Hard Drive Removals and VPN Usage Expose Lax Security at Research Institutes

An audit has revealed that security management is lax at some government-funded science and technology research institutes, with researchers removing hard disk drives (HDDs) and leaking research data.

The Board of Audit and Inspection (BAI) released the results of its audit on the security management status of public computer networks today (July 28).

According to the BAI, guidelines for national research and development security dictate that research institutes must establish procedures for bringing laptops and external storage media used in security projects in and out, while the use of unauthorized media is prohibited.

However, the BAI pointed out that HDDs attached to PCs are left to the autonomous management of research institutes without such security measures, raising concerns over security incidents such as technology data leakage caused by unauthorized removal and taking out of HDDs.

In fact, six audited research institutes (Korea Institute of Science and Technology, Korea Research Institute of Bioscience and Biotechnology, Electronics and Telecommunications Research Institute, Korea Atomic Energy Research Institute, Korea Institute of Science and Technology Information, and Korea Aerospace Research Institute) failed to manage HDD usage statuses, resulting in inadequate security controls that made it impossible to verify the quantity and removal status of used HDDs.

An analysis of HDD removals from internal PCs across five of these institutes—excluding the Electronics and Telecommunications Research Institute—between October 2024 and September 2025 confirmed that 690 HDDs had been detached. Notably, among the 39 HDDs used by former employees, the whereabouts of 12 could not be tracked or they were missing from the research institutes.

In one instance, an individual identified as A, who moved from the Korea Aerospace Research Institute to become a university associate professor, used an unauthorized HDD and removed it without deleting 60,956 files containing four security projects, thereby taking out research data.

Consequently, the BAI notified the Ministry of Science and ICT and the Korea AeroSpace Administration to ban the use of unauthorized hard disks, establish entry and exit procedures, and conduct additional investigations and follow-up actions regarding the 12 hard disks presumed to have been taken outside.

Cases raising concerns over data leakage were also detected, such as institute employees installing NAS (Network Attached Storage) servers allowing internet access from external locations like home to store and use work data, or installing virtual private network (VPN) software on internal and external terminals that enables access to the internal network from outside.

An inspection of one employee's NAS servers revealed that 20,000 work files were stored and operated across 7 out of 26 servers, leaving them exposed to hacking with approximately 60,000 login attempts detected from overseas over a period of about two months.

Furthermore, servers operated by research institutes showed low adoption rates for antivirus software, and remained vulnerable as security vulnerability inspections were conducted on only some servers.

The BAI also pointed out that although latest security update advisories are posted on notice boards, whether or not the measures are actually implemented is not tracked, leaving most major servers without security updates.

(Photo provided by the Board of Audit and Inspection, Yonhap News)
※ Please note: This article was translated by AI and may contain errors.