[Exclusive] “Shut the side door”... Banks expand “second-factor authentication” for external access

[Financial News] Since a hacking incident rocked the financial sector, stronger authentication procedures have been spreading, particularly among banks. Security measures are being urgently stepped up, including the introduction of mobile one-time password (OTP) authentication for external access, adding a second authentication step even to bank-linked websites, and fully blocking access from overseas IP addresses.
According to the financial industry on the 14th, as hacking attempts using artificial intelligence (AI) continue, banks are strengthening security and authentication procedures, led by their security departments.
Industrial Bank of Korea revised its work manual on authentication procedures starting on the 12th. Previously, employees logging into the bank’s systems from outside the bank only had to verify their identity once with their employee number and password. A second authentication step has now been added, requiring them to authenticate through mobile OTP in the IBK Employee Authentication app.
In a notice, Industrial Bank of Korea said, “As data leaks through external access routes have recently occurred across the financial sector, security measures focused on prevention are needed,” adding, “We have had no choice but to implement this measure to protect internal information and strengthen verification of users’ identities, and ask for employees’ understanding.”
Industrial Bank of Korea also sent an official letter to department heads, instructing them to review the access permissions and login records for the Enterprise Architecture Management System (EAMS), which manages personal information and other data, and report their findings by the 16th. In particular, if personal information had been downloaded, employees were required to verify the reason and obtain approval from their department head. A bank representative explained, “Since 2017, we have regularly conducted a focused, comprehensive inspection of systems that handle personal information once a month.”
Industrial Bank of Korea also strengthened its procedures for checking whether security reviews had been carried out, starting on the 12th. It changed the system so that, in addition to the existing security review (the supervisory authority’s review results), compliance with common security measures would also be checked.
Woori Bank also strengthened security for the website of its in-house broadcasting station, “Channel W,” starting on the 8th. The bank did so because the information leak that recently rocked the banking sector occurred through what is known as a “back door”—a system linked to an external system, rather than the bank’s own system—and it therefore tightened security for the related service. Woori Bank added a second authentication step for Channel W logins and blocked access from overseas IP addresses.
On the 6th, NH Bank issued an official letter in the name of the head of its Customer Information Protection Department, outlining “Precautions for Executives and Employees.” It instructed staff to watch for signs of hacking attempts when checking emails and text messages, and to report any suspicious signs promptly.
On the 1st, immediately after the Shinhan Bank hacking incident, a security officer at Korea Development Bank (the head of its Safety Management Department) also sent all employees “a message offering guidance on security duties.” The main point was to have branch and department heads take the lead in carrying out substantive security work.
Hana Bank has also strengthened its security systems. It has raised the alert level for integrated security monitoring and is conducting comprehensive inspections of services exposed externally. A Hana Bank representative said, “We use AI security tools to conduct checks and have strengthened the blocking of abnormal activity through application programming interfaces (APIs),” adding, “To prevent similar incidents, we formed a dedicated team that includes external experts and completed an emergency inspection of the bank’s internal systems.” In addition, the bank plans to improve its internal abnormal-activity detection and analysis systems and begin expanding its zero-trust security framework in the first half of next year.
KB Kookmin Bank is also strengthening its response to cybersecurity threats. Kookmin Bank has completed security vulnerability checks of all systems in its DMZ, as well as comprehensive inspections of business servers accessible externally. It has also raised the cyber threat response level under its integrated security monitoring system by two levels, from “Attention” to “Alert.” To prevent further harm to customers whose information was leaked, Kookmin Bank is also conducting intensive monitoring through its Fraud Detection System (FDS).

[email protected] Park Moon-soo, Lee Hyun-jung Reporter