On October 28, 2026, the Ministry of Science and ICT (MSIT) announced that it will conduct an emergency security vulnerability inspection of 111 private key information communication infrastructure institutions (172 facilities), following recent cyber intrusion and personal information leakage incidents in the financial and public sectors 1, 2, 3. This emergency inspection is a measure conducted separately from regular inspections mandated by existing laws and regulations. It aims to immediately improve the security level of internet-facing assets that can be easily accessed by malicious attackers from outside. To understand this inspection, it is first necessary to grasp the designation structure of key information communication infrastructure and the security inspection framework required by relevant legislation.
Designation Structure and Legal Standards for Key Information Communication Infrastructure
Key information communication infrastructure refers to core systems whose compromise from cyber incidents could have significant impacts on national security or socio-economic stability. These facilities are designated and managed under the "Information Communications Network Protection Act" 3. The scope covers facilities in various sectors, including telecommunications, finance, energy, transportation, broadcasting, healthcare, and public services 4, 5. In particular, there is a trend of expanding the scope to fields applying new technologies such as cloud data centers, smart cities, and 5G networks 5.
Once designated as key information communication infrastructure, management institutions assume specific obligations to protect the facilities. By law, management institutions are required to perform regular vulnerability analysis and assessment annually for facilities under their jurisdiction as designated by relevant central administrative agencies 4, 5. As a basic principle, analysis and assessment must be completed within six months of the initial designation 4, 5. If unavoidable circumstances make it difficult to perform the assessment within the deadline, it can be extended by up to three months with approval from the head of the central administrative agency 5. However, assessments conducted before the six-month period are accepted if they meet the criteria 5.
Core of 2026 Security Assessment: Significant Subdivision of Web and Cloud Items
The detailed and specific criteria for regular security inspections follow the guidelines issued by the Korea Internet & Security Agency (KISA). KISA released the "Detailed Guide for Technical Vulnerability Analysis and Assessment of Key Information Communication Infrastructure 2026" on December 24, 2025 4. The most notable feature of this guideline is that inspection items in the web application and cloud sectors, which frequently prompted inquiries from practitioners, have been significantly subdivided and detailed 4.
The technical guidelines consist of a total of 12 fields. Among these, the Web Application field contains 21 sub-items, all of which are designated with an importance level of 'High' 4. Specific inspection items include code injection (including SSTI and XXE), SQL injection, SSRF, CSRF, malicious file upload, exposure of administrator pages, and automated attacks 4.
The Cloud (CA-01~CA-19) field is operated with a total of 19 items. This area is meticulously inspected through four categories: account management (including MFA), permission management, virtual resource management (VPC and storage public access), and operational management (encryption, logging, and backup) 4. Additionally, virtualization equipment is treated as an independent inspection target distinct from cloud services and is handled under the 'Virtualization Equipment' field (HV-01~HV-25) with separate items 4. During practical preparation, institutions prioritize addressing items with a 'High' importance level and use free scan services to conduct an initial check of externally exposed assets 4.
Inspection Execution Method: Comprehensive Evaluation Across Three Areas
Security inspections do not merely involve running automated tools. A comprehensive and multidimensional evaluation is conducted by dividing the assessment into managerial, physical, and technical areas 5.
The specific execution methods for each area are as follows:
| Area | Main Inspection Method | Evaluation Content |
|---|---|---|
| Managerial | Document review and interviews | Establishment and implementation of security policies |
| Physical | On-site inspection of controlled areas (e.g., computer rooms) | Physical access control and facility protection status |
| Technical | Tool inspection and penetration testing | Technical defense capabilities of systems and networks |
(Based on 5)
The entity performing the assessment can be the management institution itself, or it can delegate the evaluation to the Korea Internet & Security Agency (KISA) or information security specialist service companies designated under Article 48-2 of the "Framework Act on Industrial Development of Information Technology" 5. If a system integration (SI) company is entrusted with system operations, SI may be included in inspection preparation depending on the scope of the contract 4.
When analyzing technical vulnerabilities, particular attention is paid to vulnerabilities discovered in the previous year 5. Target assets for inspection are graded by importance to establish priorities, and risk ratings are calculated based on analysis results, considering confidentiality, integrity, and availability 5. These risk ratings are classified as High, Medium, and Low, and vulnerabilities rated 'High' require early remediation 5. For the remaining ratings, medium- to long-term improvement plans are established 5.
Background of This Emergency Inspection: Externally Exposed Assets and PHP Vulnerabilities
This emergency security vulnerability inspection, which began in late October 2026, is conducted independently of the regular compliance inspections mandated by law 3. The inspection targets include 111 institutions managing 172 facilities in the telecommunications, platform, and financial sectors, covering wired and wireless network services and internet data center-related systems of the three major telecommunications companies: SK Telecom, KT, and LG U+ 3.
The background of this emergency measure lies in the investigation of the causes behind recent cyber intrusion incidents in the financial sector. According to analyses by financial regulators, internet-facing assets (externally exposed servers, web pages, etc.) such as ancillary systems, which were previously excluded from security inspection targets, were confirmed to have been exploited as primary infiltration paths by hackers 1, 3. Consequently, the MSIT concentrated its efforts on identifying internet-exposed assets with a high possibility of being exploited by hacking and verifying security vulnerabilities 1, 3.
In addition, the discovery of severe security vulnerabilities in the PHP language, used by up to 70% of websites worldwide, also played a major role 3. Regarding PHP, a vulnerability at the programming language level, the government assessed its domestic impact and the status of security patches and concurrently pursued necessary response measures 3.
Inspection Procedures and Method for Determining Improvement Actions
For this emergency inspection, the MSIT received security inspection consent forms, current status of target facilities, and self-inspection checklists from the respective management institutions by the end of October 2026 2, 3. Based on this, it planned to begin inspections in November and complete all inspection procedures by the end of 2026 at the latest 1, 2. On-site, inspections were scheduled to include verification and parallel checks of security management practices in addition to the results of each institution's self-inspection 1, 2.
The method for calculating the results of regular vulnerability analysis and assessment also follows clear criteria. Analyzed vulnerabilities are converted into quantified scores based on assessment results. To ensure the objectivity of the assessment results, scores are derived through a separate formula out of a maximum of 100 points 5.
Criteria have also been established for handling 'unremediable vulnerabilities' where technical measures are impossible, or where applying security patches would disrupt service operations. Such vulnerabilities must be supported by evidence and systematic compensating controls, which must be reflected in protective measures 5.
Utilization of Results and Pre-inspection Preparation Process for Institutions
Vulnerability analysis and assessment serve not merely as formal requirements but as fundamental data for establishing substantive protective measures 5. Management institutions and practitioners, including SI partners, apply specific pre-inspection preparation processes based on the 2026 Detailed Guide published by KISA. Applying the four-step practical preparation process recommended by the guide results in the following:
- Before D-90: Identify target assets such as IPs, domains, and cloud accounts to completely organize the inventory.
- Before D-60: Conduct internal pre-inspections based on the 21 Web Application and 19 Cloud items.
- Before D-45: Coordinate inspection schedules and scopes with the inspection conducting entity (delegated agency).
- Before D-30: Systematically organize essential evidence such as configuration states before and after vulnerability remediation, logs, and screenshots 4.
This phased approach helps institutions move beyond sporadic security responses to establish a systematic vulnerability management framework. As the adoption of new technologies such as cloud, AI, and quantum key distribution accelerates, security requirements for infrastructure have become significantly stricter. It is time for the government to focus its management capabilities to ensure that key information communication infrastructure operates stably against cyber threats through regular protective measures and continuous, meticulous security inspections.
References
- 금융·공공 해킹에 정부 긴급 점검…민간 기반시설 172곳 대상 | 연합뉴스 · yna.co.kr↩
- [속보] 정부, 민간 주요정보통신기반시설 170여개 취약점 점검 착수 · joongang.co.kr↩
- 금융권 해킹·PHP 취약점에…정부, 통신사 등 172곳 보안 점검 | 한겨레 · hani.co.kr↩
- 주요정보통신기반시설 취약점 평가 2026 개편... | SENTRIX 블로그 · sentrix.co.kr↩
- 주요 정보통신기반시설 취약점 분석ㆍ평가 - Carlsen's · carlsenblog.com↩
