Training on the Personal Information Fine Reduction System

Training for establishing risk assessment methods for network equipment, security devices, and control systems based on the revised Critical Information and Communication Infrastructure standards for the second half of 2025, and eliminating vulnerabilities through the integration of years of know-how and fast, accurate inspections and remedial actions. In particular, we expect efforts to secure inspection speed and improvement plans in accordance with the designation of ISMS-P and ISO27001 certification scopes. Gain experience with network equipment, security devices, and control systems—which are relatively less accessible and more difficult to set up environments for compared to Servers, DBs, WEB, WAS, PCs, and Cloud (Public, Private).

This training explores the service privacy reviews pursued by Naver, Kakao, and Toss. It is designed to improve the capabilities of domestic consulting and privacy protection teams by identifying where service-specific privacy protection should be applied and explaining what to check during service reviews. Rather than covering only general laws or standard review checklists, this is an in-depth review training program that also provides a checklist.

The purpose is to improve, compared with last year, awareness campaigns that are not defined in the regulations and often end merely with the distribution of promotional gifts, by referring to best practices from various organizations, given the current situation in which the performance of events and campaigns such as Information Security Day or Personal Information Protection Day, held monthly or annually, is gradually declining. These events must now move beyond gift-distribution activities organized by the Information Security Team and become events in which all employees participate and uphold security together. It is necessary to build mutual understanding through the establishment of a communication system for embedding security into the organization. Ultimately, employees must have a good understanding of information security and the Personal Information Protection Act so that the organization can realistically protect itself from hacking and insider threats. Since the departments other than the Security Team—including those responsible for commissioning various projects, managing entrusted service providers, controlling applications and security settings, planning various informatization projects, and conducting IT audits—are designated to take overall responsibility, the Security Team is distributing security-related tasks among the respective departments. However, the current situation is that each department is merely expressing dissatisfaction. This opportunity should therefore be used to move away from that situation, as internal consultative bodies alone are insufficient. Security-related scoring criteria must be reflected in the powerful personnel evaluation system. Through unannounced audits, those who fail to comply should be disciplined through pay reductions or suspension, while those who properly observe security requirements and demonstrate achievements in support of security should receive substantial financial rewards through an incentive system. Security must be embedded in the organization so that employees take the initiative themselves. Accordingly, department and individual evaluation KPIs should be adjusted through a report to the CEO under the direction of the CISO. In addition, through a system for designating department-level information security officers and personnel in charge, the organization should strengthen its human security framework against hacking and information leakage—including the leakage of documents managed by each department and the management of service providers—by providing position allowances for these responsibilities.

Massive leaks of citizens' personal information due to recurring hacking incidents of the same type at credit card companies and insurers. Other personal information controllers also suffer repeated incidents, failing to prevent the same causes and attack methods. Detection is impossible despite spending budgets on advanced monitoring, and while personnel are continuously hired, reporting systems and internal regulations remain inadequate. This is part of a lecture for ongoing research and guidance aimed at resolving the persistent customer dissatisfaction, inconvenience, and total loss of service trust caused by these incomprehensible management systems.

As the leakage of linkage information occurred and became known, measures such as evaluating the importance and management status of CI (Connecting Information) were implemented. Accordingly, specialized training is being conducted.

Following the Privacy Audit 1 lecture, there has been a continuous failure to advance the tasks of internal privacy officers, along with a failure to preemptively prevent and block accidents due to maintaining the same routine as previous years and negligence. There is a lack of key-point internal training and communication by the Privacy Team due to the insufficient understanding of privacy protection among executives, including the CEO, CPO, division heads, and department heads. As the department in charge of personal information, the Privacy Team needs to improve the issue of continuously using only checklists for legal judgment and inspection (inspections based on minimum legal provisions have many blind spots). As accurate inspections based on precise judicial precedents and sanctions are required, it is necessary to conduct training on accurate knowledge.

Establishment of a reporting system, including the promotion of various agendas for the Privacy Policy Council and Working-level Council, and reporting the results of inspections on safety measures and legal compliance by the Chief Privacy Officer (CPO) to the CEO. There is a need to establish and implement a self-audit system for personal information to conduct professional internal preliminary investigations and inspections regarding recent hacking and data breach incidents. Recognizing that existing certification systems such as ISMS-P cannot prevent accidents. Despite the need to develop audit checklists reflecting diverse services and industry characteristics and to carry out colorful and extensive tasks such as internal personal information files and business flow analysis for partners (over 1,000) and branches (over 100), these tasks are not being implemented. Furthermore, despite the need to defend various blind spots, experts are unable to do so due to a lack of knowledge. Accidents continue to occur and risks remain because appropriate audits of existing security systems are not being carried out, and those previously considered experts in management systems are not actually experts. Through this study, we aim to eliminate blind spots and strengthen the inspection of existing security systems (promoting detailed inspections), derive improvement measures, and proceed with reporting.

As a security audit task for the Information Security Division, provide 2026 cases to refer to when conducting on-site audits, along with specific inspection plans (due diligence) that reflect the characteristics of the audit, and provide training to enable improvements after reviewing existing work systems.

In Financial AI Security (PART 1. Basics), I provided an overview of AI security. Please note that this is a practitioner's training session on the AI inspections required during actual security reviews for penetration testers (Red TEAM). This lecture contains practical content and explains how to perform penetration testing on technical aspects (including checklists). When studying, you may find AI difficult, or you might find that many companies have failed to apply AI guidelines because they are focused on modeling, making reviews challenging. I expect many companies have received various feedback during audits regarding the establishment of AI security governance. This is naturally because there is no clear evidence of AI security within internal operations. Now is the time to establish it. I hope you study AI security and pursue a path as an AI security professional.

Finally, I feel that the AI security review (NIS/FSI) checklists, which have been vaguely positioned over the past 7–8 years, are now accurate from a practitioner's perspective, and I have established a clear framework for how to change, establish, and operate the management system. I will explain what AI security is and how it should be improved after June 2026, based on the standards of South Korea's top-tier companies (those with the highest level of information security). (This is not a basic or conceptual explanation*) I have developed this training divided into PART 1 (Basics & Overview) and PART 2 (Advanced & Security Review), so please refer to it.

This training was created to first help privacy officers recognize and understand the requirements for establishing a proactive protection system, as previously announced through the June 2026 Personal Information Protection Act and the Personal Information Protection Commission's (PIPC) compliance inspections. It aims to help companies review their current status, identify areas for improvement, and establish future action plans. Based on over 8 years of experience in providing advisory and consulting services for personal credit information protection, this course is designed to support strategy formulation and the preparation of reporting documents for executive management.

The shortage of PMs in security consulting firms is a persistent issue. Consequently, there are many cases where individuals in their 40s and 50s from completely different fields have been entering the industry to handle PM duties and client communications. Since these PMs in their 40s and 50s lack experience in technical areas, consulting, and security, they find the work very challenging. They often join with the mindset of learning through handovers from other PMs. I have also been providing training and handovers to these PMs based on the following content, and the satisfaction levels have been high.

Achieved the highest rating for all clients over 6 years of performing Personal Information Protection Level Evaluation consulting for public institutions (covering various types from central administrative agencies to public enterprises, small-scale public institutions, and local governments), maintained the highest rating for all (continuous consulting experience with the same institutions), and holds a track record of achieving a perfect score of 100 (ranked 1st nationwide). Based on the 2026 manual, it is possible to effectively allocate the necessary tasks and performance records for writing quantitative/qualitative reports considering the strengthened penalties and changed indicators following the Coupang incident. Depending on the company's situation, it is fully possible to be designated as a best practice through either over-investment or strategic passive response.

Insufficient capability to audit new technologies (cloud management systems) due to a lack of theory and knowledge among management system inspection personnel. Training to strengthen the expertise of personnel who proactively prevent incidents by identifying management system deficiencies to protect companies from hacking. Training for existing infrastructure and penetration testing personnel to transition into management system roles. Securing definitive capabilities and materials through the provision of back data!

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

As PaaS (previously categorized as WEB/WAS) in public and private cloud environments is integrated into in-house PaaS operations, this training is designed for Infrastructure Project Leaders (PLs) overseeing approximately 10 infrastructure inspection personnel, as well as vulnerability assessment specialists. The curriculum covers certification requirements such as ISMS-P, including cloud asset identification, asset classification, importance rating, and risk assessment reflection. It also addresses the 2026 Financial Company Security Standards (for Electronic Financial Infrastructure Vulnerability Analysis and Evaluation), which include the establishment and strengthening of container inspection and private cloud management system inspection items, as well as the addition and modification of virtualization and cloud items within Critical Information and Communication Infrastructure.

Lack of back data for private cloud inspections!! A severe shortage of experienced personnel for IaaS inspections!! Improve practical skills by providing back data and utilize it for various certifications such as Major Information and Communication Infrastructure, Financial Security Institute (FSI) assessments, ISMS-P, ISO27001, etc. Professional training for Infrastructure Project Leaders (PLs) who manage around 10 infrastructure inspection personnel. Providing inspection data and understanding of the technical areas within the cloud management framework!

Providing insights and materials for overall management of penetration testers (WEB, Mobile, HTS) targeted at Project Leaders who oversee financial company mock hacking/penetration testing. Situations have occurred where "blank" reports are repeatedly submitted when no vulnerabilities are found in each part (the same applies to the public sector). Therefore, controls are implemented to ensure that inspection results for each item are produced in the same format as educational materials. Perform inspections tailored to each theme and utilize them for security reviews and internal security deliberations to verify results.

Conducting Windows server competency training to break the trend of new and career-transitioning security consultants focusing solely on Linux servers. Understanding the Windows OS and its relationship with servers and programs installed on the OS, such as PC, WEB, WAS, and DBMS. Understanding vulnerabilities and continuing vulnerability assessment and improvement activities.

Education on the most basic Linux server inspection methods and items due to the continuous assignment of new security consultants for vulnerability assessment and the continuous placement of experienced professionals from other fields into management roles. Risk assessment for risk evaluation (remediation planning) and implementation review. Understanding and application of third-party security solutions. Establishment of the ISMS-P management system through appropriate analysis of technical and administrative domains.

- Strengthening understanding of inspections based on Privacy Impact Assessment checklist items - Finding and improving errors in personal information flow charts - Identifying and improving personal information breach factors - Understanding Privacy Impact Assessments and finding errors - Understanding Personal Information Protection Act and finding errors

- Based on the 2025 Handbook for Personal Information Protection Level Evaluation - Proposing measures to apply personal information best practices from the top 1% of public institutions - Analysis of deduction factors for each quantitative and qualitative indicator - Presenting application cases of synthetic data (PETs: Privacy Enhancing Technologies) to secure scores for new technology (bonus points) indicators - Providing cases of securing safe zones for personal information utilization, manual production, disclosure performance, and CEO reporting cases

- Policy revision for establishing cloud management systems (CSP/MSP contracts and SaaS contracts) - Vulnerability assessment for ISMS-P/ISO27001 certification or major information communication/electronic financial infrastructure response in cloud environments (public/private asset identification and vulnerability remediation) - Security operations and incident response in cloud environments - ISO27017&ISO27018 certification response

This is a theoretical and practical training course designed for those aspiring to become ISMS-P auditors in 2026, preparing them for the auditor qualification exam. It is an expanded version that includes Financial ISMS-P in addition to the standard ISMS-P.

"Nationally Certified Industrial Security Manager" New Renewal Version Final Update Completed!! This course is designed to help you obtain the Nationally Certified Industrial Security Manager certification by providing a systematic understanding of industrial security from a management perspective. Rather than focusing on rote memorization, the content is structured so that even non-security majors can understand the concepts, structure, and flow of industrial security. It is designed not only for exam preparation but also for practical application and career expansion.

The nationally certified Video Information Manager qualification course requires a systematic understanding of the procedures for collecting, storing, managing, protecting, and operating video information. Rather than making the written and practical components difficult to approach by separating them, this course is designed to help learners connect and study the core concepts and practical processes required for the exam together. It explains the operation of video information processing devices, personal information protection, video information management standards, security management, and practical exam preparation in an easy-to-understand way, even for beginners. Instead of focusing on simple memorization, the course centers on questions such as “Why are these standards necessary?” and “How are they applied in the field?” This course is suitable not only for exam candidates but also for anyone new to CCTV, video information, security, or personal information protection, helping them systematically organize the basic framework of video information management.

We provide 140 sounds in 5 areas that will help you with the CPPG certification exam. We also provide an introduction to how to use the 111 questions that are automatically generated each time, and a one-time lecture and explanation.

This course explains IT terminology and system structures frequently used in the workplace in a way that even non-majors can understand at once. It is designed to help you understand the flow of corporate IT structures—from servers and databases to APIs, security, and the cloud—rather than just learning individual terms. We will help you build foundational IT skills that are immediately applicable to your work, so you will no longer be stuck due to technical jargon in IT meetings and tasks.

This online course covers everything from the basic concepts of information security to the latest security issues, focusing on core content for obtaining certification. It enables efficient exam preparation through theory and practical mock exams that reflect the latest trends, and is structured so that even beginners can easily follow along.

This course does not simply list concepts. 👉 It explains the entire flow of IT systems based on "how a service actually operates." User Request → Server Processing → Data Storage → Result Return Web/App → API → DB → Cloud 👉 Centered around this flow, it connects where, why, and how each technology is used.

**"Digital Forensic Techniques by Byte Detective: Evidence Collection and Securing"** is a course focused on how to collect and preserve digital evidence required in cases of cybercrime, internal information leakage, and security incidents. From the basic concepts of digital forensics to the principles of evidence collection, maintaining integrity, and legal procedures for securing evidence, this course explains everything through case studies and procedural steps so that even beginners can understand. You can systematically learn the forensic mindset and core concepts of securing evidence that are essential to know before using professional analysis tools.

This course carefully selects the core systems that beginners must know in the vast field of information security. Instead of rigid theory, it's structured to help you intuitively understand system principles through clear analogies and practical examples. With this single course, you can grasp the big picture of information security systems as a whole and develop practical skills.

"Understanding Manufacturing Security in the AI Era through Field Cases" is a course designed to provide an easy understanding of OT security, which is growing in importance within smart factories and AI-based manufacturing environments, focusing on real-world field cases. This lecture explains core concepts frequently encountered in manufacturing sites, such as OT, ICS, PLC, SCADA, HMI, and MES, and compares the differences between IT security and OT security. Furthermore, it examines security threats that can occur on the manufacturing floor—such as ransomware, remote access exploitation, partner account hijacking, production line shutdowns, equipment malfunctions, and data forgery—through case studies. Through this course, students will understand the basic structure of OT security in manufacturing and identify the security perspectives necessary to protect production facilities and industrial control systems. Additionally, it provides a common foundation for further learning in industry-specific manufacturing security courses.

In an era of explosive data growth and crucial real-time processing, edge computing has established itself as an essential technology, no longer an option. This course is designed to systematically teach everything, from the core concepts of edge computing to deployment strategies for its application in real business environments. Through this course, students will firmly solidify the fundamental principles of edge computing and acquire practical knowledge and know-how applicable to real-world tasks and projects. Take the most certain first step towards becoming an edge computing expert, a core technology in the future IT environment!

This course puts an end to operational vulnerabilities in Linux servers caused by incorrect permissions. Completely master file and directory permission control based on real-world practical standards.

This course systematically teaches practical Docker skills (installation→operation→automation→security) and comprehensively covers the latest security threats and countermeasures in each section. It features a hands-on approach where you learn by following along with practical exercises. This curriculum is highly recommended for DevOps engineers, infrastructure engineers, and security practitioners who want to experience the latest container/cloud environments in real-world scenarios.

As AI systems become agentic and expand beyond text into image, audio, and multimodal capabilities, security threats are becoming significantly more complex. This lecture analyzes the latest security threats and attack techniques faced by AI Agents and Multimodal LLMs, as well as real-world cases, from an AI Red Teaming perspective.

Records remain, and responsibility grows! Everything about digital ethics that protects the workplace This course explores digital hate, digital sex crimes, and the risks of using AI that can actually occur in the workplace through case-based stories, clearly explaining what the problems are and how to prevent and respond to them. It firmly establishes the standards of digital ethics that today’s employees—who communicate digitally and use AI as part of their everyday work—urgently need, including how to work while respecting one another in digital spaces and how to use AI more safely and responsibly.

As the adoption of generative AI accelerates, new security threats such as corporate confidential information leaks and prompt injections are surging. This course covers strategies for embedding security throughout the entire AI lifecycle, based on the National Intelligence Service (NIS) guidelines' 30 core security measures and 15 practical threat cases. It also addresses security issues in the latest AI trends, such as Agentic AI and Physical AI, and presents methods for establishing governance frameworks that can be immediately applied in practice.

You can understand the concept and technology of blockchain and conduct ISMS-P certification audits specialized for virtual asset exchanges.