Faced with the "weaponization" of emerging AI tools and automation technologies by attackers, high-efficiency and large-scale cyber attacks are frequently reported internationally. The Information Security Agency of the Ministry of Digital Development issued a warning today (21st) that South Korean financial institutions have recently been invaded by AI tools combined with multi-layered springboards, leaking more than 60,000 pieces of personal information. Many key infrastructures in Japan have also been intensively exposed to ransomware attacks. Faced with the intersection of new and old information security threats, the Information Security Agency reminds enterprises to strengthen basic protective measures to reduce the risk of cyber attacks.
The Information Security Administration pointed out that in addition to the security incidents in South Korea and Japan, the industrial control systems of hundreds of supermarkets in France have recently been hacked due to preset passwords and known vulnerabilities, leading to system shutdowns; domestic public and private sectors are facing the risk of spying on backup and test systems. These incidents show that even if attack methods continue to evolve, traditional information security protection blind spots may still become a breach for hackers.
The Information Security Administration emphasized that AI changes the speed and cost of attacks, but the core concept of defense has not changed. Enterprises should grasp the two key points of "reducing the attack surface" and "providing backup and backup."
Key point 1: Reduce the attack surface and reduce the number of entrances found by AI automatic scanning.
First of all, in terms of reducing the attack surface, enterprises should reduce exposed assets, including inventory of external information assets such as websites, VPNs, remote desktops, NAS and routers, and regularly check open services and ports. Adhering to the principle of "non-essential and not external", only VPN access is allowed in the backend and test stations; equipment that the original manufacturer has stopped supporting is listed for replacement, and network segments that cannot be replaced are isolated first.
Regarding system vulnerabilities, the Information Security Administration recommends that enterprises refer to the TWCERT/CC warning and known exploited vulnerabilities (KEV) list to prioritize patching vulnerabilities that have been exploited by attackers. In terms of account security management, multi-factor authentication (MFA) or Passkey should be introduced for remote connections, emails and administrator accounts, and zero trust architecture (Zero Trust) should be gradually introduced for remote access.
In addition, employees should deactivate their accounts immediately on the day they leave, clean up idle accounts regularly, review usage permissions quarterly, and manage administrator accounts separately from accounts used by employees for daily mail and Internet use to reduce information security risks.
Key point 2: Make backups and backups so that you can recover as quickly as possible after being attacked.
In terms of backup and recovery, enterprises should implement the "3-2-1 backup principle", that is, keep 3 copies of data, use 2 different storage media, and at least 1 copy is saved offline or set to be undeletable; the backup scope must cover system settings and databases, the backup environment and the official environment should be isolated by separate accounts and network segments, and actual restore drills should be performed at least once a quarter.
In addition, enterprises should also establish a backup mechanism for critical systems, with the management layer prioritizing system recovery and the maximum tolerable downtime; preparing backup hosts, cloud backup, or manual replacement work processes for key services. In addition, switchover drills are conducted at least once a year, and warnings are set for abnormal encryption, backup deletion, and non-working hours login, etc., coupled with endpoint detection (EDR) and log storage, to improve the detection and recovery capabilities of abnormal events.
To help enterprises respond to information security threats, the Information Security Administration stated that the government has provided a number of free resources, including TWCERT/CC attack trends and vulnerability warnings, malicious sample analysis, information security incident coordination, and information security protection guidelines and training courses for small and medium-sized enterprises. In addition, the company has also established an enterprise information security hotline (0800-280-280) in conjunction with the "Immediate Service Center", and continues to update the information security frequently asked questions (FAQ) to include the latest Internet fraud and emerging AI issues, providing diversified information security support for small and medium-sized enterprises.
