Obligation to inspect public systems for hacking vulnerabilities once a year... Revision of the National Security Commission Guide

A personal information safety measure guide has been released that specifically explains the obligation to inspect security vulnerabilities and perform penetration tests for public systems at least once a year and reflects the latest authentication technologies such as Passkey.

The Personal Information Protection Committee announced on the 5th that it has revised and published a guidebook on 'Standards for securing the safety of personal information' that reflects the obligation to check public system vulnerabilities and the latest security technologies.

This guide has revised explanations and examples to reflect the recent revisions to the notice and the changing personal information processing environment, and has supplemented answers to questions frequently raised in the field.

First, we added explanations and frequently asked questions (FAQs) regarding the obligation to conduct vulnerability checks and penetration tests for public systems at least once a year.

In order to prevent personal information leaks in the public sector, the Personal Information Commission revised the notice in July of this year to conduct vulnerability inspections and penetration tests for each public system at least once a year, and to supplement and improve identified vulnerabilities without delay.

Examples of technological changes such as diversified authentication methods and artificial intelligence (AI) were also added.

The authentication methods introduced in the guide have increased from 7 types, including passwords, one-time passwords (OTP), and text messages (SMS), to 12 types, including passkeys, QR codes, and mobile apps.

Considering the possibility of changes in the encryption system due to the development of quantum computing technology, it also includes information on the introduction of quantum-resistant encryption.

The importance of key management was also emphasized by asking caution not to store encryption keys in plain text in application source code or configuration files.

Checkpoints for the safe use and management of application program interfaces (APIs) used for linking information between systems were added, and explanations on safety measures to be considered when system updates are delayed were also supplemented.

Lee Sang-min, personal information policy director of the Personal Information Committee, said, "We expect to increase field understanding of safety measure standards and reduce confusion that may arise when applying safety measures in the work environment. We plan to supplement the guide in consideration of personal information processing environment and technological changes."