Imagine a government that told Big Tech to improve resilience – then punished failures
(2024/10/01)
- Reference: 1727747053
- News link: https://www.theregister.co.uk/2024/10/01/south_korea_naver_kakao_resilience_rules/
- Source link:
South Korea's Ministry of Science and ICT has reportedly told local web giant Naver to improve its disaster recovery capabilities after not taking adequate measures to prevent service failures.
The move [1]reportedly follows a June on-site inspection that revealed Naver's disaster management plan was lacking. The biz had a system in place to log and approve work plans – which it referred to as the Task Tracking System (TTS) – but the Ministry found it susceptible to human error and wanted Naver to incorporate an automated system and designate personnel to approve tasks during specified shifts.
Naver was ordered to fix the system and processes, and report back. The corrective plan includes doing so by the end of 2024.
[2]
The Ministry has sought to improve disaster management protocols for digital platforms that have significant public impact, after South Korean web and messaging giant Kakao experienced a series of outages. It was [3]revealed that the twelve-year-old startup – with tens of millions of users that rely on it daily – did not have a disaster recovery plan.
[4]
Both Naver and Kakao were among the service providers affected by a 2022 datacenter fire that disrupted online services across South Korea.
[5]Blazing South Korean datacenter operator raided by cops, blames its own batteries
[6]Datacenter fire takes out South Korea's top two web giants
[7]Over 40 million Kakao Pay users' data somehow ended up with Alipay
[8]Samsung fined just $8K for exposing chip fab workers to X-ray radiation
In response to that incident, South Korea's government revised its Basic Act on Broadcasting and Communications Development to require platforms with over ten million users to create automated work management control systems and submit to more regulatory oversight of their resilience rigs. The law earned the nickname "Act on Prevention of Recurrence of KakaoTalk Crash."
Kakao also [9]received a visit from the Ministry last week – its third on-site inspection of the year.
The messaging platform had three service outages in May of this year that saw the government issue correction orders. It apparently complied with those orders, but another outage occurred a mere week after it had supposedly sorted itself out. ®
Get our [10]Tech Resources
[1] https://www.yna.co.kr/view/AKR20240927126100017
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zvtz5bZfUXy_PKqz21H0DAAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/12/08/kakao_dr_plan/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zvtz5bZfUXy_PKqz21H0DAAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/10/24/blazing_south_korean_data_centre/
[6] https://www.theregister.com/2022/10/17/sk_cc_naver_kaako_fire/
[7] https://www.theregister.com/2024/08/15/kakao_pay_data_leak/
[8] https://www.theregister.com/2024/09/26/samsung_fined_chip_fab_radiation/
[9] https://m-en.yna.co.kr/view/AEN20240924004900320
[10] https://whitepapers.theregister.com/
The move [1]reportedly follows a June on-site inspection that revealed Naver's disaster management plan was lacking. The biz had a system in place to log and approve work plans – which it referred to as the Task Tracking System (TTS) – but the Ministry found it susceptible to human error and wanted Naver to incorporate an automated system and designate personnel to approve tasks during specified shifts.
Naver was ordered to fix the system and processes, and report back. The corrective plan includes doing so by the end of 2024.
[2]
The Ministry has sought to improve disaster management protocols for digital platforms that have significant public impact, after South Korean web and messaging giant Kakao experienced a series of outages. It was [3]revealed that the twelve-year-old startup – with tens of millions of users that rely on it daily – did not have a disaster recovery plan.
[4]
Both Naver and Kakao were among the service providers affected by a 2022 datacenter fire that disrupted online services across South Korea.
[5]Blazing South Korean datacenter operator raided by cops, blames its own batteries
[6]Datacenter fire takes out South Korea's top two web giants
[7]Over 40 million Kakao Pay users' data somehow ended up with Alipay
[8]Samsung fined just $8K for exposing chip fab workers to X-ray radiation
In response to that incident, South Korea's government revised its Basic Act on Broadcasting and Communications Development to require platforms with over ten million users to create automated work management control systems and submit to more regulatory oversight of their resilience rigs. The law earned the nickname "Act on Prevention of Recurrence of KakaoTalk Crash."
Kakao also [9]received a visit from the Ministry last week – its third on-site inspection of the year.
The messaging platform had three service outages in May of this year that saw the government issue correction orders. It apparently complied with those orders, but another outage occurred a mere week after it had supposedly sorted itself out. ®
Get our [10]Tech Resources
[1] https://www.yna.co.kr/view/AKR20240927126100017
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zvtz5bZfUXy_PKqz21H0DAAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/12/08/kakao_dr_plan/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zvtz5bZfUXy_PKqz21H0DAAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/10/24/blazing_south_korean_data_centre/
[6] https://www.theregister.com/2022/10/17/sk_cc_naver_kaako_fire/
[7] https://www.theregister.com/2024/08/15/kakao_pay_data_leak/
[8] https://www.theregister.com/2024/09/26/samsung_fined_chip_fab_radiation/
[9] https://m-en.yna.co.kr/view/AEN20240924004900320
[10] https://whitepapers.theregister.com/
InfoSec Auditing
When I read about governments doing infosec audits, I always wonder if they are the insurance company tick-box-style audits.
You know:
[ ] Enforces-complex-passwords and minimum password length
[ ] Admins must have "peon-level" account to do ordinary biz on, not just root/Administrator-level accounts
(Etc.)
... but can still pass the audit when passwords are sticky-note attached to monitors, bottoms of keyboards, etc.