Shinhan sets 115 billion won, Hana 100.1 billion; KB Kookmin also targets 100 billion-plus

Security staffing, CISO authority vary widely across banks; regulator vows to hold CEOs accountable

ATM machines from major commercial banks clustered in central Seoul. [Herald DB]
ATM machines from major commercial banks clustered in central Seoul. [Herald DB]

South Korea's four major commercial banks — KB Kookmin Bank, Shinhan Bank, Woori Bank and Hana Bank — are set to significantly expand their information security budgets next year amid a string of hacking attacks and data breaches in the financial sector. Shinhan Bank and Hana Bank have already allocated more than 100 billion won ($74.5 million) each for cybersecurity, and KB Kookmin Bank is pursuing a similar level of funding.

According to data submitted to the National Assembly and released Monday by People Power Party lawmaker Lee Yang-su, who chairs the Assembly's intelligence committee, Shinhan Bank has earmarked 115 billion won for information security next year — roughly 2.8 times its budget of 40.6 billion won this year. The bank had trimmed its security budget this year from 45.3 billion won last year by about 5 billion won, but reversed course sharply following a data breach.

Hana Bank set its next-year information security budget at 100.1 billion won, while Woori Bank allocated 76.3 billion won. KB Kookmin Bank said it is currently revising its budget and plans to direct more than 100 billion won toward information security.

Research and development spending on new security technologies and intrusion defense also varied considerably across the four banks. Hana Bank led with 83.7 billion won, followed by Shinhan Bank at 31.6 billion won, Woori Bank at 20 billion won and KB Kookmin Bank at 16.7 billion won. KB Kookmin Bank's figures are subject to change, according to the data.

Actual spending execution rates — not just budget size — have also emerged as a concern. KB Kookmin Bank expects to spend about 52 billion won of its 86.1 billion won information security budget this year, an execution rate of 60.4 percent. The bank said the gap does not reflect a lack of security investment, explaining that budgets are set with some buffer and that actual spending is adjusted based on market prices and contract rates when projects are carried out.

Hana Bank spent 23.9 billion won of its 31.8 billion won first-half budget, an execution rate of 75.3 percent. Woori Bank expects to spend 53.6 billion won of its full-year budget of 61.6 billion won, putting its projected execution rate at 87.0 percent.

Gaps in the size of dedicated security workforces were also evident. At KB Kookmin Bank, only 17 of its 1,673 IT staff this year are security specialists, a ratio of roughly 1 percent. Shinhan Bank's security specialists account for 6 percent of its IT workforce, while Woori Bank's stand at 5.6 percent.

The authority and structural role of chief information security officers also differed across the banks. At all four institutions, the CISO simultaneously holds other positions, including chief privacy officer and credit information management and protection officer. KB Kookmin Bank's CISO holds five concurrent titles in total, including the CISO role for the bank's New York branch.

Over the past three years, the only recorded instance of a CISO withholding approval or exercising veto power in a security-related decision was a single case at Woori Bank last year. Shinhan Bank said that rather than rejecting or deferring proposals with insufficient security requirements, it issues supplementary guidance to address the deficiencies.

The frequency of face-to-face reporting by CISOs to bank presidents also varied. Shinhan Bank's CISO reports through weekly executive meetings, while Hana Bank and Woori Bank hold monthly briefings. KB Kookmin Bank said its CISO delivers regular reports to the board of directors at least four times a year and provides separate in-person briefings when significant issues arise.

Financial regulators are also moving to hold financial institutions' chief executives directly accountable for security. Financial Services Commission Chairman Lee Eok-won said at an industry-wide meeting Thursday that "security is a core management responsibility that the CEO must personally own," adding that "serious negligence or inadequate responses will be met with strict accountability for management, including the CEO, under applicable laws."

Assembly intelligence committee Chairman Lee Yang-su urged banks to go beyond simply increasing their security budgets. "Banks must build real security capabilities — by expanding their pool of security specialists and strengthening the authority and accountability of their CISOs — to put in place a response framework that actually works," he said.


rim@heraldcorp.com