Fighting AI with AI: Korea to phase out 'network separation' rules for financial firms

Korea’s financial authorities are moving to phase out longstanding rules requiring financial firms to separate their internal networks from the outside internet, aiming to strengthen the industry’s defenses against sophisticated cyberattacks powered by artificial intelligence (AI), officials said Friday.

However, cybersecurity experts warn that easing the rules before adequate safeguards are in place could open new avenues for attack.

Financial Services Commission (FSC) Chairman Lee Eog-weon announced Thursday that the regulator would launch a task force this month to develop a plan by the first quarter of next year to replace the so-called “network separation” rules with an AI-based security framework, guided by the principle of “fighting AI attacks with AI.”

The task force will bring together officials from the FSC, the Ministry of Science and ICT, the National Intelligence Service, the Financial Supervisory Service and the Financial Security Institute, alongside private-sector AI and cybersecurity experts and financial industry executives.

The changes will be phased in rather than applied across the industry all at once, with institutions deemed better equipped to manage cyber risks allowed to move first.

Introduced in 2013 after a major cyberattack paralyzed the computer systems of several banks and broadcasters, the rules require financial institutions to keep their internal networks separate from the internet, limiting hackers’ access to critical systems.

But as hackers increasingly use AI, financial firms say restrictions on access to advanced external technologies, including cloud services and high-performance AI systems, are hampering their ability to detect and counter attacks.

In response to these concerns, authorities granted temporary exemptions in June to allow AI tools to be used for cybersecurity. Initial trials are underway, with selection for a second round due to begin soon.

The exemptions offer limited relief because they are temporary and narrowly defined. Authorities have therefore decided to pursue a phased lifting of the rules on a separate track. The task force will set the procedures and eligibility criteria and design a replacement security framework.

The push for regulatory change comes amid a growing wave of cyber incidents across the financial sector. From Sept. 30, when a data breach at Shinhan Bank was confirmed, through Tues, authorities received reports of 40 security incidents involving 37 companies, including banks, insurers, securities firms and cryptocurrency businesses.

The incidents exposed more than 473,000 records and resulted in the theft of at least 1 billion won ($737 million), the FSC said.

Experts note that the pace of deregulation should depend on each institution’s ability to manage cyber risks and the sensitivity of the data involved, rather than follow a uniform timetable. Removing an already established layer of protection before adequate alternatives are in place could open up vulnerabilities that the existing system has helped contain.

“Network separation has played a role in preventing external intrusions from spreading to critical financial systems. Rather than scrapping it altogether, regulators should consider applying different levels of separation depending on the importance of the systems and data involved,” said Hwang Suk-jin, a professor at Dongguk University's Graduate School of International Affairs and Information Security.

“The more connections institutions establish with external systems, the more opportunities hackers have to break in.”

The professor added that authorities should focus less on setting a deadline for lifting the restrictions and more on evaluating firms’ internal security controls and scrutinizing the systems they connect to external networks.