The Bank of Korea has confirmed the implementation of equipment from American cybersecurity firm Palo Alto Networks, following a security review conducted in collaboration with the National Intelligence Service. This move is notably unusual, as it marks the application of foreign security solutions to the internal network improvements of a central bank with stringent security requirements.
The introduction of Palo Alto equipment, which has access to Mythos, is particularly noteworthy given the emerging cyber threats posed by artificial intelligence (AI), such as the recent Mythos Shock.
On Friday, the Bank of Korea announced the establishment of a One PC system, integrating internet and work network personal computers (PCs) into a single device.
This initiative incorporates the National Intelligence Service’s National Network Security Framework (N²SF), which categorizes work information as confidential, sensitive, or public, and applies varying levels of security based on the importance and risk associated with different information and systems. This approach aims to enhance both security and operational efficiency, moving away from the previous method of uniformly applying physical network separation across all operations.
A Bank of Korea official explained that they began a pilot project for the One PC system in August of last year, initially introducing Palo Alto equipment on a trial basis. After confirming its suitability, additional devices were added, bringing the total to eight. Six of these devices serve as gateways to distribute user access, while two handle user authentication and equipment management.
During the selection process, a key consideration was the ability to operate the equipment on-premises, installed on the bank’s internal network without connecting to external clouds in an air-gapped environment. Another crucial requirement was the capability to distribute access across multiple gateways, reducing the risk of a single device failure affecting the entire service.
The system incorporates next-generation firewall capabilities and interoperability with other security solutions. For instance, if antivirus or anomaly detection solutions identify issues with specific users or PCs, they can relay that information to block access or isolate devices.
The Bank of Korea determined Palo Alto’s equipment to be suitable after defining the necessary functions for the target system and testing multiple devices. Subsequently, the bank requested a security review from the National Intelligence Service and proceeded with the implementation following consultations.
National and public institutions in Korea are required to apply for security suitability verification with the National Intelligence Service when introducing verified information security products. The National Intelligence Service assesses whether these products meet national security requirements and identifies any potential security vulnerabilities. Foreign products must also comply with these procedures and domestic security standards.
Notably, the Bank of Korea’s adoption of Palo Alto equipment enables it to respond to the so-called Mythos Shock, triggered by Anthropic’s high-performance AI model, Claude Mythos.
Mythos has garnered global attention due to its exceptional performance, which allows it to identify system vulnerabilities and potentially issue attack commands, effectively making it the world’s most powerful hacker.
This development has created an urgent need for national core facilities, including military, public, financial, and healthcare sectors, to establish AI security systems with capabilities comparable to Mythos to counter automated cyber attacks.
Due to the potential risks associated with Mythos, direct access to the model is currently limited to participants in Project Glasswing, which includes the U.S. government, research institutions, and a select number of authorized companies.
While the Korean government explored participation in Project Glasswing, access has been restricted due to an executive order from the Donald Trump administration. This order, which considers Mythos access rights as directly linked to U.S. cybersecurity interests, requires prior consultation with the U.S. government before exporting top-tier AI models.
Palo Alto, as an initial founding member of Project Glasswing, is well-positioned to actively respond to vulnerabilities identified by Mythos. Although the Bank of Korea’s direct participation in Project Glasswing did not materialize, the introduction of Palo Alto equipment allows for indirect responses to the Mythos Shock.
A Bank of Korea official clarified that Mythos was not a significant factor in the initial selection of Palo Alto equipment, as it had not yet emerged as a major cybersecurity issue at that time. However, they acknowledged that this decision has ultimately provided a foundation for addressing high-performance AI threats like Mythos.
The Bank of Korea continues to maintain existing domestic security products alongside the new foreign solutions. A bank official stated that they remain open to introducing domestic solutions that meet the necessary functional, performance, and architectural integrity requirements.