An incident occurred where East Security's ALYac, which is called the national antivirus along with AhnLab's V3, falsely detected a Windows system as ransomware, rendering the PC unusable. Some observe that false detections in security software (SW) are inevitable in the process of dealing with increasingly sophisticated malware and ransomware, and this incident is expected to further increase interest in highly reliable security software.

With global security companies such as Quickheal and Checkmax entering the domestic market, competition is expected to intensify. The government is stepping up efforts to strengthen cybersecurity in the industrial environment by providing support for security solutions for small and medium-sized enterprises.

■ PC crashed due to false detection of pills, no compensation for damages

Users have been affected by an error in the public release of the antivirus program, ALYac, from security company East Security, which falsely detected Windows systems as ransomware.

After East Security updated the ransomware detection function of ALYac around 11:30 AM on the 30th, the Windows system was mistakenly recognized as ransomware, causing the PC to not function properly.

East Security issued an emergency notice informing consumers of the false detection and announcing emergency measures, but the widespread damage to consumers has led to reports of business disruptions at some small and medium-sized businesses using security software as publicly available products. There have been reports of computer formatting or PC shutdowns caused by ransomware alerts during work hours.

At around 1:00 AM on the 31st, East Security distributed a tool for emergency measures to correct the false detection situation, but it is expected that there will be no actual compensation for damages suffered by users of the product released for public release. The company states in its license agreement that “false detections may occur due to technical limitations of antivirus programs,” and that any damages resulting from false detections are the responsibility of the end user and that the company bears no responsibility whatsoever.

■ Business reliability, strong response even to false positives is essential

The ransomware recognition error that caused this false detection can be seen as a technical error and limitation that occurred in the process of responding to increasingly sophisticated and diverse cyber threats.

As security attacks, ranging from hacking targeting personal information databases to ransomware attacks that take users' PCs and data hostage, continue to increase, false positives of malware and ransomware are becoming more common during the advanced detection process to prevent these attacks. However, an industry insider explained that the recent ALYac incident, where false positives of the operating system caused PCs to crash and user damage, is extremely unusual.

According to the "2022 First Half Cyber Threat Report," released on the 29th by cybersecurity company Acronis, more than 50% of breaches reported during the first half of the year involved stolen credentials, enabling phishing and ransomware campaigns. Security threats are lurking across industries.

In the cybersecurity threat environment, solutions that respond to various environments such as malware prevention, endpoint detection and response (EDR), data leak prevention (DLP), email security, remote monitoring and management (RMM), and backup are required, and multi-layer integrated solutions that enable integrated management are emerging as a trend.

Global security vendor Quickheal has cautioned against the use of personal antivirus software within companies. Personal antiviruses were cited as being difficult to centrally manage, lacking official technical support, and lacking the latest security technologies to respond to real-time threats. Even during the ALYac incident, East Security's corporate license product line did not experience any PC crash issues.

Industry insiders predict that consumer interest in highly reliable enterprise antivirus software will grow following the recent pill-related incident. As the technological prowess of domestic security solution companies like AhnLab, East Security, and Secui continues to level the playing field, a single issue could have mixed effects.

In addition, global security companies such as Quickheal, Checkmax, Proofpoint, and Sailpoint have recently entered the domestic market one after another, accelerating competition in the security market.

Quickheal, a global company operating in 100 countries, entered the Korean market last November and introduced corporate vaccines through Seqrite, a cloud-based endpoint integrated vaccine. Furthermore, US cybersecurity companies Exoneers and Proofpoint recently established Korean branches, drawing keen attention from domestic security companies to their future moves.

Ministry of SMEs and Startups to Support Security Software Costs for SMEs

Small and medium-sized enterprises (SMEs) are bound to lack the capacity to respond to emerging security issues, both in terms of cost and human resources. Accordingly, government ministries have rolled up their sleeves and stepped forward to provide support for startups, ventures, and small and medium-sized enterprises that form the foundation of the industrial sector.

The Ministry of SMEs and Startups announced on the 25th that it will be recruiting additional companies in need of the "Non-face-to-face Service Voucher" project, which aims to promote digitalization and foster non-face-to-face service sectors for small and medium-sized enterprises and venture companies in the post-COVID-19 era.

Applications are open until the 14th of this month, and vouchers worth up to 4 million won will be provided to 7,000 companies. Applications for solution support are available in three areas: security solutions, video conferencing, and collaboration tools for remote work.

Application methods and specific requirements can be found on the non-face-to-face service voucher platform ( https://www.k-voucher.kr/ ).