Thousands of Cyberattacks Target Government Ministries ... Security Staff: Just 1

According to a report by IT Daily, some government ministries have only 1 dedicated security staff member, even as attempts to launch cyberattacks against government ministries have reached several thousand. As attacks using automated technologies that exploit AI grow larger in scale and faster in speed, the current staffing level is far from sufficient to respond.

On the 15th, Rep. Im Moon-young of the Democratic Party of Korea made public data submitted by the Ministry of Intellectual Property and the Korea Invention Promotion Association. According to the data, the Ministry of Intellectual Property entrusts the operation of its web services to the National Information Resources Service.

Attempts to launch cyberattacks against the web services totaled 5,346 through September this year. That is about 2.6 times last year's full-year total of 2,080 in just 9 months.

Attempts to steal information also rose from 694 in the same period to 2,893, an increase of more than 4 times. However, no actual intrusion incident leading to damage occurred in the web services.

While attempts at cyberattacks increased by more than 3,000, both the Ministry of Intellectual Property and the Financial Services Commission had very few dedicated security staff, or had seen those staff numbers decline. The shortage of dedicated security personnel was not limited to the Ministry of Intellectual Property.

At the Ministry of Intellectual Property headquarters, the number of regular employees in information security fell from 4 in 2022 to 2 this year, and only 1 person is dedicated to security work. Separate from the outsourced web services operation, there is a shortage of personnel to oversee the establishment of security policy for the entire ministry and the management and supervision of outsourced and affiliated institutions.

At the Ministry of Intellectual Property, the official in charge of information security also serves concurrently as head of information system operations. The person in charge of the Ministry of Intellectual Property's information security post has been replaced 5 times since 2020.

The Financial Services Commission also had only 1 person in charge despite several thousand cyberattack attempts. According to Rep. Han Min-soo of the Democratic Party of Korea, cyberintrusion attempts targeting the Financial Services Commission reached 3,433 from January to July this year, 2.7 times last year's annual total of 1,259. Cyberintrusion attempts targeting the Financial Services Commission were 342 in 2023 and 536 in 2024, and they had remained below 1,000 through last year, but a sharp increase began last year.

It was found that, even as it faced several thousand attacks, the Financial Services Commission had only 1 dedicated information security staff member within the Information Operations Team. The commission is reportedly planning to add 1 person in that area.

Meanwhile, the National Intelligence Service published the 'Basic Guidelines for National Cybersecurity' in May this year. Article 5, Paragraph 3 of the guidelines stipulates that dedicated cybersecurity personnel should make up at least 10% of the personnel responsible for information work. Through last year's guidelines, that provision had been a recommendation, but it was made mandatory in this year's revision. However, the Ministry of Intellectual Property has 1 dedicated security staff member, and the Financial Services Commission also has 1, so both bodies appear to have a high likelihood of struggling to meet the standard given their current staffing levels.

An industry source said that public-sector information security staffing began to increase about 5 years ago. However, the source explained that it is still handled by only some personnel under the information officer rather than through a separate organization. The source added that there are concerns over whether the current staffing structure can protect key systems from AI-based attacks.

Recently, cyberattacks targeting government ministries have increased severalfold in a short period, driven by the automation of attacks using AI, but there are concerns that the manpower and technical response systems needed to stop them are insufficient. With only 1 dedicated security staff member, it is not enough to defend against a concentrated wave of AI attacks, and the technical response systems to supplement that are also inadequate.

In response, the Ministry of Intellectual Property said in a reply submitted to Rep. Im's office that it does not separately classify a detection system for automated attacks using AI. It was also found that the Korea Invention Promotion Association, an affiliated institution of the ministry, suffered its first intrusion incident in 2023, and the cause of that incident was the failure to apply a response logic for automated attacks. Even after experiencing the related incident, it did not appear to have reorganized its security system.

On that basis, Rep. Im said cyberattacks targeting the Ministry of Intellectual Property had surpassed last year's level in just 9 months and expressed concern that the ministry has only 1 public official dedicated to security. He then urged a full review and improvement of the AI-based cyberattack response system, security management of affiliated institutions, specialized personnel, and budgets.

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242230

References

• https://www.itdaily.kr/news/articleView.html?idxno=242230