2026 Version Risk Assessment for Networks, Security Equipment, and Control Systems of Critical Information and Communication Infrastructure

- Public and private sector top-tier information security and personal information protection management system certification audit training in Korea - Preparation for ISMS-P certification strengthening due to comprehensive information security measures establishment - Management system GAP assessment and improvement plan development training - Individual training for ISMS-P initial audit, follow-up audit, and renewal audit - Professional information security training for acquiring excellent information security level enterprise certification

- Understanding the establishment and inspection of personal information management systems in accordance with the Personal Information Protection Act - Inspection and status assessment of personal information processing systems - Creation of personal information flow charts and flow diagrams - Identification of personal information breach factors - Publication of personal information impact assessment summaries

With hacking incidents occurring continuously from 2025 to the present, the addition of penetration testing to ISMS-P certification has been finalized. As the work-life balance and importance of penetration testers rise, there is a need for an environment where they can grow. Unlike other fields of information security, penetration testers can only practice and build portfolios when a proper environment is provided. Unlike the first penetration testing environment which simply provided a practice lab, this second environment allows you to build the website yourself, complete with more diverse admin functions and even actual payment features! Penetration testing scenarios for achieving practical goals have been fully implemented! ~Hone your skills according to the 2026 Major Information and Communication Infrastructure penetration testing items and evolve into one of the top penetration testers in the country!~

The recent Coupang personal information leak has been recorded as the largest personal information breach in domestic history, marking a case where the personal information of all South Korean citizens was leaked. However, the issue of ISMS-P's effectiveness was concluded with meaningless improvement measures such as penetration testing and certification revocation, and as of December 11, 2025, Coupang and others that were subject to the Personal Information Processing Policy Evaluation System conducted by the Personal Information Protection Commission in 2024 continue to operate incorrectly in more than 10 areas of the evaluation system's standards. The reason is clearly the human factor of Coupang's personal information team, who are the best personal information experts domestically and internationally, and ISMS-P auditors, who hold the best personal information expert qualifications domestically and internationally. All of these personal information leaks, including this incident and those at G-Market, Netmarble, SKT, KT, LG U+, etc., could have been prevented with even basic common sense knowledge of the Personal Information Protection Act. However, the reality is that accidents continue to occur due to human factors, insufficient preliminary inspections, and differences in legal interpretation, resulting in customers' personal information not being protected or appropriate protective measures not being established and operated. Through this course, you can develop the ability to transparently and objectively evaluate personal information through proper personal information inspection methods and professional training to eliminate blind spots, with the hope that personal information protection for customers will be achieved.

As personal information breach incidents expand, customer anxiety grows. During this time, companies have been operating management systems that cannot properly identify personal information and implement safety measures through ISMS-P/ISO27701-based business system operations (lawyers, etc.) and penetration testing (RED TEAM composition, e.g., Coupang) consisting of domestic and international hacking competition winners. Even companies that haven't experienced incidents yet are in a situation where breaches could occur at any time. -The reason is that personal information managers themselves create unmanaged blind spots, such as insufficient methods for obtaining customer consent and inadequate identification of personal information processing status. ->Therefore, there is a need to improve work processes by sharing fines/penalties for domestic companies' consent forms and processing policies (as of December 8, 2025) to transparently disclose to customers the expertise of personal information managers and proper personal information protection safety measures.

Most large corporations and financial institutions are conducting penetration testing in addition to simulated hacking, so recently there is a need to establish new positions and secure capabilities to perform penetration operations using the RED TEAM terminology as is. Therefore, in addition to simple WEB and APP simulated hacking, we are opening an educational course that can provide practical training on large-scale personal information leakage after discovering scenarios that can penetrate servers. +Providing server and website environments where penetration testing can be performed +Sharing hacking tools and hacking methods

This is a project where you install an actual app on your phone and practice penetration testing using hacking tools in accordance with the Electronic Financial Infrastructure Inspection Standards and Public Service Inspection Standards for mobile apps. This course helps you understand mobile app penetration testing, overcome any fears, and learn inspection know-how, result report writing, and communication methods.

- Provision of penetration testing environment and assessment tools - WEB penetration testing practice according to the 2025 revised edition of Critical Information and Communications Infrastructure - WEB penetration testing practice according to the 2025 revised edition of Electronic Financial Infrastructure - Review and sharing of vulnerabilities existing on websites - Education on penetration testing report writing methods and improvement measures

- Training on inspection methods aligned with cloud management system checkpoints in the Electronic Financial Infrastructure Vulnerability Analysis and Assessment Standards - Inspection of protective measures required by Electronic Financial Supervisory Regulations tailored to cloud and virtualization environments respectively - Organization of matters that must be included in establishing cloud security regulations and procedures - Securing evidence materials for evaluation and certification-related tasks in cloud environments

-Learn about the information security continuous assessment items conducted annually for financial companies, and strengthen preparation and response capabilities as a financial security officer -Learn based on the highest-grade information security continuous assessment cases, and receive education on know-how to achieve and maintain the highest grade in information security continuous assessment

-Understand best practices for each inspection item in the electronic financial infrastructure management system inspection that targets financial companies reviewed annually, and apply them to derive management system improvement tasks in preparation for appropriate breach incidents and leakage accidents -Present management system establishment cases for financial security personnel that can be established together with management system setup and ISMS-P/ISO27001 certification -Provide excellent materials for security personnel working at companies to utilize management system cases and prepare for electronic financial infrastructure management system inspection freelancers -Specialized education for consultants and R&D personnel in industry, academia, and legal sectors who need additional education on electronic financial infrastructure management systems according to the Financial Transaction Act and Electronic Financial Supervision Regulations

Voice phishing, URL, mobile, accounts, card usage, internet banking, ARS authentication, and other various financial fraud incidents are causing an increase in victims. Recently, hacking and fraud techniques utilizing various vulnerabilities such as open banking, simple payment (pay), strengthened fraud methods, hackers utilizing leaked personal information, and taking control of personal PCs and mobile devices are being reinforced. Financial authorities and various financial companies do not specifically disclose accident procedures and hacking methods related to financial consumers, which has led to growing misunderstandings among people who have never experienced hacking. We have recognized the seriousness of this issue through reports from our surroundings and have produced educational materials. Please, we hope you will recognize accurate hacking methods, and also understand related laws and policies to appropriately establish preventive systems and strengthen response measures in advance. (In case of incidents, it is your own responsibility under current law.)

- Based on the 2025 Personal Information Protection Level Assessment Manual standards - Proposing measures for applying best practices from top 1% public institutions in personal information protection - Analysis of deduction factors for each quantitative and qualitative indicator - Presenting application cases of synthetic data (PETs Personal Information Enhancement Technology) to secure scores for new technology (bonus points) indicators - Providing cases of securing safe zones for personal information utilization, manual production, disclosure records, CEO reporting cases, etc.

- Establishment of incident response manual and training plans - Introduction of training cases including penetration testing, DDoS, and APT - Sharing of mid-to-long-term information security strategies (~2027 or ~2030) of leading domestic companies - Introduction of information security activities of leading domestic companies - Education on Risk Management Framework (RMF) and Zero Trust implementation cases for electronic financial companies

- Strengthening understanding of inspections based on Privacy Impact Assessment checklist items - Finding and improving errors in personal information flow charts - Identifying and improving personal information breach factors - Understanding Privacy Impact Assessments and finding errors - Understanding Personal Information Protection Act and finding errors

- Professional training for KISA ISMS-P certification audit preparation - Understanding and establishing improvement plans for information security workflow in fintech and electronic financial companies - ISMS-P certification audit application process following vulnerability analysis and assessment of electronic financial infrastructure according to Electronic Financial Supervision Regulations - Improvement of financial companies' incident response and breach response manuals - Know-how for creating personal information flow charts according to the Credit Information Act and submitting performance records for establishing and operating personal credit information management systems

- Policy revision for establishing cloud management systems (CSP/MSP contracts and SaaS contracts) - Vulnerability assessment for ISMS-P/ISO27001 certification or major information communication/electronic financial infrastructure response in cloud environments (public/private asset identification and vulnerability remediation) - Security operations and incident response in cloud environments - ISO27017&ISO27018 certification response

Developed to submit annual performance records, including the establishment of information security regulations and the preparation of various activity evidence, by applying domestic and international certification standards for Information Security Management Systems (ISMS) and internal/external audit criteria to the revised Risk Assessment standards for the Management and Physical sectors of Critical Information and Communication Infrastructure in the second half of 2025. The plan is designed to prepare for changes in the external environment (AI, etc.), internal environment (new systems and changes in employees/external staff), and new evaluation indicators and legal amendments. It aims to establish activity plans to advance information security levels compared to the previous year. Specifically, it involves objectively and meticulously inspecting various activities to strengthen accident prevention systems—such as personal information leaks caused by hacking—and establishing plans for the headquarters to supervise all departments and ensure the secure management of contractors. This includes operating DevSecOps systems following the introduction of AI systems and implementing Privacy by Design (PbD) adequacy review frameworks. The execution is based on expanding monitoring and periodic inspection report areas, external disclosure areas, data linkage system inspections (API, MyData, etc.), establishing network separation improvement plans according to N2SF, and advancing Zero Trust implementation. *Possessing over 150 references for establishing and applying the world's first and highest-level information security and personal information protection activities and system enhancement plans.

2025 Electronic Financial Infrastructure (OS Virtualization, Container Virtualization) Inspection Know-how Transfer and 2025 Second Half Revised Major Information and Communication Infrastructure (CA,HV) Inspection Know-how Transfer In particular, providing Risk assessment for core hypervisors (ESXi, Xenserver) with the latest versions Additionally providing Risk assessment for K8S(Kubernetes_master), Docker, etc. Finally, providing vulnerability analysis and assessment results that meet CSAP (Cloud Management System Certification) standards **Providing installation methods for ESXi, Kubernetes master, Docker, Xencenter

Electronic Financial Infrastructure Vulnerability Analysis and Assessment based on 2025 standards, DBMS, WAS(PaaS), PC explained based on the Major Information and Communication Infrastructure standards revised in the second half of 2025 And penetration testing explained based on the standards revised in the second half of 2025 Additionally, mobile penetration testing as well Expected skill improvement through know-how transfer and fast and accurate inspection methods and remediation measures

Electronic Financial Infrastructure Vulnerability Analysis and Assessment based on 2025 standards, DBMS, WAS(PaaS), PC explained based on the Major Information and Communication Infrastructure standards revised in the second half of 2025 And penetration testing explained based on the standards revised in the second half of 2025 Additionally, mobile penetration testing as well Expected skill improvement through know-how transfer and fast and accurate inspection methods and remediation measures

Developed to submit annual performance records, including the establishment of information security regulations and the preparation of various activity evidence, by applying domestic and international certification standards for Information Security Management Systems (ISMS) and internal/external audit criteria to the revised Risk Assessment standards for the Management and Physical sectors of Critical Information and Communication Infrastructure in the second half of 2025. The plan is designed to prepare for changes in the external environment (AI, etc.), internal environment (new systems and changes in employees/external staff), and new evaluation indicators and legal amendments. It aims to establish activity plans to advance information security levels compared to the previous year. Specifically, it involves objectively and meticulously inspecting various activities to strengthen accident prevention systems—such as personal information leaks caused by hacking—and establishing plans for the headquarters to supervise all departments and ensure the secure management of contractors. This includes operating DevSecOps systems following the introduction of AI systems and implementing Privacy by Design (PbD) adequacy review frameworks. The execution is based on expanding monitoring and periodic inspection report areas, external disclosure areas, data linkage system inspections (API, MyData, etc.), establishing network separation improvement plans according to N2SF, and advancing Zero Trust implementation. *Possessing over 150 references for establishing and applying the world's first and highest-level information security and personal information protection activities and system enhancement plans.

This is the CPPG WIN course, a shortcut to obtaining the CPPG certification. This is a theoretical course for passing the 2025 CPPG certification, reflecting the recent 6 exam trends.

This course systematically teaches practical Docker skills (installation→operation→automation→security) and comprehensively covers the latest security threats and countermeasures in each section. It features a hands-on approach where you learn by following along with practical exercises. This curriculum is highly recommended for DevOps engineers, infrastructure engineers, and security practitioners who want to experience the latest container/cloud environments in real-world scenarios.

Through this course, you can study short answer and descriptive questions from past practical exams for the Information Security Engineer.

Produced reflecting latest legal changes and recent exam patterns. Even without personal data knowledge, we'll explain it for easiest understanding. Trust and follow!

This course carefully selects the core systems that beginners must know in the vast field of information security. Instead of rigid theory, it's structured to help you intuitively understand system principles through clear analogies and practical examples. With this single course, you can grasp the big picture of information security systems as a whole and develop practical skills.

This course is a foundational learning program that covers Introduction to Information and Communication Technology, one of the core theories in computer engineering. Through this course, learners can understand the basic structure and operating principles of computers, and learn the principles and applications of information and communication technology based on this foundation. The course is structured to provide comprehensive learning from the processes of information generation, transmission, processing, and storage to data communication methods in network and internet environments. In addition to the basic concepts of information and communication technology, by understanding the trends and roles of information and communication technology utilized in real life and across industries, this course provides a solid theoretical foundation for learners who are first entering the fields of computer engineering and information and communication technology. 👉 By taking this course, learners can build a fundamental foundation in information and communication technology that encompasses computers and networks, and further utilize it for advanced learning or preparation for related certifications.

This lecture is designed to make personal information protection education interesting and ‘social engineering-based.’ Rather than covering the revisions to the Personal Information Protection Act, it focuses on real-life information protection threat cases and responses.

IT services are rapidly transitioning to cloud environments. You will learn security practices from basic virtual infrastructure construction to security threat monitoring and vulnerability diagnosis for each area to secure the Amazon AWS cloud environment.

This is a course where you can learn the basics of web technology. You can learn the basics of web technology in a short period of time. If you are interested in studying or getting a job related to the web, you must take this course!

You can understand the concept and technology of blockchain and conduct ISMS-P certification audits specialized for virtual asset exchanges.

This is an online course where you can learn essential content for certification, from basic concepts of information security to the latest security issues. With theory reflecting the latest exam trends and practical mock tests, you can efficiently prepare for the exam, and it's structured so that even those new to information security can easily follow along.

This lecture provides a general guide on how to prepare while studying when you want to choose a career in IT security penetration testing, and what questions and answers to prepare for the interview. I will share my experience working as a penetration testing consultant, at large companies, and in the financial sector, and currently running a penetration testing consulting business.