The South Korean government has launched a security review of more than 170 critical private-sector information and communications facilities. The move follows the discovery of a serious security flaw in PHP, a programming language used by more than 70% of websites worldwide, and a string of cyber breaches across financial firms and private companies that prompted authorities to take a close look at vulnerabilities at major corporations.
The government is reviewing security vulnerabilities at 111 organizations that manage key information and communications infrastructure in the private sector, according to the Ministry of Science and ICT on the 28th. The review covers about 172 facilities operated by those organizations, including critical infrastructure in sectors ranging from telecommunications to internet platforms.
The review was launched to strengthen security systems at major information and communications facilities after a series of breaches, including personal data leaks, at financial institutions and public agencies. The discovery of the serious flaw in PHP is another key factor behind the move.
Because internet-facing assets have been flagged as one of the main entry points for hackers, the government plans to check whether security gaps remain in servers and web pages that can be accessed from outside. Specifically, it will examine how each organization manages the security of the systems it operates and identify weaknesses that could be exploited in cyberattacks. The aim is to reassess the overall security level of critical facilities rather than focus on problems in any single piece of software.
The government plans to secure consent from the organizations under review by the end of this month and distribute a checklist for self-assessments. It will then combine those self-assessments with reviews of security management practices to determine whether vulnerabilities are being properly managed. The full review is expected to be completed as early as next month and no later than the end of this year.