Application Access

To control access to important information, application access rights shall be granted differentially according to the user's duties.

• Clearly identify applications used internally (back-office systems, membership management systems, etc.)
• Identify personal information processing systems that handle personal information among the applications
• Establish a classification scheme for user and personal information handler access rights (an access rights classification table, etc.) based on the principle of least privilege
• Implement application functions so that rights to process important information and personal information (input, view, change, delete, download, output, etc.) can be set in a granular manner
• Establish and implement procedures for granting accounts and rights to the identified applications and personal information processing systems
• Retain records related to granting/changing/deleting rights to review the appropriateness of access rights

Sessions with no input for a certain period shall be automatically blocked, and the number of concurrent sessions for the same user shall be limited.

• Determine and apply the session-retention time by considering the characteristics of each application and duty, the magnitude of risk, etc.
• For personal information processing systems, take measures so that system access is automatically blocked when no work is processed for a certain period or longer, in accordance with legal requirements
• Display a warning message and restrict access upon concurrent connection with the same account

Administrator-only applications (administrator web pages, management consoles, etc.) shall be access-controlled so that unauthorized persons cannot access them.

• Block external disclosure of administrator-only applications and take access-restriction measures such as via IP address
• Where external disclosure is unavoidably necessary, apply secure authentication means (OTP, etc.) or secure connection means (VPN, etc.)
• Regularly monitor the access logs and event logs of administrators (users) and personal information handlers
• Upon discovering anomalous signs, carry out detailed investigation, internal reporting, etc. in accordance with predefined procedures

To secure consistency of display-restriction measures for personal information and important information, relevant criteria shall be established/applied.

• Examples of criteria for display-restriction measures of personal information and important information

  1. Name : the middle character of the name (however, for a 2-character name, the last character; for a name of 4 characters or more, the characters excluding the first and last characters)
  2. Resident registration number : the last 7 of the 13 digits
  3. Telephone number, mobile phone : the exchange number
  4. Address : the building number below the road name and the digits of the detailed address
  5. Email address : the remainder of the ID excluding the first 2 characters
  6. Card number : 6 digits from the 7th digit
  7. IP address : bits 17-24 (Ver. 4), bits 113-128 (Ver. 6), etc.

  ※ Application of display-restriction measures for personal information and important information (examples)

  • Name : 현*, 김*하, 김*우, 선**녀
  • Resident registration number : 040101-*******
  • Mobile phone number : 010-****-0913
  • Address : ***, Bugaksan-ro, Seongbuk-gu, Seoul, Building ***, Unit ****
  • Email address : ma******@abcd.com
  • Card number : 4558-12**-****-0116
  • IP address : 123.123.***.123

Applications shall be implemented and operated so that unnecessary exposure (viewing, screen display, printing, downloading, etc.) of personal information and important information can be minimized.

• When outputting personal information and important information from applications (personal information processing systems, etc.) (printing, screen display, downloading, etc.), specify the purpose and minimize the output items according to the purpose
• Output the minimum personal information within the scope of access rights to the personal information processing system, according to the form and purpose of the work, its type, location, and other conditions and environments
• Unless absolutely necessary for work, take measures so that "like" searches are not possible when searching for personal information
• When searching for personal information, use exact-match search (equal search) or search conditions of two or more items so that unnecessary or excessive information is not retrieved
• Take measures so that personal information is not saved in the form of hidden fields in office files (Excel, etc.)
• Take measures so that unnecessary personal information is not output through viewing the web page source, etc.