Korea Zinc Shares OT Security Playbook After 2019 Ransomware Attack

Hwang In-gu, CISO of Korea Zinc, presented the manufacturer's OT security operations case at the CPS (OT/ICS) Secure AX Summit 2026, held at El Tower in Yangjae, Seoul on November 13, according to Daily Secu. About 70 OT security personnel from public institutions and companies attended the event, which was hosted by the K-ICS Council and Daily Secu, organized by NNSP, and sponsored by KTC, Hoseo University and KTNF.

Hwang described how Korea Zinc surveyed control assets by walking its plants over about six months, identifying roughly 500 computers used in control environments. The company installed locks on unused switches and USB ports, introduced one-way communication equipment between the business and production networks, and placed internal firewalls segregating the production network by plant.

Rather than deploying detection equipment at all plants at once, Korea Zinc moved portable equipment process by process and analyzed communications for about three months each, a process that has continued for about two years. The company keeps backup data on external hard disks in a safe, performs regular backups about once every six months, and backs up separately when processes are changed.

More recently, Korea Zinc ran a PoC with NNSP to examine intermittent wireless communication failures in some smelting processes, confirming wireless signals, interference and retransmission status in under 10 hours.

The practices follow a ransomware attack on October 14, 2019, which encrypted hundreds of business PCs and servers as well as a disk backup server and took about a month to recover. An internal firewall kept the attack from spreading to the production control network. After the incident, the company spent six months walking its factories to identify control assets and set up network checks by process and an offline backup system, and in 2020 it hired an OT security staffer whose first task was the asset survey.