.11 wireless LAN products, and issues TTA-accredited test certificates after conducting the tests.
Home network equipment manufacturers say that if the government establishes a system whereby accredited testing institutions test whether home network equipment meets the security requirements and issue accredited test certificates, it would help reduce the industry's burden.
A Ministry of Science and ICT official said, "After verifying the facts, we will consider ways to reduce the burden on home network device manufacturers and ensure the notice is implemented faithfully."
0 Comments
No comments yet.