Penetration Testing Lecture 2 (Practice Environment 2 provided)

Vulnerability analysis and evaluation for electronic financial infrastructure as of 2025, covering DBMS, WAS (PaaS), and PC based on the revised standards for critical information and communications infrastructure in the second half of 2025. Additionally, penetration testing explained according to the standards revised in the second half of 2025, including mobile penetration testing. Expect skill improvement through the transfer of know-how, along with fast and accurate inspection methods and remediation plans.

Since most large corporations and financial institutions are conducting penetration testing in addition to standard mock hacking, there is a recent need to establish new roles and secure capabilities to perform intrusions as a "RED TEAM" in the literal sense. Therefore, beyond simple WEB and APP mock hacking, we have opened a training course where participants can discover scenarios for infiltrating servers and practice executing large-scale personal information leaks. + Provision of server and website environments for penetration testing + Sharing of hacking tools and methodologies

The grounds previously used to pursue certifications such as ISMS-P, including penalty reductions, have become even more significant. With the revision of the Enforcement Decree of the Personal Information Protection Act following a series of large-scale personal information breaches involving Coupang, SKT, Lotte Card, and others, an unprecedented system has been introduced that provides a reduction in administrative fines—40% of the 10% of revenue—when a proactive protection system has been established before an incident occurs. Accordingly, a legal basis has now been established through the reduction system for the priority introduction of measures such as inspections of personal information processing systems and the securing of dedicated personal information protection personnel, which had previously been difficult to manage and inspect under the existing Personal Information Protection Act. Therefore, additional items must be reflected in the personal information protection regulations, additional records of personal information protection activities must be prepared, and the time has come to review budgets, including records of the implementation of personal information protection solutions. These measures, scheduled to take effect from the second half of 2026, must be reflected in the personal information management system without delay so that reporting to the CPO can be carried out.

This training explores the service privacy reviews pursued by Naver, Kakao, and Toss. It is designed to improve the capabilities of domestic consulting and privacy protection teams by identifying where service-specific privacy protection should be applied and explaining what to check during service reviews. Rather than covering only general laws or standard review checklists, this is an in-depth review training program that also provides a checklist.

The purpose is to improve, compared with last year, awareness campaigns that are not defined in the regulations and often end merely with the distribution of promotional gifts, by referring to best practices from various organizations, given the current situation in which the performance of events and campaigns such as Information Security Day or Personal Information Protection Day, held monthly or annually, is gradually declining. These events must now move beyond gift-distribution activities organized by the Information Security Team and become events in which all employees participate and uphold security together. It is necessary to build mutual understanding through the establishment of a communication system for embedding security into the organization. Ultimately, employees must have a good understanding of information security and the Personal Information Protection Act so that the organization can realistically protect itself from hacking and insider threats. Since the departments other than the Security Team—including those responsible for commissioning various projects, managing entrusted service providers, controlling applications and security settings, planning various informatization projects, and conducting IT audits—are designated to take overall responsibility, the Security Team is distributing security-related tasks among the respective departments. However, the current situation is that each department is merely expressing dissatisfaction. This opportunity should therefore be used to move away from that situation, as internal consultative bodies alone are insufficient. Security-related scoring criteria must be reflected in the powerful personnel evaluation system. Through unannounced audits, those who fail to comply should be disciplined through pay reductions or suspension, while those who properly observe security requirements and demonstrate achievements in support of security should receive substantial financial rewards through an incentive system. Security must be embedded in the organization so that employees take the initiative themselves. Accordingly, department and individual evaluation KPIs should be adjusted through a report to the CEO under the direction of the CISO. In addition, through a system for designating department-level information security officers and personnel in charge, the organization should strengthen its human security framework against hacking and information leakage—including the leakage of documents managed by each department and the management of service providers—by providing position allowances for these responsibilities.

Massive leaks of citizens' personal information due to recurring hacking incidents of the same type at credit card companies and insurers. Other personal information controllers also suffer repeated incidents, failing to prevent the same causes and attack methods. Detection is impossible despite spending budgets on advanced monitoring, and while personnel are continuously hired, reporting systems and internal regulations remain inadequate. This is part of a lecture for ongoing research and guidance aimed at resolving the persistent customer dissatisfaction, inconvenience, and total loss of service trust caused by these incomprehensible management systems.

As the leakage of linkage information occurred and became known, measures such as evaluating the importance and management status of CI (Connecting Information) were implemented. Accordingly, specialized training is being conducted.

Following the Privacy Audit 1 lecture, there has been a continuous failure to advance the tasks of internal privacy officers, along with a failure to preemptively prevent and block accidents due to maintaining the same routine as previous years and negligence. There is a lack of key-point internal training and communication by the Privacy Team due to the insufficient understanding of privacy protection among executives, including the CEO, CPO, division heads, and department heads. As the department in charge of personal information, the Privacy Team needs to improve the issue of continuously using only checklists for legal judgment and inspection (inspections based on minimum legal provisions have many blind spots). As accurate inspections based on precise judicial precedents and sanctions are required, it is necessary to conduct training on accurate knowledge.

Establishment of a reporting system, including the promotion of various agendas for the Privacy Policy Council and Working-level Council, and reporting the results of inspections on safety measures and legal compliance by the Chief Privacy Officer (CPO) to the CEO. There is a need to establish and implement a self-audit system for personal information to conduct professional internal preliminary investigations and inspections regarding recent hacking and data breach incidents. Recognizing that existing certification systems such as ISMS-P cannot prevent accidents. Despite the need to develop audit checklists reflecting diverse services and industry characteristics and to carry out colorful and extensive tasks such as internal personal information files and business flow analysis for partners (over 1,000) and branches (over 100), these tasks are not being implemented. Furthermore, despite the need to defend various blind spots, experts are unable to do so due to a lack of knowledge. Accidents continue to occur and risks remain because appropriate audits of existing security systems are not being carried out, and those previously considered experts in management systems are not actually experts. Through this study, we aim to eliminate blind spots and strengthen the inspection of existing security systems (promoting detailed inspections), derive improvement measures, and proceed with reporting.

As a security audit task for the Information Security Division, provide 2026 cases to refer to when conducting on-site audits, along with specific inspection plans (due diligence) that reflect the characteristics of the audit, and provide training to enable improvements after reviewing existing work systems.

In Financial AI Security (PART 1. Basics), I provided an overview of AI security. Please note that this is a practitioner's training session on the AI inspections required during actual security reviews for penetration testers (Red TEAM). This lecture contains practical content and explains how to perform penetration testing on technical aspects (including checklists). When studying, you may find AI difficult, or you might find that many companies have failed to apply AI guidelines because they are focused on modeling, making reviews challenging. I expect many companies have received various feedback during audits regarding the establishment of AI security governance. This is naturally because there is no clear evidence of AI security within internal operations. Now is the time to establish it. I hope you study AI security and pursue a path as an AI security professional.

Finally, I feel that the AI security review (NIS/FSI) checklists, which have been vaguely positioned over the past 7–8 years, are now accurate from a practitioner's perspective, and I have established a clear framework for how to change, establish, and operate the management system. I will explain what AI security is and how it should be improved after June 2026, based on the standards of South Korea's top-tier companies (those with the highest level of information security). (This is not a basic or conceptual explanation*) I have developed this training divided into PART 1 (Basics & Overview) and PART 2 (Advanced & Security Review), so please refer to it.

This training was created to first help privacy officers recognize and understand the requirements for establishing a proactive protection system, as previously announced through the June 2026 Personal Information Protection Act and the Personal Information Protection Commission's (PIPC) compliance inspections. It aims to help companies review their current status, identify areas for improvement, and establish future action plans. Based on over 8 years of experience in providing advisory and consulting services for personal credit information protection, this course is designed to support strategy formulation and the preparation of reporting documents for executive management.

The shortage of PMs in security consulting firms is a persistent issue. Consequently, there are many cases where individuals in their 40s and 50s from completely different fields have been entering the industry to handle PM duties and client communications. Since these PMs in their 40s and 50s lack experience in technical areas, consulting, and security, they find the work very challenging. They often join with the mindset of learning through handovers from other PMs. I have also been providing training and handovers to these PMs based on the following content, and the satisfaction levels have been high.

Achieved the highest rating for all clients over 6 years of performing Personal Information Protection Level Evaluation consulting for public institutions (covering various types from central administrative agencies to public enterprises, small-scale public institutions, and local governments), maintained the highest rating for all (continuous consulting experience with the same institutions), and holds a track record of achieving a perfect score of 100 (ranked 1st nationwide). Based on the 2026 manual, it is possible to effectively allocate the necessary tasks and performance records for writing quantitative/qualitative reports considering the strengthened penalties and changed indicators following the Coupang incident. Depending on the company's situation, it is fully possible to be designated as a best practice through either over-investment or strategic passive response.

Insufficient capability to audit new technologies (cloud management systems) due to a lack of theory and knowledge among management system inspection personnel. Training to strengthen the expertise of personnel who proactively prevent incidents by identifying management system deficiencies to protect companies from hacking. Training for existing infrastructure and penetration testing personnel to transition into management system roles. Securing definitive capabilities and materials through the provision of back data!

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

As PaaS (previously categorized as WEB/WAS) in public and private cloud environments is integrated into in-house PaaS operations, this training is designed for Infrastructure Project Leaders (PLs) overseeing approximately 10 infrastructure inspection personnel, as well as vulnerability assessment specialists. The curriculum covers certification requirements such as ISMS-P, including cloud asset identification, asset classification, importance rating, and risk assessment reflection. It also addresses the 2026 Financial Company Security Standards (for Electronic Financial Infrastructure Vulnerability Analysis and Evaluation), which include the establishment and strengthening of container inspection and private cloud management system inspection items, as well as the addition and modification of virtualization and cloud items within Critical Information and Communication Infrastructure.

Lack of back data for private cloud inspections!! A severe shortage of experienced personnel for IaaS inspections!! Improve practical skills by providing back data and utilize it for various certifications such as Major Information and Communication Infrastructure, Financial Security Institute (FSI) assessments, ISMS-P, ISO27001, etc. Professional training for Infrastructure Project Leaders (PLs) who manage around 10 infrastructure inspection personnel. Providing inspection data and understanding of the technical areas within the cloud management framework!

Providing insights and materials for overall management of penetration testers (WEB, Mobile, HTS) targeted at Project Leaders who oversee financial company mock hacking/penetration testing. Situations have occurred where "blank" reports are repeatedly submitted when no vulnerabilities are found in each part (the same applies to the public sector). Therefore, controls are implemented to ensure that inspection results for each item are produced in the same format as educational materials. Perform inspections tailored to each theme and utilize them for security reviews and internal security deliberations to verify results.