In Financial Sector AI Hack, Cisco Says Reinforcing Basic Protections Is Key
IT DAILY ·
✦ AI Summary
Jatin Sachdeva, Cisco APJC Chief Security Architect, said the vulnerabilities in the recent hacking incident in South Korea's financial sector were already widely known information.
He said AI has sped up the pace of attacks and that security systems need to be adjusted to match.
He also emphasized that Zero Trust, network segmentation, and lateral movement control remain as important as ever.
Jatin Sachdeva, Cisco APJC Chief Security Architect, said in response to the recent hacking incident in South Korea's financial sector that the vulnerability the attacker exploited was already widely known information. He made the remarks at a roundtable on the 13th at Cisco Korea's office in Gangnam-gu, Seoul.
Sachdeva said AI is accelerating the speed of attacks. He added that security frameworks need to be reorganized to keep up with that faster pace.
He said, however, that the essence of the required protective measures has not changed. He stressed the importance of Zero Trust, network segmentation, and controlling lateral movement. The photo from the event shows Sachdeva answering questions during a Q&A session, and it was provided by Cisco Korea.
After personal information leaks occurred at 7 financial companies in late September to early October, financial authorities urgently summoned CEOs of financial firms and officials from related agencies. The authorities checked response efforts and shared related information, including attack IP addresses.
The issue drawing attention in this incident was ARTEX. ARTEX is an AI-based penetration-testing tool designed to strengthen defenders' capabilities and is available as open source on GitHub. However, attackers abused ARTEX as a hacking tool and launched simultaneous attacks on multiple organizations. The case also fueled fears that AI-driven attacks have become real.
The security industry, however, analyzed the incident as closer to existing cases of attack automation. Attackers first targeted externally exposed assets that had been left outside management oversight, and AI was used to carry out that targeting process more quickly.
The architect gave a similar answer when asked about the hacking incident in the financial sector. He said he had reviewed recent attack cases in South Korea and explained that while attackers' use of AI has increased the speed of attacks, the nature of the security gaps involved was already a known attack path.
He said faster defensive capabilities are needed to respond to the AI era. He cited Zero Trust and network segmentation as the necessary technologies, explaining that these were also important and necessary in the past.
The discussion then turned to responses to weaknesses related to insufficient authorization in the financial sector hacking cases. Authentication refers to the process of verifying identity, while authorization refers to verifying what privileges a user has. Some in the security industry pointed to the possibility of an authorization flaw related to account privilege verification in the Shinhan Bank hacking incident.
The architect explained that if users are granted excessive privileges, the resources and scope they can access can become too broad. He said Cisco's Secure Access feature can be used to identify AI agents with excessive privileges, determine their related actions, tools, and resources, and immediately block actions that exceed their permitted scope.
At the roundtable, the agenda also covered Secure Access Service Edge, or SASE, and discussed changes in the environment as the spread of AI significantly increases connections between organizational systems and the external internet. According to Cisco's research, traffic increases by as much as 450% when AI agents perform tasks, and AI inference accounts for 70% of that additional traffic.
Cisco argued that security in the AI era requires network technology to be used in parallel. To that end, it presented security solutions such as efficient network configurations based on software-defined wide area networks, or SD-WAN, and cloud-based web firewalls as necessary components, and said SASE is a solution that encompasses these network and security requirements.
Hwang Sang-gyu, managing director at Cisco Korea, said MFA is needed in response to incidents in South Korea's financial sector. He also explained that Cisco integrated the Duo platform with Secure Access and that the purpose was to strengthen authentication and authorization security.
Mukesh Chand Trapliyal, APJC SASE business leader, said that network and security cannot be separated and must be handled together, and explained that SASE is a way of integrating them. He said SASE can handle the traffic increase driven by AI and is a technology for defending against threats.
Cisco said it has been operating local infrastructure and building domestic points of presence, or PoPs, to provide such services to Korean companies, and that it has also launched a Seoul region service. The Seoul region service began on July 29 this year, and the company emphasized that it can reduce latency and meet local data regulations.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242162
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.