Detailed Analysis Training on the Lotte Card Data Leak Incident (Business Suspension)

- Public and private sector top-tier information security and personal information protection management system certification audit training in Korea - Preparation for ISMS-P certification strengthening due to comprehensive information security measures establishment - Management system GAP assessment and improvement plan development training - Individual training for ISMS-P initial audit, follow-up audit, and renewal audit - Professional information security training for acquiring excellent information security level enterprise certification

- Establishment of incident response manuals and training plans - Introduction of training cases such as penetration testing, DDoS, and APT - Sharing long-term information security strategies (~2027 or ~2030) of leading domestic companies - Introduction of information security activities of leading domestic companies - Education on Risk Management Framework (RMF) and Zero Trust implementation cases for electronic financial companies

- Understanding the establishment and inspection of personal information management systems in accordance with the Personal Information Protection Act - Inspection and status assessment of personal information processing systems - Creation of personal information flow charts and flow diagrams - Identification of personal information breach factors - Publication of personal information impact assessment summaries

As the leakage of linkage information occurred and became known, measures such as evaluating the importance and management status of CI (Connecting Information) were implemented. Accordingly, specialized training is being conducted.

Following the Privacy Audit 1 lecture, there has been a continuous failure to advance the tasks of internal privacy officers, along with a failure to preemptively prevent and block accidents due to maintaining the same routine as previous years and negligence. There is a lack of key-point internal training and communication by the Privacy Team due to the insufficient understanding of privacy protection among executives, including the CEO, CPO, division heads, and department heads. As the department in charge of personal information, the Privacy Team needs to improve the issue of continuously using only checklists for legal judgment and inspection (inspections based on minimum legal provisions have many blind spots). As accurate inspections based on precise judicial precedents and sanctions are required, it is necessary to conduct training on accurate knowledge.

Establishment of a reporting system, including the promotion of various agendas for the Privacy Policy Council and Working-level Council, and reporting the results of inspections on safety measures and legal compliance by the Chief Privacy Officer (CPO) to the CEO. There is a need to establish and implement a self-audit system for personal information to conduct professional internal preliminary investigations and inspections regarding recent hacking and data breach incidents. Recognizing that existing certification systems such as ISMS-P cannot prevent accidents. Despite the need to develop audit checklists reflecting diverse services and industry characteristics and to carry out colorful and extensive tasks such as internal personal information files and business flow analysis for partners (over 1,000) and branches (over 100), these tasks are not being implemented. Furthermore, despite the need to defend various blind spots, experts are unable to do so due to a lack of knowledge. Accidents continue to occur and risks remain because appropriate audits of existing security systems are not being carried out, and those previously considered experts in management systems are not actually experts. Through this study, we aim to eliminate blind spots and strengthen the inspection of existing security systems (promoting detailed inspections), derive improvement measures, and proceed with reporting.

As a security audit task for the Information Security Division, provide 2026 cases to refer to when conducting on-site audits, along with specific inspection plans (due diligence) that reflect the characteristics of the audit, and provide training to enable improvements after reviewing existing work systems.

In Financial AI Security (PART 1. Basics), I provided an overview of AI security. Please note that this is a practitioner's training session on the AI inspections required during actual security reviews for penetration testers (Red TEAM). This lecture contains practical content and explains how to perform penetration testing on technical aspects (including checklists). When studying, you may find AI difficult, or you might find that many companies have failed to apply AI guidelines because they are focused on modeling, making reviews challenging. I expect many companies have received various feedback during audits regarding the establishment of AI security governance. This is naturally because there is no clear evidence of AI security within internal operations. Now is the time to establish it. I hope you study AI security and pursue a path as an AI security professional.

Finally, I feel that the AI security review (NIS/FSI) checklists, which have been vaguely positioned over the past 7–8 years, are now accurate from a practitioner's perspective, and I have established a clear framework for how to change, establish, and operate the management system. I will explain what AI security is and how it should be improved after June 2026, based on the standards of South Korea's top-tier companies (those with the highest level of information security). (This is not a basic or conceptual explanation*) I have developed this training divided into PART 1 (Basics & Overview) and PART 2 (Advanced & Security Review), so please refer to it.

This training was created to first help privacy officers recognize and understand the requirements for establishing a proactive protection system, as previously announced through the June 2026 Personal Information Protection Act and the Personal Information Protection Commission's (PIPC) compliance inspections. It aims to help companies review their current status, identify areas for improvement, and establish future action plans. Based on over 8 years of experience in providing advisory and consulting services for personal credit information protection, this course is designed to support strategy formulation and the preparation of reporting documents for executive management.

The shortage of PMs in security consulting firms is a persistent issue. Consequently, there are many cases where individuals in their 40s and 50s from completely different fields have been entering the industry to handle PM duties and client communications. Since these PMs in their 40s and 50s lack experience in technical areas, consulting, and security, they find the work very challenging. They often join with the mindset of learning through handovers from other PMs. I have also been providing training and handovers to these PMs based on the following content, and the satisfaction levels have been high.

Achieved the highest rating for all clients over 6 years of performing Personal Information Protection Level Evaluation consulting for public institutions (covering various types from central administrative agencies to public enterprises, small-scale public institutions, and local governments), maintained the highest rating for all (continuous consulting experience with the same institutions), and holds a track record of achieving a perfect score of 100 (ranked 1st nationwide). Based on the 2026 manual, it is possible to effectively allocate the necessary tasks and performance records for writing quantitative/qualitative reports considering the strengthened penalties and changed indicators following the Coupang incident. Depending on the company's situation, it is fully possible to be designated as a best practice through either over-investment or strategic passive response.

Insufficient capability to audit new technologies (cloud management systems) due to a lack of theory and knowledge among management system inspection personnel. Training to strengthen the expertise of personnel who proactively prevent incidents by identifying management system deficiencies to protect companies from hacking. Training for existing infrastructure and penetration testing personnel to transition into management system roles. Securing definitive capabilities and materials through the provision of back data!

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

As PaaS (previously categorized as WEB/WAS) in public and private cloud environments is integrated into in-house PaaS operations, this training is designed for Infrastructure Project Leaders (PLs) overseeing approximately 10 infrastructure inspection personnel, as well as vulnerability assessment specialists. The curriculum covers certification requirements such as ISMS-P, including cloud asset identification, asset classification, importance rating, and risk assessment reflection. It also addresses the 2026 Financial Company Security Standards (for Electronic Financial Infrastructure Vulnerability Analysis and Evaluation), which include the establishment and strengthening of container inspection and private cloud management system inspection items, as well as the addition and modification of virtualization and cloud items within Critical Information and Communication Infrastructure.

Lack of back data for private cloud inspections!! A severe shortage of experienced personnel for IaaS inspections!! Improve practical skills by providing back data and utilize it for various certifications such as Major Information and Communication Infrastructure, Financial Security Institute (FSI) assessments, ISMS-P, ISO27001, etc. Professional training for Infrastructure Project Leaders (PLs) who manage around 10 infrastructure inspection personnel. Providing inspection data and understanding of the technical areas within the cloud management framework!

Providing insights and materials for overall management of penetration testers (WEB, Mobile, HTS) targeted at Project Leaders who oversee financial company mock hacking/penetration testing. Situations have occurred where "blank" reports are repeatedly submitted when no vulnerabilities are found in each part (the same applies to the public sector). Therefore, controls are implemented to ensure that inspection results for each item are produced in the same format as educational materials. Perform inspections tailored to each theme and utilize them for security reviews and internal security deliberations to verify results.

Conducting Windows server competency training to break the trend of new and career-transitioning security consultants focusing solely on Linux servers. Understanding the Windows OS and its relationship with servers and programs installed on the OS, such as PC, WEB, WAS, and DBMS. Understanding vulnerabilities and continuing vulnerability assessment and improvement activities.

Education on the most basic Linux server inspection methods and items due to the continuous assignment of new security consultants for vulnerability assessment and the continuous placement of experienced professionals from other fields into management roles. Risk assessment for risk evaluation (remediation planning) and implementation review. Understanding and application of third-party security solutions. Establishment of the ISMS-P management system through appropriate analysis of technical and administrative domains.

Classification of inspection items and establishment of an inspection plan (strategy) during network inspection Establishment of inspection criteria considering the risk and difficulty of actions Inspection of network service items and strategies for utilizing server access control solutions Command-based inspection after remote network access and preparation of risk assessment reports Interviews with network personnel and application of manual inspection items

Career concerns in security consulting: 5 hours of audio explanations covering career solutions from entry-level to 30-year veterans. Includes mental stability and salary negotiation strategies for new security consultants or those struggling to adapt. Includes methods for upgrading job skills and improving internal/external reputation. A lecture designed to resolve concerns for those considering a job change or career path shift.

Training on identifying the status of and performing inspections on personal (credit) information processing systems in accordance with the Notification on Measures to Ensure the Safety of Personal Information and Appendix 3 of the Credit Information Supervision Regulations.

Vulnerability analysis and evaluation for electronic financial infrastructure as of 2025, covering DBMS, WAS (PaaS), and PC based on the revised standards for critical information and communications infrastructure in the second half of 2025. Additionally, penetration testing explained according to the standards revised in the second half of 2025, including mobile penetration testing. Expect skill improvement through the transfer of know-how, along with fast and accurate inspection methods and remediation plans.

This course is a foundational learning program that covers Introduction to Information and Communication Technology, one of the core theories in computer engineering. Through this course, learners can understand the basic structure and operating principles of computers, and learn the principles and applications of information and communication technology based on this foundation. The course is structured to provide comprehensive learning from the processes of information generation, transmission, processing, and storage to data communication methods in network and internet environments. In addition to the basic concepts of information and communication technology, by understanding the trends and roles of information and communication technology utilized in real life and across industries, this course provides a solid theoretical foundation for learners who are first entering the fields of computer engineering and information and communication technology. 👉 By taking this course, learners can build a fundamental foundation in information and communication technology that encompasses computers and networks, and further utilize it for advanced learning or preparation for related certifications.

Cyber security threats are increasing every year, stealing personal information and abusing privacy. This course covers security issues and security activities that employees must know and follow in their work and personal lives.

IT services are rapidly transitioning to cloud environments. You will learn security practices from basic virtual infrastructure construction to security threat monitoring and vulnerability diagnosis for each area to secure the Amazon AWS cloud environment.

Through this course, you can study short answer and descriptive questions from past practical exams for the Information Security Engineer.

This course is designed to prepare you for the Information Security Engineer written exam by concisely summarizing core theories and strengthening practical skills through problem-solving. Take a step closer to obtaining your Information Security Engineer certification with past exam analysis and practical preparation strategies.

This lecture is designed to make personal information protection education interesting and ‘social engineering-based.’ Rather than covering the revisions to the Personal Information Protection Act, it focuses on real-life information protection threat cases and responses.

You can effectively study the contents of the Information Security Engineer practical exam questions and obtain the Information Security Engineer practical qualification.

This lecture provides a general guide on how to prepare while studying when you want to choose a career in IT security penetration testing, and what questions and answers to prepare for the interview. I will share my experience working as a penetration testing consultant, at large companies, and in the financial sector, and currently running a penetration testing consulting business.

This online course covers everything from the basic concepts of information security to the latest security issues, focusing on core content for obtaining certification. It enables efficient exam preparation through theory and practical mock exams that reflect the latest trends, and is structured so that even beginners can easily follow along.

As AI systems become agentic and expand beyond text into image, audio, and multimodal capabilities, security threats are becoming significantly more complex. This lecture analyzes the latest security threats and attack techniques faced by AI Agents and Multimodal LLMs, as well as real-world cases, from an AI Red Teaming perspective.

"Nationally Certified Industrial Security Manager" New Renewal Version Final Update Completed!! This course is designed to help you obtain the Nationally Certified Industrial Security Manager certification by providing a systematic understanding of industrial security from a management perspective. Rather than focusing on rote memorization, the content is structured so that even non-security majors can understand the concepts, structure, and flow of industrial security. It is designed not only for exam preparation but also for practical application and career expansion.

This course systematically teaches practical Docker skills (installation→operation→automation→security) and comprehensively covers the latest security threats and countermeasures in each section. It features a hands-on approach where you learn by following along with practical exercises. This curriculum is highly recommended for DevOps engineers, infrastructure engineers, and security practitioners who want to experience the latest container/cloud environments in real-world scenarios.

Feeling overwhelmed by where to start with AI auditing? AI has moved beyond a mere technology trend and is rapidly expanding into corporate decision-making, workflow automation, customer service, recruitment, security, and risk management. However, compared to the speed of AI adoption, not many people systematically understand questions like: "Is the AI being properly controlled?", "Can we trust the AI's judgment?", or "What risks could arise from the data, models, and operational processes?" In particular, those working in IT auditing, security, internal control, and project management often face these concerns: - How does AI auditing differ from traditional IT auditing? - Is it enough to just look at the code for an AI model, or must we examine the data and training process as well? - How do AI governance, risk, bias, explainability, MLOps, and incident response connect to one another? - Where should I start to understand the concepts covered in AI auditing certification courses like AAIA from a practical perspective? This course was created specifically to resolve this sense of uncertainty. For about 20 years, I have gained experience in IT service planning, development, PM, collaboration platform operation, groupware construction, chatbot service planning, and security and audit-related tasks. I have firsthand experience in how systems are planned, developed, and operated in actual organizations, and how failures, changes, security, and user requirements are interconnected. Furthermore, I have synthesized the perspectives of IT auditing and AI auditing through CISA and AAIA study programs. In this course, rather than diving deep into complex AI technology through math or development, I focus on the core concepts that auditors and IT practitioners must understand. We will examine AI systems by breaking them down into the flow of data, models, operations, security, governance, risk, and audit procedures, and summarize what controls and checkpoints are required at each stage. Through this course, students will understand that AI auditing is not simply "evaluating AI," but rather the task of inspecting governance, risk, and control systems to ensure that AI is used safely and responsibly within an organization. This course is suitable for: - Those new to AI auditing. - Those in IT auditing or security who want to expand into the AI domain. - Those who want to organize AI governance and risk from a practical perspective. - Those who want to grasp the overall concepts before starting AI audit-related studies such as AAIA. Upon completing the course, you will be able to answer the following questions yourself: - What components make up an AI system? - What should an AI auditor check during the data, model, and operation stages? - Why are AI governance and Responsible AI important? - How are AI risk, bias, explainability, privacy, and security connected? - What perspectives and evidence should be included in an AI audit report? In the rapidly changing era of AI, the ability to manage and inspect technology to make it trustworthy is just as important as the ability to use it well. This course is an introductory program for those who want to understand the big picture of AI auditing step-by-step from the beginning. Let's build the first standard for looking at IT and AI from an auditing perspective together.

You can understand the concept and technology of blockchain and conduct ISMS-P certification audits specialized for virtual asset exchanges.

[Introduction to Security Incident Response: Learning through Scenarios of Web Server Hacking, Ransomware, and Account Takeover] This course examines why various information security incidents—such as web server hacking, ransomware, account takeover, and internal penetration—occur and how they spread, categorized by incident type. Students will follow each incident scenario to understand the attack flow, analyze the core causes of the incident, and learn how to resolve issues and prevent recurrence through security architectures such as firewalls, DMZ, access control, privilege management, backup, and log monitoring. Rather than a simple explanation of security concepts, this is a scenario-based introduction to information security that provides a comprehensive understanding from root cause analysis to resolution strategies.

As the adoption of generative AI accelerates, new security threats such as corporate confidential information leaks and prompt injections are surging. This course covers strategies for embedding security throughout the entire AI lifecycle, based on the National Intelligence Service (NIS) guidelines' 30 core security measures and 15 practical threat cases. It also addresses security issues in the latest AI trends, such as Agentic AI and Physical AI, and presents methods for establishing governance frameworks that can be immediately applied in practice.

This is a course where you can learn the basics of web technology. You can learn the basics of web technology in a short period of time. If you are interested in studying or getting a job related to the web, you must take this course!