Financial Authorities Allow Remote Home Access for Financial Firms' 'Important Terminals'

[Asia Economy Reporter Kim Hyo-jin] Amid active implementation of remote work by companies due to concerns over the spread of the novel coronavirus infection (COVID-19), financial authorities have expressed the opinion that remote access to 'important terminals (PCs)' of financial company employees is conditionally possible.

This is based on the judgment that it is difficult to restrict remote work measures depending on the job category or nature of the tasks.

According to financial authorities on the 20th, the Financial Supervisory Service (FSS) responded on the 17th with a non-action opinion letter regarding a query from Citibank Korea about whether important terminals are included in the scope of remote access allowed for COVID-19 related remote work.

A non-action opinion letter is a system where, before a financial company takes specific business or management measures or actions, the financial authorities determine whether such measures or actions violate financial supervisory regulations, thereby eliminating legal uncertainty and preventing disadvantages.

Current electronic financial supervisory regulations require each financial company to designate important terminals considering the importance and use of related data, apply strengthened protection measures such as prohibiting external removal, remote access, and groupware access, and do not allow exceptions to network separation application.

This applies to terminals used mainly by employees handling personal information of financial consumers and terminals directly accessing information processing systems for operation, development, and security purposes.

Since February, when the spread of COVID-19 intensified, financial authorities have repeatedly issued non-action opinions to financial companies and financial associations stating that "remote work through remote access can be implemented when there is a loss of personnel at a level that makes it difficult to secure business continuity due to infectious diseases or when such a possibility is significantly high," but this is the first time a judgment has been made regarding remote access to important terminals.

The FSS explained, "Considering the seriousness of COVID-19, it is judged that remote work cannot be restricted depending on the work," and "In unavoidable situations, remote work through remote access to important terminals is possible."

However, to minimize the possibility of information leakage from important terminals, the FSS ordered ▲ prior approval of remote work employees and terminals ▲ application of the same security controls as company terminals ▲ encryption of communication and two-factor authentication during remote access ▲ strengthened monitoring of abnormal signs in remote access and data import/export. It also instructed that remote access should be immediately blocked once the emergency situation ends.

This content was produced with the assistance of AI translation services.