"As cyber attacks utilizing artificial intelligence (AI) become more sophisticated, there is a growing sentiment that 'AI attacks should be countered with AI.' I believe this statement is partially correct and partially incorrect. While AI-based security responses are necessary, strengthening basic cybersecurity frameworks and reducing vulnerabilities should come first."
Concerns about corporate cybersecurity responses are rising following a series of hacking incidents in the financial sector and the discovery of critical security vulnerabilities in PHP, a widely used programming language for website development. The proliferation of AI-driven vulnerability scanning and automated attacks has expanded the security threats that companies must address.
Choi Young-cheol, CEO of SGA Solutions, emphasized in an interview that basic security measures must take precedence even as AI-driven cyber attacks become more advanced. He explained that while utilizing AI technology for security responses is important, companies must first improve existing vulnerabilities in authentication and access control.
Choi is an expert with nearly 30 years of experience in the information security field. He worked as a researcher at the Korea Internet & Security Agency (KISA) in 1997 and currently leads integrated security projects at SGA Solutions.
He diagnosed that recent incidents in the financial sector demonstrate persistent gaps in domestic companies' authentication and access management. He stressed the need to strengthen and institutionalize relevant security standards to transition from traditional perimeter-based security systems to a zero trust-based security framework. Below are excerpts from his interview.
- Hacking and personal data breaches are occurring frequently in the financial sector. What is the biggest issue?
"The incidents in the financial sector exploit weaknesses in basic authentication and access management rather than advanced hacking techniques. Attackers obtained leaked usernames and passwords and automated login attempts using AI-based tools. Particularly, external business systems for loan brokers differ from internet banking and security standards, leading to cases where two-factor authentication was not applied. In some systems, attackers could log in with legitimate accounts and change request values to access customer information from other employees. The lack of basic authentication and access control is the biggest issue."
- What changes are occurring as AI is utilized in cyber attacks?
"In the past, finding software vulnerabilities required a high level of skill and time. Now, AI can identify vulnerabilities and automate attacks. Even novice hackers can leverage advanced hacking capabilities, allowing one individual to perform the roles of hundreds or thousands. If AI continues to identify complex vulnerabilities for attacks, we could see more frequent sophisticated attacks similar to those against telecommunications companies. All industries and public institutions are potential targets."
- How should companies respond to the increasing sophistication of AI attacks?
"The saying 'AI-based cyber attacks should be countered with AI' is partially correct and partially incorrect. While AI-based defenses are important, there are attacks that can be thwarted with basic security measures. I believe the recent financial sector incidents could have been prevented if proper authentication and access controls had been applied. First, we need to reduce vulnerabilities in existing security frameworks. Then, we can enhance response speed through AI-driven software vulnerability assessments and automated security monitoring."
- New security risks are being reported due to the proliferation of AI agents.
"The environment where AI agents perform tasks by accessing internal systems and data instead of humans is expanding. While humans authenticate using usernames, passwords, and one-time passwords (OTPs), AI agents automatically access systems by delegating user permissions. This process can complicate access management. AI agents should also have their accounts registered and access permissions controlled like humans. However, since the technical structures of AI agents vary, standardization is still needed. AI agents must be included in a 'zero trust' security framework that verifies authentication and permissions each time access is attempted, without automatically trusting users or devices."
- What is micro-segmentation, and how does it prevent attackers from moving internally and spreading damage?
"Simply blocking external intrusions is not enough. We must prevent attackers from moving laterally after compromising one server to access critical information on another. Micro-segmentation is a technique that divides servers and systems to limit the range of access between them. Even if one server is compromised, it becomes difficult for the attack to spread to other servers, thereby reducing damage. As AI makes vulnerability scanning easier, having a security framework that assumes breaches will occur becomes increasingly important."
- What is the current level of zero trust adoption among domestic companies?
"Domestic companies have invested in security for a long time, but many operate individual security products that are not interconnected. We need to shift from the existing perimeter-based security model to a structure that continuously verifies authentication and permissions for users, devices, and systems. A 'zero trust native' approach, where the security framework itself is designed based on zero trust principles, is necessary."
- Are companies increasing security investments following large-scale hacking incidents?
"I have not yet felt significant changes. Even after last year's telecommunications incident, various measures were proposed, but fundamental technological changes have been insufficient. From a corporate perspective, security investment is often viewed as a cost rather than a means to increase revenue. It is also challenging to persuade companies that have already received security certifications and implemented related products to invest further. Although companies face penalties after incidents, these situations do not sufficiently connect to investments for building new security frameworks."
- What institutional improvements are needed to expand security investments?
"While zero trust guidelines and government pilot projects have been established, actual on-site adoption remains limited. Relying solely on companies' voluntary decisions for security framework transitions has its limits. We need to strengthen existing security certifications and regulatory controls to align with current threats and establish criteria for implementing and validating zero trust security models. We must also prevent situations where companies claim to have established zero trust by implementing only some functions. Changes in security standards are necessary for corporate investments to lead to actual system improvements."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.