South Korea Updates Personal Data Security Guidance to Include Passkeys Amid Rising Cyber Threats
South Korea's privacy regulator, the Personal Information Protection Commission (PIPC), has updated its official guidance for protecting personal information. This revision now includes passkeys as a recognized option for passwordless authentication, expanding the number of approved authentication methods from seven to twelve. Other additions to the guidance include QR codes and mobile applications. The updated directives also mandate that public sector systems undergo annual vulnerability assessments and penetration testing, with prompt remediation of any identified weaknesses. Furthermore, the PIPC has issued warnings against storing encryption keys in plaintext within application source code or configuration files and has addressed API security, delayed software updates, and preparations for post-quantum cryptography. These changes are a direct response to growing cybersecurity concerns, as South Korean government systems recorded 1.57 billion suspected attack alerts between January and July of the curr...
