현대제철 통합보고서

Hyundai Steel has established security policies that are implemented and diagnosed for the safe management of corporate security. The principle goal of our security policy is 'the protection of tangible and intangible business information and technical information.' Through our in-house standards management system, we have disclosed our 'Regulations on Security Management', which include rules on entry, everyday security rules, personal information protection, and rules for suppliers/outsourcing companies, in order to guide employees on how to respond immediately in case of emergency. Hyundai Steel diagnoses security policies through the company's security level assessment and an ISO 27001 certification audit is conducted annually. In addition, we use hacking simulations to diagnose our IT systems and infrastructure every year, and set out measures to mitigate the exposed vulnerabilities.

Hyundai Steel organizes a half-yearly security conference for designated security officers from each of the company's departments. The security conference is held for the purpose of training and promotion, aimed at reinforcing employees' basic knowledge of security, providing information on policy changes, requesting cooperation on related tasks, and facilitating communication. The main agendas of the meetings are 'security policy sharing, guidance on phishing trends, sharing security issues, and training on personal information protection.' Upon completing the training session, security officers share the content with members of their respective departments. In 2020, due to COVID-19, the format of the security conference had to be adjusted from 'collective training at the workplace' to 'remote self-directed training', and in the second half of the year, 319 teams(99.7%) out of a total of 320 teams participated in this training. In addition, in 2020, we developed new contents for online security training. This security training was provided to all employees with a completion rate of '99.7%', and will be conducted on an annual basis.

In accordance with the Industrial Technology Drain Prevention Act, Hyundai Steel has strengthened its security management system for the national core technologies²⁾ it possesses. In particular, the company has made efforts to revise its security management rules and regulations, obtain security pledges, conduct security training, and inspect how national core technologies are being managed. Hyundai Steel has established comprehensive information protection measures to raise the level of information protection management across the company. This has helped prevent information leaks concerning our core technologies and assisted in resolving compliance issues.

Hyundai Steel conducts bi-annual training for all employees using mock phishing e-mails, as a measure to raise security awareness. In the second half of 2020, 3,320 out of 16,452 trainees clicked the mock phishing email, recording a 20.2% vulnerability rate. In the future, we will hold regular employee training using realistic scenarios, in order to minimize damage from security lapses such as those triggered by malicious code, and to strengthen employees' awareness of security against such threats.

Hyundai Steel continues to diagnose its security systems and take improvement measures through verification assessments as part of international security standard certification. Assessments for ISO 27001 are held every three years, and in the second half of 2020, our certification was renewed through document reviews in 14 areas of certification standards, and an on-site inspection. In the future, Hyundai Steel will maintain the international security standard framework and strengthen its excellence in security.