17,387 of 19,041 servers at 23 state-funded research institutes lack antivirus protection

Six institutes cited budget shortfalls despite a 46.3 percent rise in information security spending

Rep. Lee Hoon-ki of the Democratic Party of Korea [provided by lawmaker's office]
Rep. Lee Hoon-ki of the Democratic Party of Korea [provided by lawmaker's office]

More than nine out of 10 servers operated by 23 government-funded research institutes are running without antivirus software, a lawmaker revealed Tuesday. Some of the institutes cited budget constraints as the reason, but their information security budgets had in fact grown by 46.3 percent over the past year.

Rep. Lee Hoon-ki of the Democratic Party of Korea, who represents Incheon's Namdong-gu and sits on the National Assembly's Science, Technology, Information, Broadcasting and Communications Committee, raised the issue at a national audit of government-funded research institutes held Tuesday at the Korea Advanced Institute of Science and Technology in Daejeon.

According to Lee, 17,387 of the 19,041 servers operated by the 23 institutes — 91.3 percent of the total — lacked antivirus software. The situation was similarly poor for externally facing servers that connect directly to the internet to provide public-facing services such as websites: 372 of 766 such servers, or 48.6 percent, had no antivirus protection installed.

Externally facing servers are considered particularly vulnerable to hacking and malware infections because of their direct internet exposure. A breach could allow attacks to spread into internal networks or be exploited as a channel for leaking research data.

By contrast, the Ministry of Science and ICT headquarters — which operates under the same security guidelines as the institutes — had antivirus software installed on 100 of its 108 servers, a rate of 92.6 percent. Lee's office said the gap in basic security measures between the ministry and its affiliated research institutes was stark.

The more troubling finding was that several institutes cited budget shortfalls as the reason for not installing antivirus software, even as their actual security spending rose sharply.

Six institutes — the National Institute of Green Technology, the Korea Institute of Oriental Medicine, the Korea Institute of Industrial Technology, the Korea Institute of Machinery and Materials, the Korea Institute of Energy Research and the Korea Electrotechnology Research Institute — responded to Lee's data request by saying they would "install the software in stages after securing the necessary budget."

Yet the combined information security budgets of those six institutes rose 46.3 percent in a single year, climbing from 2.47 billion won ($1.86 million) last year to 3.62 billion won this year — an increase of 1.15 billion won. Lee's office also noted that the full information security budgets requested by all 23 institutes for this year had been approved without cuts.

The National Institute of Green Technology and the Korea Institute of Oriental Medicine went further: neither allocated a separate budget line for server antivirus software acquisition or maintenance in 2025 or 2026.

At the Korea Institute of Oriental Medicine, only two externally facing servers out of 141 total had antivirus software installed, putting the overall installation rate at just 1.4 percent. The institute cited a lack of antivirus budget as the reason.

An analysis by Lee's office found, however, that the institute had spent 43 million won of its information security budget on network line fees, 28 million won on cloud service charges and 22 million won on degausser equipment purchases.

The institute itself estimated the cost of antivirus software at about 500,000 won per server, putting the total cost of covering all 139 unprotected servers at around 69.5 million won. Had the institute not directed its security funds toward network and cloud costs, Lee's office concluded, it could have fully covered all servers.

Although the Board of Audit and Inspection and other oversight bodies have previously flagged the antivirus gap at government research institutes, some have set their target completion dates as late as next year or the year after.

At Tuesday's national audit, Lee questioned Kang Sang-wook, the Ministry of Science and ICT's planning and coordination chief, on the disparity. "The ministry's own antivirus installation rate is 92.6 percent, yet the affiliated research institutes stand at just 8.7 percent," Lee said. "Why are institutions conducting research on nationally critical technologies failing to implement even the most basic security measures?"

Kang acknowledged the problem while noting its complexity. "Some equipment at the research institutes is technically difficult to install antivirus software on, so achieving 100 percent coverage is not straightforward," he said. "But I do think there is much room for improvement." He added that the ministry would work to install the software as quickly as possible and would strengthen its oversight to ensure institute heads paid closer attention to the issue.

Lee called on the ministry to conduct a full review of the security status of all servers at the research institutes before the end of this year and to push forward installation schedules as much as possible. "The ministry must also verify that servers where antivirus installation is not feasible have equivalent alternative protections in place, and it must strengthen its supervisory responsibility to ensure that institute heads take direct charge of information security," he said.


bigroot@heraldcorp.com