Planning information security and personal data protection events/campaigns

Massive leaks of citizens' personal information due to recurring hacking incidents of the same type at credit card companies and insurers. Other personal information controllers also suffer repeated incidents, failing to prevent the same causes and attack methods. Detection is impossible despite spending budgets on advanced monitoring, and while personnel are continuously hired, reporting systems and internal regulations remain inadequate. This is part of a lecture for ongoing research and guidance aimed at resolving the persistent customer dissatisfaction, inconvenience, and total loss of service trust caused by these incomprehensible management systems.

As the leakage of linkage information occurred and became known, measures such as evaluating the importance and management status of CI (Connecting Information) were implemented. Accordingly, specialized training is being conducted.

Following the Privacy Audit 1 lecture, there has been a continuous failure to advance the tasks of internal privacy officers, along with a failure to preemptively prevent and block accidents due to maintaining the same routine as previous years and negligence. There is a lack of key-point internal training and communication by the Privacy Team due to the insufficient understanding of privacy protection among executives, including the CEO, CPO, division heads, and department heads. As the department in charge of personal information, the Privacy Team needs to improve the issue of continuously using only checklists for legal judgment and inspection (inspections based on minimum legal provisions have many blind spots). As accurate inspections based on precise judicial precedents and sanctions are required, it is necessary to conduct training on accurate knowledge.

Establishment of a reporting system, including the promotion of various agendas for the Privacy Policy Council and Working-level Council, and reporting the results of inspections on safety measures and legal compliance by the Chief Privacy Officer (CPO) to the CEO. There is a need to establish and implement a self-audit system for personal information to conduct professional internal preliminary investigations and inspections regarding recent hacking and data breach incidents. Recognizing that existing certification systems such as ISMS-P cannot prevent accidents. Despite the need to develop audit checklists reflecting diverse services and industry characteristics and to carry out colorful and extensive tasks such as internal personal information files and business flow analysis for partners (over 1,000) and branches (over 100), these tasks are not being implemented. Furthermore, despite the need to defend various blind spots, experts are unable to do so due to a lack of knowledge. Accidents continue to occur and risks remain because appropriate audits of existing security systems are not being carried out, and those previously considered experts in management systems are not actually experts. Through this study, we aim to eliminate blind spots and strengthen the inspection of existing security systems (promoting detailed inspections), derive improvement measures, and proceed with reporting.

As a security audit task for the Information Security Division, provide 2026 cases to refer to when conducting on-site audits, along with specific inspection plans (due diligence) that reflect the characteristics of the audit, and provide training to enable improvements after reviewing existing work systems.

In Financial AI Security (PART 1. Basics), I provided an overview of AI security. Please note that this is a practitioner's training session on the AI inspections required during actual security reviews for penetration testers (Red TEAM). This lecture contains practical content and explains how to perform penetration testing on technical aspects (including checklists). When studying, you may find AI difficult, or you might find that many companies have failed to apply AI guidelines because they are focused on modeling, making reviews challenging. I expect many companies have received various feedback during audits regarding the establishment of AI security governance. This is naturally because there is no clear evidence of AI security within internal operations. Now is the time to establish it. I hope you study AI security and pursue a path as an AI security professional.

Finally, I feel that the AI security review (NIS/FSI) checklists, which have been vaguely positioned over the past 7–8 years, are now accurate from a practitioner's perspective, and I have established a clear framework for how to change, establish, and operate the management system. I will explain what AI security is and how it should be improved after June 2026, based on the standards of South Korea's top-tier companies (those with the highest level of information security). (This is not a basic or conceptual explanation*) I have developed this training divided into PART 1 (Basics & Overview) and PART 2 (Advanced & Security Review), so please refer to it.

This training was created to first help privacy officers recognize and understand the requirements for establishing a proactive protection system, as previously announced through the June 2026 Personal Information Protection Act and the Personal Information Protection Commission's (PIPC) compliance inspections. It aims to help companies review their current status, identify areas for improvement, and establish future action plans. Based on over 8 years of experience in providing advisory and consulting services for personal credit information protection, this course is designed to support strategy formulation and the preparation of reporting documents for executive management.

The shortage of PMs in security consulting firms is a persistent issue. Consequently, there are many cases where individuals in their 40s and 50s from completely different fields have been entering the industry to handle PM duties and client communications. Since these PMs in their 40s and 50s lack experience in technical areas, consulting, and security, they find the work very challenging. They often join with the mindset of learning through handovers from other PMs. I have also been providing training and handovers to these PMs based on the following content, and the satisfaction levels have been high.

Achieved the highest rating for all clients over 6 years of performing Personal Information Protection Level Evaluation consulting for public institutions (covering various types from central administrative agencies to public enterprises, small-scale public institutions, and local governments), maintained the highest rating for all (continuous consulting experience with the same institutions), and holds a track record of achieving a perfect score of 100 (ranked 1st nationwide). Based on the 2026 manual, it is possible to effectively allocate the necessary tasks and performance records for writing quantitative/qualitative reports considering the strengthened penalties and changed indicators following the Coupang incident. Depending on the company's situation, it is fully possible to be designated as a best practice through either over-investment or strategic passive response.

Insufficient capability to audit new technologies (cloud management systems) due to a lack of theory and knowledge among management system inspection personnel. Training to strengthen the expertise of personnel who proactively prevent incidents by identifying management system deficiencies to protect companies from hacking. Training for existing infrastructure and penetration testing personnel to transition into management system roles. Securing definitive capabilities and materials through the provision of back data!

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

As PaaS (previously categorized as WEB/WAS) in public and private cloud environments is integrated into in-house PaaS operations, this training is designed for Infrastructure Project Leaders (PLs) overseeing approximately 10 infrastructure inspection personnel, as well as vulnerability assessment specialists. The curriculum covers certification requirements such as ISMS-P, including cloud asset identification, asset classification, importance rating, and risk assessment reflection. It also addresses the 2026 Financial Company Security Standards (for Electronic Financial Infrastructure Vulnerability Analysis and Evaluation), which include the establishment and strengthening of container inspection and private cloud management system inspection items, as well as the addition and modification of virtualization and cloud items within Critical Information and Communication Infrastructure.

Lack of back data for private cloud inspections!! A severe shortage of experienced personnel for IaaS inspections!! Improve practical skills by providing back data and utilize it for various certifications such as Major Information and Communication Infrastructure, Financial Security Institute (FSI) assessments, ISMS-P, ISO27001, etc. Professional training for Infrastructure Project Leaders (PLs) who manage around 10 infrastructure inspection personnel. Providing inspection data and understanding of the technical areas within the cloud management framework!

Providing insights and materials for overall management of penetration testers (WEB, Mobile, HTS) targeted at Project Leaders who oversee financial company mock hacking/penetration testing. Situations have occurred where "blank" reports are repeatedly submitted when no vulnerabilities are found in each part (the same applies to the public sector). Therefore, controls are implemented to ensure that inspection results for each item are produced in the same format as educational materials. Perform inspections tailored to each theme and utilize them for security reviews and internal security deliberations to verify results.

Conducting Windows server competency training to break the trend of new and career-transitioning security consultants focusing solely on Linux servers. Understanding the Windows OS and its relationship with servers and programs installed on the OS, such as PC, WEB, WAS, and DBMS. Understanding vulnerabilities and continuing vulnerability assessment and improvement activities.

Education on the most basic Linux server inspection methods and items due to the continuous assignment of new security consultants for vulnerability assessment and the continuous placement of experienced professionals from other fields into management roles. Risk assessment for risk evaluation (remediation planning) and implementation review. Understanding and application of third-party security solutions. Establishment of the ISMS-P management system through appropriate analysis of technical and administrative domains.

Classification of inspection items and establishment of an inspection plan (strategy) during network inspection Establishment of inspection criteria considering the risk and difficulty of actions Inspection of network service items and strategies for utilizing server access control solutions Command-based inspection after remote network access and preparation of risk assessment reports Interviews with network personnel and application of manual inspection items

A lecture for security consultants who have experience only in Linux, DB, WEB, networks, and security equipment, but lack experience with PCs. Securing response capabilities for cases where PC inspections are replaced by security solutions or conducted via scripts. Categorizing inspection items to prepare inspection strategies and establish response strategies based on inspection experience. One of the business improvements (KPIs) to shorten inspection time and increase accuracy.

Security equipment cannot be inspected using scripts or solutions like databases. Experienced personnel must be assigned. Difficulty in recruiting, including experienced individuals, diligent diagnosticians, or freelancers. Numerous defects found during ISMS-P certification of security equipment; skill levels vary significantly depending on the inspector. Sharing inspection methods and management strategies (methodologies, etc.) for security equipment with those who need them.

"The deep learning code runs, but why do the formulas in papers look so unfamiliar?" As you study AI, you eventually hit a wall of mathematical formulas. If you trace the source of that wall, it usually leads back to not having a solid foundation in the most basic mathematical language. Starting with the language of sets, this course covers core concepts across 18 lectures, including equations, functions, sequences, exponents/logarithms, and trigonometric functions. We don't make you memorize formulas. While we briefly touch upon how these connect to the context of AI, the primary goal of this course is one thing — to build an unshakable foundation for when you later learn linear algebra, calculus, and probability/statistics. As the first part of the Suminjeongeum series, this course will provide you with the common language needed to properly digest the remaining three parts.

Based on over 100 deep learning training sessions, this course systematically organizes the core foundational theories that students found most challenging. The course connects mathematical intuition, model learning principles, and code implementation step by step in a way that even non-majors can understand, deeply covering the fundamental structure and operating principles of how AI models learn, rather than just library usage. This is a practical introductory course designed to help you grow into a skilled engineer who understands AI principles by implementing core deep learning foundational technologies such as gradient descent, loss functions, optimization, perceptrons, multilayer neural networks, and backpropagation through both formulas and code.

"Understanding Manufacturing Security in the AI Era through Field Cases" is a course designed to provide an easy understanding of OT security, which is growing in importance within smart factories and AI-based manufacturing environments, focusing on real-world field cases. This lecture explains core concepts frequently encountered in manufacturing sites, such as OT, ICS, PLC, SCADA, HMI, and MES, and compares the differences between IT security and OT security. Furthermore, it examines security threats that can occur on the manufacturing floor—such as ransomware, remote access exploitation, partner account hijacking, production line shutdowns, equipment malfunctions, and data forgery—through case studies. Through this course, students will understand the basic structure of OT security in manufacturing and identify the security perspectives necessary to protect production facilities and industrial control systems. Additionally, it provides a common foundation for further learning in industry-specific manufacturing security courses.

"Your first step to creating a customized LLM with LoRA-based lightweight fine-tuning!" This is an introductory hands-on course designed so that even those new to LLMs can easily follow along. We minimize complex theory and guide you step-by-step through the entire process: loading the model → applying data → training → comparing results. In a short time, you'll directly experience the workflow of cutting-edge lightweight fine-tuning techniques like LoRA and QLoRA, and gain an intuitive understanding of "how LLM fine-tuning works." Even without extensive resources, experience the satisfaction of creating an LLM specialized for your domain!

The AWS Certified AI Practitioner practice exam course is a core summary program designed to help you pass the certification. First, you will quickly review the basic concepts of AI/ML and Generative AI, and learn the features and use cases of key AWS AI services that frequently appear on the exam (e.g., SageMaker, Rekognition, Polly, etc.). Based on this, you will practice determining which AI solutions are suitable for various real-world scenarios, while also covering topics related to the responsible use of AI models and data security. Finally, you will learn problem-solving strategies for each type of exam question and prepare for the actual test through mock exams. This course allows you to prepare for the exam efficiently in a short period of time.

This course is designed to simultaneously develop both fundamental theory and practical application skills needed to proficiently execute AI modeling projects in real-world settings. Learners will understand the overall flow of AI projects and experience step-by-step processes through hands-on practice: problem definition → model design → data acquisition and preprocessing → feature extraction → model training and validation. Additionally, by learning how to select and manage optimal AI models in various situations, learners can build practical AI capabilities that can be applied to actual business environments. Through this course, learners can systematically understand the entire AI modeling project process and strengthen their data-driven problem-solving abilities based on this foundation.

Understand core AI concepts through visual materials—no formulas or code required—and practice prompt writing and task-specific application patterns. Covering everything from machine learning to generative AI, this practical introductory course empowers non-majors to apply AI directly to their work in just 90 minutes.

When providing global services or handling overseas customer data, knowing only domestic laws is no longer sufficient. This course is an introductory program that organizes the core structures of major global privacy protection laws at a glance within 30 minutes. It's designed to help you understand by comparing privacy protection laws by country, including GDPR, CCPA, APPI, PIPA, PDPA, and others. Additionally, you can briefly explore global data security regulations such as HIPAA, PCI DSS, and APEC CBPR, as well as emerging privacy protection issues in AI environments and trends in guaranteeing data subject rights.

With the advancement of generative AI, many companies are pursuing AX (AI Transformation). However, in the actual field, there are not many educational programs that systematically teach what to do and how to do it compared to the demand that "AX must be done." While most AI education focuses on how to use generative AI or write prompts, this course focuses on the "AX Strategy Planning Methodology" for transforming corporate tasks and services into AI-based ones. This course is based on the practical experience of a 25-year expert who has performed DX/AX consulting and training for large corporations, the financial sector, public institutions, and various companies in the actual IT field. It allows you to learn from a practical perspective not just how to use AI well, but which tasks should undergo AX, to what extent AI should make decisions, how to control risks, and how to design and verify AX projects. Furthermore, it systematically covers core content necessary for actual AX implementation, from understanding the essence of AX to AI thinking systems, AX design methodology, Human-AI role separation, Guardrail design, and KPI and verification structures. In particular, it goes beyond simple theoretical education. Based on real corporate cases such as insurance underwriting, customer consultation, manufacturing quality, internal work support, marketing recommendations, development productivity, and management decision-making, it provides guide templates and sample materials for AX problem definitions, AX hypothesis definitions, AX performance designs, AX service structure diagrams, Guardrail designs, and AX verification plans. This ensures that after taking the course, you can secure the practical capabilities to easily plan and promote actual AX tasks. The biggest differentiator of this lecture is that it teaches how to plan and design AX from the perspective of someone who actually performs AX projects. Specifically, by providing AX strategy planning output templates and seven industry-specific AX cases that can be used in the field, it is designed so that students can refer to cases most similar to their own work and apply them immediately by modifying them to fit their environment. In short, this is not a course to create AI users, but a process to create AX strategy planners who can design and execute a company's AX.

LLM and Agent, the fundamental technologies behind AI like ChatGPT. LLM is currently the technology that has come closest to AGI. In this lecture, we will explore LLM and Agent technologies from a layperson's perspective.

We provide an easy understanding of the concepts and principles of generative AI from a humanities perspective, including literature, film, music, and history, while exploring the cultural impacts and life changes AI will bring. We offer practical insights and strategies on how individuals and companies should respond and prepare for the AI era.

- Based on the 2025 Handbook for Personal Information Protection Level Evaluation - Proposing measures to apply personal information best practices from the top 1% of public institutions - Analysis of deduction factors for each quantitative and qualitative indicator - Presenting application cases of synthetic data (PETs: Privacy Enhancing Technologies) to secure scores for new technology (bonus points) indicators - Providing cases of securing safe zones for personal information utilization, manual production, disclosure performance, and CEO reporting cases

Automate your repetitive tasks now with Opal. Create your own practical automation tools with our no-code AI workflow design!

From core theories of deep learning and CNN to various CNN model implementation methods, and practical deep learning development know-how through real-world problems, If you want to become a deep learning CNN technology expert based on Pytorch, join us in this lecture :)

Are you feeling anxious because it seems like everyone is trying Vibe Coding except you? Unsure of where to even begin? Don't worry. SSG Coach is here to help. Game development isn't difficult when you're Vibe Coding with AI. I will guide you so that anyone can create a game using only the free Gemini CLI. I will also provide essential game development knowledge, so that after completing this course, you'll be ready to take on other game projects as well.

This is a practical course where even beginners can learn how to quickly create PDF and Notion templates using AI and generate passive income by selling them on platforms like Etsy, Gumroad, and the Notion Marketplace. You will master everything at once, from market research and production to creating product detail pages, uploading, and sales strategies.

What if AI could directly open a browser and write shell scripts to resolve server issues? Through practical automation know-how implemented with OpenClaw across Windows and Linux, we guide you on the shortest path to completing your own powerful remote development environment without complex configurations.

Your colleagues are already using Claude Code for their work—are you still doing everything manually? Don't worry! This course will turn you into a vibe coding master.

- Establishment of incident response manuals and training plans - Introduction of training cases such as penetration testing, DDoS, and APT - Sharing long-term information security strategies (~2027 or ~2030) of leading domestic companies - Introduction of information security activities of leading domestic companies - Education on Risk Management Framework (RMF) and Zero Trust implementation cases for electronic financial companies

Through this lecture, you'll be able to learn about the AI graduate school admission process and preparation methods from start to finish! I'll also share some great tips to increase your chances of getting accepted!