Geumchwipyeong Penetration Testing PL Training: WEB, Mobile, HTS

- Policy revision for establishing cloud management systems (CSP/MSP contracts and SaaS contracts) - Vulnerability assessment for ISMS-P/ISO27001 certification or major information communication/electronic financial infrastructure response in cloud environments (public/private asset identification and vulnerability remediation) - Security operations and incident response in cloud environments - ISO27017&ISO27018 certification response

- Strengthening understanding of inspections based on Privacy Impact Assessment checklist items - Finding and improving errors in personal information flow charts - Identifying and improving personal information breach factors - Understanding Privacy Impact Assessments and finding errors - Understanding Personal Information Protection Act and finding errors

Insufficient capability to audit new technologies (cloud management systems) due to a lack of theory and knowledge among management system inspection personnel. Training to strengthen the expertise of personnel who proactively prevent incidents by identifying management system deficiencies to protect companies from hacking. Training for existing infrastructure and penetration testing personnel to transition into management system roles. Securing definitive capabilities and materials through the provision of back data!

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

As PaaS (previously categorized as WEB/WAS) in public and private cloud environments is integrated into in-house PaaS operations, this training is designed for Infrastructure Project Leaders (PLs) overseeing approximately 10 infrastructure inspection personnel, as well as vulnerability assessment specialists. The curriculum covers certification requirements such as ISMS-P, including cloud asset identification, asset classification, importance rating, and risk assessment reflection. It also addresses the 2026 Financial Company Security Standards (for Electronic Financial Infrastructure Vulnerability Analysis and Evaluation), which include the establishment and strengthening of container inspection and private cloud management system inspection items, as well as the addition and modification of virtualization and cloud items within Critical Information and Communication Infrastructure.

Lack of back data for private cloud inspections!! A severe shortage of experienced personnel for IaaS inspections!! Improve practical skills by providing back data and utilize it for various certifications such as Major Information and Communication Infrastructure, Financial Security Institute (FSI) assessments, ISMS-P, ISO27001, etc. Professional training for Infrastructure Project Leaders (PLs) who manage around 10 infrastructure inspection personnel. Providing inspection data and understanding of the technical areas within the cloud management framework!

Conducting Windows server competency training to break the trend of new and career-transitioning security consultants focusing solely on Linux servers. Understanding the Windows OS and its relationship with servers and programs installed on the OS, such as PC, WEB, WAS, and DBMS. Understanding vulnerabilities and continuing vulnerability assessment and improvement activities.

Education on the most basic Linux server inspection methods and items due to the continuous assignment of new security consultants for vulnerability assessment and the continuous placement of experienced professionals from other fields into management roles. Risk assessment for risk evaluation (remediation planning) and implementation review. Understanding and application of third-party security solutions. Establishment of the ISMS-P management system through appropriate analysis of technical and administrative domains.

Classification of inspection items and establishment of an inspection plan (strategy) during network inspection Establishment of inspection criteria considering the risk and difficulty of actions Inspection of network service items and strategies for utilizing server access control solutions Command-based inspection after remote network access and preparation of risk assessment reports Interviews with network personnel and application of manual inspection items

A lecture for security consultants who have experience only in Linux, DB, WEB, networks, and security equipment, but lack experience with PCs. Securing response capabilities for cases where PC inspections are replaced by security solutions or conducted via scripts. Categorizing inspection items to prepare inspection strategies and establish response strategies based on inspection experience. One of the business improvements (KPIs) to shorten inspection time and increase accuracy.

Security equipment cannot be inspected using scripts or solutions like databases. Experienced personnel must be assigned. Difficulty in recruiting, including experienced individuals, diligent diagnosticians, or freelancers. Numerous defects found during ISMS-P certification of security equipment; skill levels vary significantly depending on the inspector. Sharing inspection methods and management strategies (methodologies, etc.) for security equipment with those who need them.

Database vulnerability assessment training for the protection of critical information and communication infrastructure in the public sector. Demand for vulnerability assessments arises as a legal requirement. Characterized by the need to secure sufficient assessment time and budget, particularly in the public sector. Lack of specialized personnel for vulnerability assessments in the public sector. Lectures for establishing protection measures in response to revisions of critical information and communication infrastructure and annual changes.

This content is composed of insights from experienced professionals—ranging from newcomers to those with 35 years of experience—performing vulnerability analysis and evaluation for Financial Security Standards and Major Information and Communication Infrastructure. It is designed to provide valuable information for new employees or experienced professionals transitioning from other fields. Among the various types, Database was selected, and the evaluation criteria are based on the Financial Security Standards. While basic training or handovers are typically based on the previous year's standards, I believe it would be helpful to familiarize yourself with various analysis techniques as well. Since diverse strategies are required for accurate and rapid diagnosis within a limited timeframe, this may also be beneficial for PMs who plan from the perspective of methodology and approach.

Career concerns in security consulting: 5 hours of audio explanations covering career solutions from entry-level to 30-year veterans. Includes mental stability and salary negotiation strategies for new security consultants or those struggling to adapt. Includes methods for upgrading job skills and improving internal/external reputation. A lecture designed to resolve concerns for those considering a job change or career path shift.

With hacking incidents occurring continuously from 2025 to the present, the addition of penetration testing to ISMS-P certification has been finalized. As the work-life balance and importance of penetration testers rise, there is a need for an environment where they can grow. Unlike other fields of information security, penetration testers can only practice and build portfolios when a proper environment is provided. Unlike the first penetration testing environment which simply provided a practice lab, this second environment allows you to build the website yourself, complete with more diverse admin functions and even actual payment features! Penetration testing scenarios for achieving practical goals have been fully implemented! ~Hone your skills according to the 2026 Major Information and Communication Infrastructure penetration testing items and evolve into one of the top penetration testers in the country!~

The recent Coupang personal information leak has been recorded as the largest data breach in South Korea's history, marking an instance where the personal information of virtually every South Korean citizen was compromised. However, the debate regarding the effectiveness of ISMS-P concluded with meaningless improvement measures such as mock hacking and certification revocation. As of December 11, 2025, companies like Coupang—which were subjects of the Personal Information Processing Policy Evaluation System conducted by the Personal Information Protection Commission in 2024—continue to operate in violation of more than 10 criteria of that evaluation system. The reason for this lies in human error involving Coupang's personal information team (comprised of top domestic and international experts) and ISMS-P auditors (who hold the highest domestic and international qualifications). With basic common knowledge of the Personal Information Protection Act, this recent leak, as well as breaches at Gmarket, Netmarble, SKT, KT, and LG U+, could have all been prevented. In reality, accidents continue to occur because customers' personal information is not protected—or appropriate protective measures are not established and operated—due to human issues such as inadequate preliminary inspections and differences in legal interpretation. Through this lecture, you can acquire the skills to evaluate personal information transparently and objectively, with the hope that personal information protection for customers will be achieved through professional training aimed at proper inspection methods and eliminating blind spots.

As customer anxiety grows due to the expansion of personal information leak incidents, companies have been operating management systems that fail to properly identify personal data or implement adequate security measures. These systems have relied on operational frameworks based on ISMS-P/ISO27701 standards (managed by lawyers, etc.) and penetration testing (RED TEAMs, e.g., Coupang) composed of winners from domestic and international hacking competitions. Even companies that have not yet experienced an incident are in a situation where a leak could occur at any time. - The reason is that personal information managers are creating unmanaged blind spots themselves, such as through inadequate methods of obtaining customer consent and insufficient identification of personal information processing statuses. -> Therefore, it is necessary to share information regarding fines and penalties (as of 2024.12.8) related to domestic companies' consent forms and privacy policies. This will improve business operations by enhancing the expertise of personal information managers and ensuring that proper security measures for personal information protection are transparently disclosed to customers.

Since most large corporations and financial institutions are conducting penetration testing in addition to standard mock hacking, there is a recent need to establish new roles and secure capabilities to perform intrusions as a "RED TEAM" in the literal sense. Therefore, beyond simple WEB and APP mock hacking, we have opened a training course where participants can discover scenarios for infiltrating servers and practice executing large-scale personal information leaks. + Provision of server and website environments for penetration testing + Sharing of hacking tools and methodologies

- This project involves installing actual apps on mobile phones and practicing simulated hacking using hacking tools, in accordance with the inspection standards for electronic financial infrastructure and public services. - This course allows you to gain an understanding of mobile app penetration testing, overcome any hesitations, and learn everything from inspection know-how to report writing and communication methods.

- Provision of penetration testing environments and inspection tools - Web penetration testing practice based on the 2026 revised edition for Critical Information and Communication Infrastructure - Web penetration testing practice based on the 2026 revised edition for Electronic Financial Infrastructure - Review and sharing of vulnerabilities existing on websites - Training on penetration testing reporting methods and improvement strategies

Vulnerability analysis and evaluation for electronic financial infrastructure as of 2025, covering DBMS, WAS (PaaS), and PC based on the revised standards for critical information and communications infrastructure in the second half of 2025. Additionally, penetration testing explained according to the standards revised in the second half of 2025, including mobile penetration testing. Expect skill improvement through the transfer of know-how, along with fast and accurate inspection methods and remediation plans.

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

Repeatedly study the 100 most frequently appearing CPPG core topics through theory, mind maps, and problem solving.

KCA Information Security Risk Manager (ISRM) certification course! The cornerstone for acquiring the top 3 personal information protection certifications: CPPG, ISMS-P!

This course is designed to prepare you for the Information Security Engineer written exam by concisely summarizing core theories and strengthening practical skills through problem-solving. Take a step closer to obtaining your Information Security Engineer certification with past exam analysis and practical preparation strategies.

This course systematically teaches practical Docker skills (installation→operation→automation→security) and comprehensively covers the latest security threats and countermeasures in each section. It features a hands-on approach where you learn by following along with practical exercises. This curriculum is highly recommended for DevOps engineers, infrastructure engineers, and security practitioners who want to experience the latest container/cloud environments in real-world scenarios.

This course puts an end to operational vulnerabilities in Linux servers caused by incorrect permissions. Completely master file and directory permission control based on real-world practical standards.

This course is a foundational learning program that covers Introduction to Information and Communication Technology, one of the core theories in computer engineering. Through this course, learners can understand the basic structure and operating principles of computers, and learn the principles and applications of information and communication technology based on this foundation. The course is structured to provide comprehensive learning from the processes of information generation, transmission, processing, and storage to data communication methods in network and internet environments. In addition to the basic concepts of information and communication technology, by understanding the trends and roles of information and communication technology utilized in real life and across industries, this course provides a solid theoretical foundation for learners who are first entering the fields of computer engineering and information and communication technology. 👉 By taking this course, learners can build a fundamental foundation in information and communication technology that encompasses computers and networks, and further utilize it for advanced learning or preparation for related certifications.

This lecture provides a general guide on how to prepare while studying when you want to choose a career in IT security penetration testing, and what questions and answers to prepare for the interview. I will share my experience working as a penetration testing consultant, at large companies, and in the financial sector, and currently running a penetration testing consulting business.

Cyber security threats are increasing every year, stealing personal information and abusing privacy. This course covers security issues and security activities that employees must know and follow in their work and personal lives.

**"Digital Forensic Techniques by Byte Detective: Evidence Collection and Securing"** is a course focused on how to collect and preserve digital evidence required in cases of cybercrime, internal information leakage, and security incidents. From the basic concepts of digital forensics to the principles of evidence collection, maintaining integrity, and legal procedures for securing evidence, this course explains everything through case studies and procedural steps so that even beginners can understand. You can systematically learn the forensic mindset and core concepts of securing evidence that are essential to know before using professional analysis tools.

IT services are rapidly transitioning to cloud environments. You will learn security practices from basic virtual infrastructure construction to security threat monitoring and vulnerability diagnosis for each area to secure the Amazon AWS cloud environment.

"Nationally Certified Industrial Security Manager" New Renewal Version Final Update Completed!! This course is designed to help you obtain the Nationally Certified Industrial Security Manager certification by providing a systematic understanding of industrial security from a management perspective. Rather than focusing on rote memorization, the content is structured so that even non-security majors can understand the concepts, structure, and flow of industrial security. It is designed not only for exam preparation but also for practical application and career expansion.

As AI systems become agentic and expand beyond text into image, audio, and multimodal capabilities, security threats are becoming significantly more complex. This lecture analyzes the latest security threats and attack techniques faced by AI Agents and Multimodal LLMs, as well as real-world cases, from an AI Red Teaming perspective.

This is a course where you can learn the basics of web technology. You can learn the basics of web technology in a short period of time. If you are interested in studying or getting a job related to the web, you must take this course!

This online course covers everything from the basic concepts of information security to the latest security issues, focusing on core content for obtaining certification. It enables efficient exam preparation through theory and practical mock exams that reflect the latest trends, and is structured so that even beginners can easily follow along.