The government will check security vulnerabilities at private critical information and communications infrastructure facilities in response to a series of cyber incidents. It plans to focus on how systems that could be exposed to hacking attacks, such as servers and webpages connected to the external internet, are being managed.

Government authorities said on Tuesday that the Ministry of Science and ICT will push ahead with security inspections of 111 institutions that operate private critical information and communications infrastructure facilities. The inspections are expected to cover about 172 facilities.

The move follows the president's instruction to inspect security and strengthen response systems for national core information systems after a string of personal information leaks and cyber incidents at financial and public institutions.

Critical information and communications infrastructure facilities are those that could have a serious impact on national security and the economy and society if cyber attacks or system failures occur. They are designated under the Information and Communications Infrastructure Protection Act. In the private sector, they include systems related to the networks and internet data centres of the three major telecom operators such as SK Telecom, KT and LG Uplus.

In this inspection, the government will focus on checking security vulnerabilities and the management status of information systems exposed to the outside. It will examine in particular whether institutions are properly identifying and managing assets such as internet-connected servers and webpages that attackers could use as intrusion paths.

So far, agencies managing critical information and communications infrastructure facilities have conducted annual internal checks for security vulnerabilities and submitted protection measures to the relevant ministries. Based on those submissions, the government operated its security system by drawing up an annual protection plan and managing its implementation status.

This time, in addition to regular checks, it will add inspection items reflecting security risks revealed by recent incidents in the financial sector. The ministry will distribute a related checklist to each institution and plans to verify security management practices focusing on assets exposed to external attacks.

The ministry plans to compile consent forms for inspections, facility status and results of internal checks from the target institutions by the end of this month. It then plans to begin verification work on the inspection results as early as November and complete it within the year.