No Vulnerabilities Found in Emergency Review at Korea Gas Technology Corp. Despite No MFA for Admin Accounts
IT DAILY ·
✦ AI Summary
Korea Gas Technology Corp. conducted an emergency security review on Oct. 6 following the hacking incident in the financial sector.
The company reported zero vulnerabilities in the account and authentication protection category, but actual operating standards showed that MFA was not applied to system administrator accounts.
The company said administrator accounts are controlled through firewalls and IP access restrictions, and Rep. Lim Moon-young of the Democratic Party of Korea demanded an explanation of the review criteria and the basis for the finding of no problems.
Korea Gas Technology Corp. was found to have reported zero vulnerabilities in the account and authentication protection category after conducting an emergency security review on Oct. 6 following the hacking incident in the financial sector. According to materials submitted by the company and disclosed on the 19th by Rep. Lim Moon-young of the Democratic Party of Korea, the company carried out the emergency security review with items including whether MFA was applied, brute-force attacks, retired employees' accounts and password resets.
As a result of the review, the company reported zero vulnerabilities in the account and authentication protection category. Zero vulnerabilities were also reported in the latest emergency security review results.
However, under actual operating standards, MFA was not applied to system administrator accounts. By contrast, general employees and outsourced personnel are subject to OTP authentication when accessing the internal network.
In response to the gap between the review results and actual management practices, the company said administrator accounts are controlled through firewalls and IP access restrictions.
MFA is a method that allows access only to users who pass two or more forms of authentication. The basic first step in account login is primary authentication through an ID and password. Examples of MFA configurations include requiring additional authentication such as fingerprint recognition.
By contrast, if MFA is not applied and only firewall and IP access restrictions are used, only ID and password authentication remains in place. In that case, access may be possible through an allowed IP range or if an insider account is compromised. Under such conditions, the system may be left exposed without protection against attack threats.
A real-world example related to this is the personal information leak incident at Shinhan Bank. In that case, the loan broker-only service was cited as the subject at issue. It became known that this service did not have an MFA system requiring separate additional authentication measures.
Reflecting the growing importance of this issue, the National Intelligence Service incorporated related provisions into Article 76, Paragraph 4 of the revised 'National Cybersecurity Basic Guidelines,' amended on May 1 this year. The revised guidelines explicitly state that MFA should be applied to authentication for information system administrator privileges. However, they also include an exception allowing it not to be applied if doing so is unavoidable due to the characteristics of the information and communications network or information system.
Meanwhile, the topic of materials related to Korea Gas Technology Corp. is whether an emergency security review was conducted after the 2026 hacking incident in the financial sector and what the results were. The source of the related photo is Rep. Lim Moon-young's office.
Regarding the company's security operations, the reason MFA was not applied to administrator accounts was presented as an item requiring confirmation. Rep. Lim pointed out that administrator accounts were operating without MFA.
The circumstances behind the report of zero vulnerabilities in the emergency security review were also cited as another point requiring confirmation. Rep. Lim noted that zero vulnerabilities were reported in the emergency security review even though MFA was not applied to administrator accounts, and called for a clear explanation of the review criteria and the basis for determining that there were no problems.
Shortcomings were also found in terms of security staffing. According to Rep. Lim's office, the company's information security center has 5 employees, accounting for 0.21% of the company's total workforce of 2,339. It was also found that only 1 person held the qualification of ISMS-P certification auditor.
At 14 branch offices nationwide, employees assigned to other tasks were found to be handling cybersecurity work concurrently. Rep. Lim emphasized that information security at an agency managing national gas facilities is directly linked to public safety, and said that rather than the pace of AI adoption, what is needed is the establishment of a security system spanning administrator accounts, on-site PCs, and security monitoring.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242294
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.