In recent years, the term ‘quantum computer’ has appeared frequently in the news. Quantum computers are an innovative technology with computational power that differs fundamentally from conventional computers, but they are also causing great concern because they pose a serious threat to the Internet security systems we use today. Post-Quantum Cryptography

Most digital services such as financial services, email, and messaging applications that we use daily are secured using public key encryption technologies such as RSA and ECC. Unlike conventional computers, quantum computers can easily solve the mathematical problems (including prime factorization of large numbers) that these encryption systems rely on by using a special algorithm called Shor’s algorithm. In other words, the possibility of the Internet’s current security foundation collapsing increases once quantum computers become commercially viable. As a result, governments and companies around the world are focusing on a new encryption technology that can replace existing encryption systems to protect information safely even in the post-quantum era—post-quantum cryptography (PQC).

What Is Post-Quantum Cryptography?

Post-quantum cryptography (PQC) literally refers to cryptographic techniques that are resistant to quantum computer attacks. While existing cryptographic systems have structures that can be easily compromised by the computational power of quantum computers, post-quantum cryptography is designed based on mathematical problems that remain difficult to solve even with quantum computers.

Based on different mathematical foundations, post-quantum cryptography typically includes ‘lattice-based cryptography’, ‘code-based cryptography’, ‘multivariate-based cryptography’, and ‘hash-based signatures’. Lattice-based cryptography is particularly popular due to its combination of strong security and efficiency, and many countries and companies are already transitioning to adopt it as their next-generation security technology.

Post-Quantum Cryptography Types

• Lattice-based cryptography: The most prominent approach, recognized for being both secure and efficient
• Code-based cryptography: Established and reliable, based on well-studied mathematical foundations
• Multivariate-based cryptography: Provides security by leveraging the difficulty of solving polynomial equation systems, though it suffers from large key sizes
• Hash-based signatures: Offer strong security, but have the disadvantage of large key and signature sizes

Major Countries’ Adoption of Post-Quantum Cryptography

Post-quantum cryptography is now being actively implemented at the level of national security and industrial strategy, extending beyond lab-level technology. The movements of major countries demonstrate their recognition of its importance.

The United States is leading the response. The U.S. National Institute of Standards and Technology (NIST) has been collaborating with cryptographers around the world on the “Post**-**Quantum Cryptography Standardization Project” since 2016. The U.S. Department of Defense and the NSA have also begun implementing quantum-resistant cryptography in military and national security systems. The European Union is also moving rapidly. The EU Cybersecurity Agency (ENISA) has published guidelines for the adoption of quantum-resistant cryptography and has prepared a roadmap for its implementation across both public and private sectors within member states. Germany and France are developing strategies to strengthen their companies’ competitiveness by allocating significant budgets to research and development of related technologies at the national level.

South Korea is also moving quickly. The National Intelligence Service (NIS) announced “National Standards for Post-Quantum Cryptography” in 2022 and began implementation primarily in the financial sector and public institutions. The Institute for Information & Communications Technology Planning & Evaluation (IITP) is also supporting related workforce development and industry growth, making quantum-resistant cryptography-based services likely to proliferate in Korea in the future. China aims to secure indigenous technology in all areas including quantum computing, quantum communication, and quantum-resistant cryptography through its ‘Quantum Information Science 2030 Plan’. Its intention to implement proprietary quantum-resistant cryptography standards across Internet infrastructure is clear, positioning it as an active participant in global security standard development.

Post-Quantum Cryptography Technology’s Impact Across Industries

Post-quantum cryptography is not just a technology to replace current cryptosystems. It is considered a key technology that will bring about fundamental changes across digital infrastructure. Its impact is expected to be particularly noticeable in several industries.

In the financial industry, banks, securities companies, and insurance companies rely on public key cryptography for customer authentication, wire transfers, and payment systems. The adoption of quantum-resistant cryptography requires substantial system overhauls, and several global banks are currently in testing phases. IoT and 5G/6G network environments are also considered major application areas for quantum-resistant cryptography. Since IoT environments connecting billions of devices are highly vulnerable to quantum attacks, active development is underway for quantum-resistant cryptographic solutions that can operate efficiently with low power consumption.

In the cloud industry, a next-generation security competition has already begun focused on protecting customer data. Global cloud service providers such as Google Cloud and AWS are experimenting with quantum-resistant cryptography-based secure data transfer protocols, and specialized quantum security service packages are likely to emerge. The defense and aerospace industries are no exception. Satellite communications, military networks, and weapon systems are considered priority areas for quantum-resistant cryptography implementation, as they are directly tied to national security. The United States has already announced plans to implement quantum-resistant cryptography in next-generation military satellites.

Widespread quantum computer commercialization could still be years or decades away. However, one fact is clear: the encryption technology we use today is not quantum-secure. This is why governments and major companies are urgently adopting quantum-resistant cryptography. Governments and businesses are developing rapid transition strategies to prepare for the ‘quantum threat’ to existing encryption systems, fundamentally changing the cybersecurity technology paradigm. Post-quantum cryptography will become the new security standard, and companies and countries that proactively adopt it will gain competitive advantages in the digital society overall. Rapid changes are expected across industries including finance, telecommunications, cloud computing, and defense, and end-user impacts are expected to materialize soon. Post-quantum cryptography is now a critical strategic necessity, not an option, when discussing the future of security.

Software supply chain security has gained worldwide attention in recent years. This is a concept that encompasses the entire process by which software products are designed, developed, and distributed, along with all elements involved in that process. Following the SolarWinds hacking incident in late 2020, countries began to focus on software supply chain security.

SolarWinds is an IT solutions and software provider with many Fortune 1000 companies as customers, with many organizations using SolarWinds’ network monitoring solution, Orion. A malicious hacking group was able to distribute malware to more than 18,000 organizations through Orion’s update files, severely damaging U.S. government agencies and global companies, and bringing the importance of software supply chain security to light. In July 2021, while the aftermath of the SolarWinds incident had not yet subsided, another IT management software company, Kaseya, was also targeted in a supply chain attack. In the following year, large-scale software supply chain attacks such as the Log4j vulnerability further highlighted the importance of software supply chain security.

What Is the Software Supply Chain?

As mentioned earlier, the software supply chain refers to the entire lifecycle in which software is planned, designed, developed, tested, distributed, and maintained, along with all of its components. This includes source code, open-source libraries, third-party components, development tools, build systems, distribution platforms, and the human resources that operate them. Software supply chain security, therefore, refers to activities aimed at ensuring security and integrity throughout this process.

The software supply chain can be broadly divided into ‘upstream’ and ‘downstream’ components. Upstream refers to external components and tools used by developers, while downstream refers to customers and users who use the developed software. Supply chain attacks primarily target upstream dependencies, potentially causing cascading damage downstream to customers and users of the developed software.

The Importance of Software Supply Chain Security

✅ Potential for Cascading Damage Attacks on the software supply chain have a ‘one-to-many’ effect, as they can target a single point in the supply chain and affect numerous end users. For example, inserting malicious code into an open-source library used by many applications puts all those applications and their users at risk. As demonstrated in the SolarWinds case, a single supply chain attack can impact thousands of businesses.

✅ Accelerated Digital Transformation Increases Risk The acceleration of digital transformation following COVID-19 has led to a significant increase in software dependency. Nearly all industries operate based on software, and the proliferation of cloud services and Software as a Service (SaaS) models has made it more complex. This increasing complexity makes it increasingly difficult to detect and resolve security vulnerabilities.

✅ Connection to National Security Software supply chain security is directly tied to national security concerns. Attacks on software used in critical sectors such as critical infrastructure, defense, finance, and healthcare can lead to national crises. Governments have begun introducing laws and regulations to strengthen these defenses as state-sponsored hacking groups have targeted software supply chains as an efficient attack vector.

✅ Business Continuity and Reputation For businesses, software supply chain security is directly linked to business continuity. Service interruptions caused by supply chain attacks can lead to declining customer confidence and reputation, as well as direct financial losses. For B2B companies in particular, legal liability and contract violations can arise if their products become the source of a security breach at other companies.

Domestic and International Software Supply Chain Security Landscape

The U.S. government announced comprehensive measures to strengthen software supply chain security through President Biden’s Executive Order 14028 in May 2021. The order strengthened security requirements for software used by the federal government and required developers to provide Software Bills of Materials (SBOM). In 2023, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced its “Secure by Design” initiative, emphasizing how it should be considered from the early stages of software development. Additionally, the Google-led Supply Chain Levels for Software Artifacts (SLSA) framework has gained attention, defining four incremental security levels to ensure the integrity of the software supply chain.

The European Union has also proposed the Cyber Resilience Act of 2022 to strengthen the security requirements for all digital products sold in the EU market. The legislation assigns software developers responsibility for maintaining security throughout their products’ life cycles, and requires prompt responses in the event of security vulnerabilities.

The importance of software supply chain security is also growing in Korea. The Korea Internet & Security Agency (KISA) revised its software development security guidelines in 2023 to include related elements and help companies comply with them. The government established “Software Supply Chain Security Guidelines 1.0” in 2023 to support public institutions and companies in developing their own security management capabilities in response to rapidly evolving cybersecurity risks in software supply chains and the mandatory SBOM submission requirements implemented by major international partners such as the U.S. and Europe.

Software supply chain security is no longer optional, but essential. As the digital economy develops, software has infiltrated every aspect of our society, meaning that protecting the software supply chain is critical for individuals, businesses, and nations alike. The widespread use of open-source software, complex dependencies, and rapid development cycles are making the software supply chain increasingly vulnerable. Software supply chain security cannot be achieved through the efforts of a single organization alone**; it** requires participation from developers, businesses, governments, and end users in maintaining security. Through these collaborative efforts, we can ensure the trust and safety of the digital world.

Recently, the Personal Information Protection Committee has launched a comprehensive preliminary investigation into the collection and use of personal information by major robot vacuum cleaners both domestically and internationally. This initiative stems from growing awareness of the risk of personal information leakage that may occur as rapidly proliferating Internet of Things (IoT) devices become deeply embedded in our daily lives. With smart devices posing potential risks of intruding into our personal lives beyond simply providing convenience, how safe is our privacy?

The Surge in Home IoT Devices and the Gravity of Information Collection

According to recent statistics, the number of home IoT devices worldwide is projected to exceed 75 billion by 2025. Korea is also at the center of this global trend, with the penetration rate of smart home devices increasing by more than 20 percent annually. This explosive growth is simultaneously creating serious privacy concerns. The security of home IoT devices goes beyond being just a technical issue to affecting a person’s fundamental privacy rights. Smart home devices maintain detailed records of our daily lives and collect personal information, sometimes unintentionally. Robot vacuum cleaners, smart air conditioners, and voice recognition speakers have the potential to collect detailed information about users’ lifestyles, conversation content, and even their home layouts. In other words, today’s smart devices are evolving into ‘information collection devices’ that observe and record our entire lives beyond being simple tools.

A robot vacuum cleaner goes beyond just cleaning floors and maps out detailed floor plans of homes, furniture layouts, and users’ lifestyles. Smart air conditioners closely track personal lifestyle habits such as temperature preferences, room usage, and work schedules. Voice recognition speakers collect users’ conversations, voice data, and personal preferences, while smart refrigerators also continuously record and analyze information on eating habits, food purchase patterns, and family members. These devices are constantly monitoring a person’s daily life often without the user’s knowledge.

Cases of Domestic and International Home IoT Device Security Threats

Security vulnerabilities in home IoT devices have caused serious privacy breaches worldwide.

The massive smart camera breach in Germany severely compromised user privacy across 56 countries in 2019. Millions of real-time videos and pieces of personal information were left unprotected and exposed on the Internet, allowing hackers easy access. The 2020 smart speaker eavesdropping scandal in the United States revealed that company employees were listening to private conversations without user consent. Thousands of private conversations were recorded and analyzed annually, constituting a serious privacy invasion. The massive smart home device privacy breach in China in 2021 resulted in the hacking of approximately 100 million users’ information. The need for national-level cybersecurity responses became more urgent as location and personal identification information were leaked en masse.

Korea is no exception. Similar cases of serious security breaches have occurred in Korea. In 2022, a smart home appliance mobile application exposed a security system that was vulnerable to hacking due to insufficient data encryption. This created potential risks of privacy law violations. In 2023, personal private images were leaked without authorization through a home CCTV hacking incident, with secondary damage occurring through online platforms. This incident clearly demonstrated how vulnerable the security infrastructure of home IoT devices currently is.

Creating a Safe IoT Environment: Manufacturers’ Security Responsibilities and Consumers’ Smart Choices

It should be noted that the primary responsibility for IoT device security lies with manufacturers, not individual users. It is practically impossible for average consumers to understand and implement complex security protocols. Therefore, manufacturers must prioritize security from the design stage and develop their products using an integrated approach that fundamentally protects user privacy.

From this perspective, data encryption is the most fundamental and important element of home IoT device security. All personal information collected through devices must be rigorously protected through encryption technology and must fundamentally block unauthorized external access. Penta Security’s encryption platform D.AMO (Diarmo) securely protects data through encryption, encryption/decryption key management, access control, auditing, and monitoring to ensure that data contents remain protected even when exposed. Diarmo offers a diverse suite of products to optimize and implement performance and security solutions tailored to customer system architectures.

Additionally, unauthorized access should be effectively prevented by restricting device access and introducing multi-factor authentication systems. This approach fundamentally prevents unauthorized users from accessing personal information. Penta Security’s authentication platform iSIGN provides secure authentication services across various IT environments. iSIGN delivers enhanced authentication capabilities, such as resource access control and user identification by providing multiple authentication methods using Mobile OTP apps, PKI, FIDO, etc., thereby reducing the risk of authentication breaches.

Consumers should prioritize products from security-conscious manufacturers. Security, not just price or functionality, should be a key consideration when making purchasing decisions. These consumer choices provide strong incentives for security-conscious companies to gain competitive advantages in the market.

In the United States, the CyberTrust Mark system helps consumers easily assess security levels. This certification mark serves as a trust indicator that allows consumers to determine at a glance whether a product has met certain security standards when purchasing an IoT device. These marks can only be obtained if devices meet essential security requirements such as data encryption, security updates, and access control, helping consumers choose safer products. Such certification schemes offer manufacturers incentives to strengthen security, while also providing standards to help consumers confidently choose products. Korea also needs to introduce a similar clear security certification system. A system that strengthens manufacturer responsibilities while helping consumers make informed choices would effectively improve the security level of the entire IoT ecosystem.

Home IoT device security is no longer optional, but an essential requirement. Technological advances should make our lives more convenient, but individual privacy and fundamental rights should never be compromised in the process. Only when manufacturers develop secure products with security consciousness, and consumers drive positive market change by choosing products that prioritize security, can we secure digital privacy. This preliminary investigation by the Personal Information Protection Committee is highly significant in this context. Governments, businesses, and individuals must all raise awareness and actively address home IoT device security concerns.

With the rapid development of AI technology, AI data centers are emerging as the core infrastructure for national competitiveness. Data centers are facilities that store, process, and manage critical data and IT systems for companies and organizations, serving as the core infrastructure of the modern digital economy. Numerous servers, network equipment, and storage systems operate 24 hours a day, 365 days a year, supporting the Internet services we use daily and the core operations of companies.

Unlike conventional data centers, AI data centers are specialized infrastructure optimized for training and inference of large-scale AI models, characterized by their integration and operation of high-performance computing resources such as GPUs and AI accelerators on a large scale. With the recent advent of generative AI platforms such as ChatGPT and DeepSeek, AI model training and inference tasks that require large-scale computation have grown exponentially, increasing the importance of AI-specific data centers that can efficiently handle these workloads. By combining AI semiconductors and high-performance computing infrastructure, next-generation data centers are positioned as key drivers of digital innovation. Therefore, countries around the world are developing and implementing various strategies to strengthen their AI data center capabilities.

Cybersecurity Threats Targeting AI Data Centers

AI data centers, which are attracting worldwide attention, face numerous security threats commensurate with their importance.

The biggest security threat is the risk of information leakage during actual AI operations. For example, when inputting a patient’s medical records into a medical AI system or transaction information into a financial AI system, such sensitive information can be compromised. AI-specific attacks, such as model poisoning, are also emerging as new threats. Attackers can inject maliciously manipulated data into the training process, thereby degrading the performance of AI models or causing intentional malfunctions in certain situations. For example, an AI in a self-driving car might misidentify a red traffic light as a green light, or a facial recognition AI might misidentify a particular person as someone else. Unauthorized use of large-scale computing resources is also a serious problem. There are increasing attempts to gain unauthorized access to high-performance computing resources in AI data centers for cryptocurrency mining and other illegal computational operations. This can disrupt the normal operation of the data center and cause enormous energy losses.

These security threats are becoming more intelligent and advanced alongside the development of AI technology. Attackers are using AI technology to bypass security systems and attempt new types of attacks, creating situations that are difficult to address with existing security measures. Given the rapid pace of AI technology development and the evolution of attack techniques, there is an urgent need for a more systematic and proactive response strategy. So, what specific measures should we consider to strengthen the security of AI data centers?

AI Data Center Cybersecurity Response Strategy

First, from a technical perspective, we need to implement security programs specialized for AI operations. We also recommend implementing a security methodology called Zero Trust. Zero Trust is a security approach based on the principle of “never trust, always verify.” While traditional security methods create distinctions between external and internal environments, such as a castle surrounded by walls, assuming that the internal environment is secure, Zero Trust continuously verifies identity even for users already inside the perimeter. Simply put, Zero Trust abandons the assumption that “internal employees are inherently trustworthy,” and requires verification for all access and data requests every time. It’s like having to show ID, provide transaction details, and complete additional authentication every time you withdraw money from a bank.

A Zero Trust environment continuously monitors and verifies all activities that take place inside the AI data center: who accesses what data, which AI model is being used, and what operations are being performed. This effectively prevents internal information leakage and system misuse. All Penta Security products are designed to be Zero Trust Ready. Based on core security technologies (identity management, application security, network security, system security, and data security), Penta Security provides customized security solutions that comply with national and international standards and security regulations. This allows organizations to flexibly select and deploy Penta Security’s security products in the areas they need based on their security budget, resources, and existing infrastructure.

From an institutional perspective, it is necessary to implement a security certification system for AI data centers and develop programs to train specialized security personnel. It is also recommended to establish systems that comply with international security standards and to develop response protocols for security incidents. Additional effective strategies include forming and operating public-private security collaborative bodies, establishing platforms for active participation in international security cooperation networks and information sharing regarding security threats, and conducting regular joint security exercises.

As critical infrastructure for the digital economy, AI data centers are becoming increasingly important. Cybersecurity is particularly essential for the stable operation and reliability of AI data centers. As South Korea is accelerating the establishment of AI data centers based on world-class IT infrastructure, it is urgent to establish appropriate security systems. The government and private sector should cooperate to develop technical and institutional countermeasures and strengthen international cooperation to create a safe and competitive AI data center ecosystem.

The UK government’s recent demand for access to encrypted data from Apple has drawn global attention. This conflict represents more than a dispute between a government and a tech company. It symbolizes the fundamental tension between digital privacy and national security in the modern era. The issue is being closely monitored by both the European Unions and the U.S. government, and major tech companies such as Google and Meta are also watching with great interest, aware of the potential implications for their own data policies. But what exactly prompted the UK government to request access to Apple’s encrypted data?

Balancing Digital Privacy

The Online Safety Bill and the Start of a Global Debate

Through the Online Safety Bill, the UK government is seeking the authority to detect and block illegal content on messaging apps, primarily focusing on child sexual abuse material(CSAM) and terrorism related content. The government’s request includes access to end-to-end(E2E) encrypted messaging services like Apple’s iMessage, bringing it into direct conflict with the fundamental principles of encryption.
The UK government argues that national security and public interest must take precedence. To effectively combat serious crimes occurring in digital spaces, particularly those targeting children or involving terrorism, it insists that law enforcement must be able to access encrypted communications when necessary, following legal procedures. The government emphasizes that this level of access is essential for ensuring public safety in the digital age and insists that tech companies must bear greater responsibility for illegal activities occuring on their platforms, including providing technical cooperation when required.

Balancing Digital Privacy

Apple : “Privacy is a Core Company Value”

In response, Apples has firmly opposed the UK’s demands. The company maintains that protecting user privacy is a core corporate value and that compromising encryption integrity under any circumstances is unacceptable. Apple warns that the creation of backdoors, as requested by the government, poses a serious threat to overall system security. Once such a backdoor exists, it could potentially be exploited by malicious actors, putting all users’ personal information at risk. Apple further argues that privacy and data security are fundamental human rights in modern society, and that ensuring these rights is part of a tech company’s broader social responsibility.

However, Apple has recently made the decision to withdraw certain security features from its UK users. This means that some of the data stored in UK users’ iCloud accounts will no longer be fully encrypted. Instead, only standard encryption will apply, allowing Apple to access the data and share it with law enforcement if presented with a valid warrant. 

How is this issue being viewed by civil society and experts? Privacy advocacy groups have expressed concern that expanding government surveillance powers could infringe on fundamental individual rights and potentially pave the way for broader future surveillance. Security experts approach the issue from a technical perspective, warning that any form of backdoor inherently introduces vulnerabilities. They argue that even backdoors created for specific legal purposes could eventually be discovered and exploited by hackers, endangering the safety of the entire digital ecosystem. Legal scholars are examining the implications of such demands on international and human rights law, sparking discussions about how legal systems around the world should adapt to these new challenges.

The way encrypted data is stored and processed has become one of the most pressing issues of the digital era. It is no longer just a technical matter. It requires complex discussions across social, legal, and ethical dimensions. The clash between the UK and Apple illustrates just how difficult it is to strike a balance between national security and personal privacy. One particularly notable aspect is Apple’s unprecedented decision to pull advanced encryption services from an entire country. This sets a rare precedent in which a major tech company has opted to withdraw services entirely in response to a single nation’s legal demands, and it could significantly influence similar conflicts in the future.

In light of this, governments and corporations around the world must work toward finding a sustainable balance between national security and individual privacy, while ensuring that civil society’s voices are adequately represented. The establishment of international standards and guidelines for handling encrypted data is becoming increasingly urgent—and such frameworks must evolve alongside technological progress. The UK–Apple case is likely to serve as a critical reference point in ongoing discussions around digital privacy and security.

Cybersecurity in the healthcare sector is becoming more crucial than ever. As medical institutions accelerate digital transformation, Electronic Medical Records (EMR) and Picture Archiving and Communication Systems (PACS) have been widely adopted. Consequently, the proportion of sensitive patient information stored and managed digitally has surged. In particular, at the end of 2023, major hospitals in South Korea suffered ransomware attacks(Healthcare Hacking Attacks) that disrupted medical services, significantly highlighting the importance of healthcare cybersecurity.

Healthcare Hacking Attacks

The Importance of Healthcare Security Through Domestic and International Case Studies

In November 2023, the hacking incident at Korea University Medical Center shocked the Korean healthcare industry. A ransomware attack paralyzed the hospital’s information systems, shutting down emergency rooms and severely disrupting outpatient services. As healthcare digitalization progresses, such cybersecurity incidents are occurring more frequently both in Korea and abroad.

In 2022, CommonSprit Healthㅡa large healthcare chain in the U.S. operating over 140 hospitalsㅡsuffered a ransomware attack that crippled its EMR system. The incident delayed emergency surgeries and caused major service disruptions. Recovery costs reached $150 million, and millions of patients’ data were exposed. Even earlier, in 2017, the UK’s National Health Service(NHS) fell victim to the WannaCry ransomware, which halted medical services.

4 Essential Cybersecurity Tips Medical Institutions must Implement Immediately

Medical Institutions must pay close attention to the following key security measures. These are not just recommendations ㅡ they are essential practices in today’s modern healthcare environment.

1. Encrypt All Data ㅡ Always
   Data encryption is non-negotiable. Both stored and in-transit medical data must be protected using strong encryption methods. Even if hackers intercept the data, proper encryption ensures it remains indecipherable. Particularly, sensitive records such as Electronic Medical Records(EMR) and medical imaging data should be encrypted using advanced standards like AES-256. End-to-end(E2E) encryption must be implemented for all data transmissions. In addition, secure management of encryption keys is critical.
2. Secure Medical Devices
   With the growing number of network-connected medical devices, the risk of cyberattacks has significantly increased. Hospitals must ensure that all connected devices—including MRI, CT, ultrasound machines, patient monitoring systems, and syringe pumps—receive regular security patches and updates. Older devices that cannot be easily updated should be isolated on separate secure networks. Periodic security checks for all networked devices are highly recommended.
3. Establish a Robust Backup System
   To defend against ransomware attacks, it is crucial to regularly back up critical medical data and implement a system that allows for rapid recovery. Following the 3-2-1 backup rule is a best practice: keep at least three copies of the data, store them on two different types of media, and keep one copy offline or offsite. Additionally, conducting quarterly backup recovery drills ensures that institutions can respond quickly and effectively in a real crisis.
4. Provide Regular Security Training
   Ongoing security education for healthcare professionals and staff is essential. Training should raise awareness of social engineering attacks and ensure strict compliance with internal security policies. Practical education on topics like identifying phishing emails, managing strong passwords, and handling suspicious links should be included. Quarterly phishing simulations and regular updates on emerging threats can help reinforce a culture of cybersecurity.

Implementing a security system is not a one-time task—it requires continuous monitoring and improvement. As cyber threats continue to evolve, healthcare organizations must regularly assess and update their security frameworks.

Cybersecurity in healthcare is not just about protecting data—it directly impacts patient safety. With cyberattacks on medical institutions on the rise, cybersecurity has become a core component of healthcare delivery. Institutions must continuously strengthen and enhance their security measures to ensure patient data protection and uninterrupted care.

In early 2025, the emergence of a new large language model (LLM), DeepSeek, drew significant attention from the global AI research and security communities. With performance benchmarks suggesting it could rival OpenAI’s GPT-4, DeepSeek’s release had an immediate impact on the international market, prompting a decline in the stock prices of AI-related companies, including Microsoft, a key investor in OpenAI. However, the ensuing disruption was not solely attributed to competition. Subsequent analyses uncovered critical security vulnerabilities within DeepSeek, raising serious concerns about the latent risks embedded in the rapid evolution of LLM technologies.

Shifting Landscapes in AI and Emerging Security Vulnerabilities

The emergence of DeepSeek significantly disrupted the existing dynamics of the AI market. Developed by a Chinese company, this model demonstrated remarkable capabilities in mathematical reasoning, programming, and multilingual processing. In particular, its performance in solving mathematical problems surpassed that of GPT-4, while also exhibiting strong proficiency in coding tasks. This marked the rise of a new contender in the global AI landscape, challenging the long-standing dominance of U.S.-based companies in AI technology leadership. 

However, alongside DeepSeek’s impressive debut, researchers identified serious security vulnerabilities. It was found that the model could potentially leak sensitive personal information and was susceptible to malicious prompt-based attacks. Of particular concern was the discovery that prompt injection techniques could be used to bypass the model’s ethical safeguards, raising significant alarm across the global AI and cybersecurity communities.

Security Vulnerability and Global Regulatory Responses to DeepSeek

Following the disclosure of DeepSeek’s security flaws, major countries swiftly moved to establish regulatory frameworks tailored to their national interests. The United States has shown the most assertive stance, treating the issue as a matter of national security. The U.S. Department of Commerce began actively considering placing DeepSeek on the Entity List, a move that would effectively prohibit American companies from using the model. The National Security Agency(NSA) has taken the lead in drafting comprehensive security guidelines for the use of DeepSeek, which are expected to serve as federal-level regulatory standards. Meanwhile, the European Union classified DeepSeek as a “high-risk AI system” under its AI Act framework, subjecting it to strict regulatory requirements. Organizations seeking to deploy DeepSeek within the EU must now meet detailed obligations regarding data protection, system transparency, and algorithmic accountability. 

In response to the security concerns surrounding DeepSeek, Japan implemented swift regulatory measures under the Economic Security Promotion Act. In January 2024, the Ministry of Economy, Trade and Industry(METI) designated DeepSeek as a “Specified Critical Technology Related to National Security.” As a result, Japanese companies intending to adopt DeepSeek are now required to undergo prior government screening. Furthermore, its use in critical infrastructure sectors has been fundamentally prohibited. Specifically, commercial deployment of DeepSeek has been restricted across 14 key industries, including finance, healthcare, transportation, and energy. 

In South Korea, the Ministry of Science and ICT (MSIT) has established a multi-layered regulatory framework of DeepSeek. In February 2024, MSIT announced the “Emergency Security Measures for DeepSeek”, which outlined specific guidelines for its use in public institutions and major private-sector organizations. Under these measures, the use of DeepSeek is completely prohibited within public agencies. In the private sector, deployment is permitted only after passing a security evaluation conducted by the Korea Internet & Security Agency(KISA). Additionally, the Personal Information Protection Commission(PIPC) introduced a special supervisory framework for DeepSeek’s handling of personal data. Companies utilizing DeepSeek are now required to conduct mandatory privacy impact assessments and submit quarterly reports on data processing activities. 

While countries have enacted stringent regulatory measures in response to DeepSeek, these actions represent only an initial step toward addressing the underlying challenges. The DeepSeek incident has intensified global concerns regarding the security vulnerabilities inherent in large language models(LLM), elevating the issue as a critical agenda item in the ongoing development of AI technologies. The vulnerabilities discovered in DeepSeek are not isolated to a single model; rather, they may reflect structural weaknesses common across most existing LLMs. As such, the systematic analysis of these security threats and the formulation of robust countermeasures are essential for ensuring the safe and responsible advancement of AI systems.

Types of Security Threats in LLMs(Large Language Models) and Countermeasures

While numerous countries have introduced stringent regulatory measures in response to the DeepSeek incident, these actions represent only an initial step toward addressing the underlying challenges. The case has significantly heightened global awareness regarding the security vulnerabilities inherent in Large Language Models (LLMs), positioning this issue as a critical priority in the ongoing advancement of AI technologies. The security flaws revealed by DeepSeek may not be unique to a single model but rather indicative of structural weaknesses common to many existing LLMs. Accordingly, a systematic analysis of these threats and the development of comprehensive countermeasures are essential to ensure the responsible and secure evolution of AI systems. 

To effectively address these security threats, it is essential to establish robust input validation mechanisms. This includes implementing through verification processes for all user inputs, deploying filtering systems capable of detecting and blocking malicious prompts, and utilizing real-time monitoring to identify abnormal input patterns. Conducting regular security audits is also highly recommended, including periodic vulnerability assessments to identify potential risks, validation by security experts, and the timely application of patches to address discovered weaknesses. Strengthening data protection frameworks is equally important by applying data anonymization techniques and encrypting sensitive information. Additionally, developing and enforcing AI ethics guidelines can be beneficial; by setting clear ethical standards and providing regular training, organizations can ensure proper adherence while establishing response procedures for potential ethical violations. 

The DeepSeek incident has served as a critical reminder of the severe risks that may accompany the advancement of AI technologies. While AI is expected to continue evolving rapidly, the associated security threats are also likely to become increasingly sophisticated. Therefore, it is imperative to maintain a careful balance between technological innovation and security enhancement, requiring a systematic and collaborative response from the international community. To achieve this, governments, corporations, and research institutions must work together to establish security standards and ensure continuous monitoring and improvement of AI systems.

Enhancing IoT Security: The Role of the Cyber Trust Mark

The Internet of Things(IoT) has transformed modern life by making everyday tasks more convenient. However, this growing connectivity also creates new entry points for cyber attackers. A vulnerable home camera can expose private moments, while a compromised smart door lock can pose serious physical security risks. 

In 2020, hackers exploited a vulnerability in a popular smart doorbell brand in the U.S., gaining unauthorized access to in-home cameras. This incident caused widespread privacy violations and left victims feeling unsafe in their own homes. Similarly, in 2021, a smart home system in a South Korean Apartment complex was breached, leading to the leak of residents’ personal information. These examples highlight that IoT security breaches are not isolated events ㅡ they can escalate into large-scale cyber threats. As IoT devices increasingly serve as digital gateways, strong security measures are essential.

Why is the Cyber Trust Mark?

To address rising concerns around IoT vulnerabilities, the U.S. government introduced the Cyber Trust Maskㅡa cybersecurity certification designed to help consumers identify trustworthy smart devices. Developed based on standards from the National Institute of Standards and Technology(NIST), this program evaluates devices on criteria such as:

• The ability to change default passwords
• Availability of regular software and firmware updates
• Protection of user data both on the device and in the cloud

Certified products will display a shield-shaped logo, much like the EnergyStar label for energy efficiency, providing a quick and clear signal of cybersecurity compliance. The White House has announced plans to expand adoption of the Cyber Trust Mark, including a forthcoming executive order requiring federal agencies to purchase only certified IoT products starting in 2027. 

While this initiative is a critical step toward securing the IoT ecosystem, it is not a silver bullet. Experts emphasize that cybersecurity requires shared responsibilityㅡconsumers must remain informed and proactive about potential risks, just as manufacturers must commit to secure design and practices.

What Should Consumers Look For in IoT Devices?

When buying smart devices, consumers should evaluate the following security features:

1. Regular Security Updates
   Choose products from manufacturers that offer consistent firmware updates to address emerging vulnerabilities.
2. Customizable, Strong Passwords
   Avoid devices that rely on default credentials like “admin” or “1234”. Look for those that support and encourage secure, user-defined passwords.
3. Data Encryption
   Devices handling personal or sensitive dataㅡsuch as health metrics or home locationㅡshould use strong encryption to ensure date confidentially and integrity.
4. Compliance with Security Standards
   Verify whether the product complies with recognized industry certifications or security frameworks.

By making security a top priority in purchasing decisions, consumers can help protect their homes, families, and personal information.

What Responsibilities Do Manufacturers Have?

To build consumer trust and prevent security breaches, IoT manufacturers must:

• Adopt a “Secure by Design” approach, integrating security considerations from the earliest stages of product development.
• Ensure timely software and firmware updates in response to new threats.
• Apply robust encryption protocols for all data storage and transmission.
• Adhere to international security standards and communicate their compliance transparently to users.

These practices not only enhance product safety but also strengthen long-term brand credibility and user loyalty.

Toward a Safer, Smarter IoT System

IoT technology continues to reshape how we live, but it must not come at the cost of our privacy and security. Certification programs like the Cyber Trust Mark play an important role in creating a more trustworthy IoT landscape, but collaboration is key.

Governments, manufacturers, and users must work together to foster a secure digital environment. As cyber threats continue to rise globally, countries like South Korea must also prioritize security measures for smart devicesㅡnot only in homes but across public institutions and critical infrastructure. Creating a secure IoT future is a shared responsibility. Start by assessing the security of the devices you already own.

Welcoming 2025 with Penta Security

Penta Security kicked off the new year by bringing all employees together to share the company’s vision for 2025. This year’s kickoff was especially meaningful as we also celebrated the 10th anniversary of Cloudbric, Penta Security’s cloud security SaaS platform. Let’s take a look back at this inspiring event that marked the beginning of an exciting year for Penta Security.

Welcoming 2025 with Penta Security

CEO Message: Focus on Purpose, With A.I., and Expanding Business Partnerships

The annual kickoff is an opportunity for all employees to align on company goals and strategic direction for the year ahead. Penta Security CEO, Taekyun Kim outlined three key themes for 2025: “Focus on Purpose,” “With A.I.,” and “Expanding Business Partnerships.”

Regardless of external changes, staying focused on purpose and priorities ensures that we remain on the right path. CEO Kim emphasized the importance of “Focus on Purpose,” highlighting how a clear vision helps us set meaningful goals and build a strong, competitive organization.

To strengthen our competitive edge, we must also prepare for the future. “With A.I.” , reflects the growing influence of artificial intelligence as a dominant megatrend. Having already laid the foundation for AI driven transformation, Penta Security is ready to integrate AI into various aspects of our business this year.

Finally, “Expanding Business Partnerships” will be a key focus area, as we collaborate with both domestic and international partners to tackle pressing cybersecurity challenges.

Navigating an ever-changing landscape and  overcoming challenges presents valuable opportunities for growth. In 2025, Penta Security is committed to reinforcing its position as a global cybersecurity leader.

Celebrating Excellence: Promotions & Awards

Following the business strategy presentation, we moved on to the most anticipated moments  of the kickoff—recognizing outstanding employees. We celebrated this year’s promotions and honored employees with awards such as the Pentastic Award and Best Communication of the Year. Winners received well-deserved recognition, along with personal development grants as a token of appreciation for their contributions. Congratulations once again to all those who were promoted and awarded!

Flying Around the World: Cloudbric Turns 10!

Launched in 2015 as South Korea’s first cloud security SaaS platform, Cloudbric is celebrating its 10th anniversary this year. During the kickoff, we watched a special video featuring reflections from employees who have witnessed Cloudbric’s incredible journey over the past decade.

A great security solution must be both powerful and user-friendly. Cloudbric has achieved this balance, earning recognition in over 150 countries worldwide. To ensure that even more users can enjoy a secure, worry-free digital experience, Penta Security will continue working closely with its teams in Japan and Vietnam to enhance Cloudbric’s capabilities.

This year’s kickoff was particularly significant as we celebrated Cloudbric’s decade-long journey. With cybersecurity threats becoming increasingly sophisticated, Penta Security remains committed to listening to our customers, advancing security solutions, and continuously improving user experience.

As we move forward to 2025, we won’t settle for simply being the No.1 domestic cybersecurity company—we aim to lead the global market. Thank you for your continued support, and here’s to another year of innovation!

Celebrating 10 Years of Cloudbric

Hello! We are Penta Security, a security company based on cryptographic technology.

On January 15, 2025, we celebrated the 10th anniversary of Cloudbric, Penta Security’s cloud security SaaS platform. To mark this milestone, we’ve prepared a brief summary of Cloudbric’s journey from its beginnings to today. Discover how Cloudbric has become a leader in Korea’s SECaaS(Security as a Service) market and gained widespread recognition globally!

Cloudbric 10th anniversary

2015: Global Launch of Cloud-Based Web Security SaaS, Cloudbric WAF+

As the global cloud market expanded, so did the demand for cloud security solutions. In 2015, Penta Security anticipated this trend and introduced Cloudbric WAF+, Korea’s first web security SaaS, to the global market.

Cloudbric WAF+ allows companies to quickly enhance their web security by simply updating DNS settings—no need for additional agents or modules. This all-in-one platform provides essential services like web firewalls, malicious bot mitigation, DDoS protection, threat IP blocking, and SSL/TLS certificates. Its user-friendly dashboard makes it easy for anyone to monitor website security, even without expertise in cybersecurity.

Since its debut, Cloudbric WAF+ has received international recognition. In 2015, it was named a National Cyber Security Awareness Month (NCSAM) Champion, and in 2016, it won the SC Award Europe for “Best SME Security Solution.” By 2019, just four years after its launch, it had over 13,000 users across 53 countries.

Launch of Cloudbric WMS for Simplified Security Management

The COVID-19 pandemic brought a surge in remote work and accelerated cloud adoption across industries. However, managing web firewalls offered by cloud providers like AWS and Microsoft Azure posed challenges for many organizations.

To address this, Penta Security introduced Cloudbric WMS, a platform that simplifies the operation and management of Cloud Service Provider (CSP) WAFs. With Cloudbric WMS, even non-experts can easily configure and monitor security policies tailored to their needs. It ensures smooth operation of CSP WAFs without requiring dedicated security personnel.

Additionally, Penta Security is not only one of the seven Independent Software Vendors (ISV) worldwide, offering managed rules for AWS WAF, but also the only ISV to enable the Web Application and API Protection (WAAP) model by integrating managed rules with AWS WAF. Managed Rules for AWS Web Application Firewall (WAF) are a set of rules written, curated, and managed by AWS Marketplace Sellers, available for subscription on the AWS Marketplace to provide immediate security for web applications or APIs against web threats.

Strengthening Threat Intelligence and Collaboration

As cyberattacks become increasingly sophisticated, sharing and updating threat intelligence is critical. In 2021, Cloudbric joined C-TAS, a threat information-sharing system operated by Korea’s Internet & Security Agency (KISA). This partnership enhanced Threat DB, our threat intelligence platform, and improved our ability to provide advanced security services through machine learning-driven analysis.

In 2022, we further expanded our collaboration by joining the Cyber Threat Alliance (CTA), a nonprofit founded by major global security companies such as McAfee, Palo Alto Networks, Symantec, and Fortinet. Through these alliances, we share threat intelligence and work closely with partners worldwide to combat escalating cyber threats.

2022: Expanding to B2C with Cloudbric VPN

In 2022, Penta Security ventured into the B2C market by launching Cloudbric VPN. This service ensures user privacy and security by hiding locations, activities, and other sensitive data, enabling secure and anonymous online browsing.

Powered by our extensive expertise in security, Cloudbric VPN offers a secure internet experience built on advanced algorithms. Within just a year of its release, the service surpassed 200,000 downloads, and by 2024, it had over 1.3 million users worldwide.

Learn more about Cloudbric VPN

Flying around the world, Cloudbric

From web security SaaS like Cloudbric WAF+ to tools for managing CSP WAF policies, ZTNA solutions, security apps, and threat intelligence platforms, Cloudbric offers comprehensive security services. As a SaaS solution, it provides top-tier security without requiring hardware installation, making it accessible to businesses of all sizes.

As of 2025, Cloudbric serves more than 900 corporate clients across 150 countries. To mark its 10th anniversary, Penta Security is focusing on expanding SaaS security services in the Middle East and Southeast Asia, continuing our mission to lead the global cybersecurity industry.

Looking ahead, Penta Security remains committed to creating a safer future for everyone through the proven reliability and quality of Cloudbric.