금융권 내부 해킹 위협 대응을 위한 MITRE ATT&CK 및 BAS 기반의 선제적 검증 프레임워크 연구

As financial institutions undergo rapid digital transformation, the expansion of cloud infrastructure, API-based services, and continuous access by external vendors and developers have fundamentally altered traditional security boundaries. While these changes enhance operational efficiency, they also increase exposure to internal hacking threats that exploit legitimate credentials and system management tools. Such technical internal hacking attacks are particularly difficult to detect using conventional malware-focused or reactive security monitoring approaches. Existing security architectures in the financial sector primarily rely on SIEM for post-event log analysis and FDS for detecting anomalous financial transactions. However, these systems exhibit structural limitations in identifying technical attack stages such as privilege escalation, lateral movement, and persistence when conducted through valid accounts and trusted administrative tools. Major financial incidents, including the NH Bank system outage and the Bangladesh Bank SWIFT heist, demonstrate that internal hacking activities often remain undetected until significant damage has already occurred. This study redefines internal hacking threats in the financial sector as structured technical attacks that can be systematically modeled using the MITRE ATT&CK framework. Based on the observation that such attacks follow repeatable tactics, techniques, and procedures (TTPs), this research argues for a proactive security approach that validates the feasibility of attack paths before real-world exploitation occurs. To address this challenge, the study proposes a proactive internal hacking validation framework utilizing Breach and Attack Simulation (BAS). The proposed framework consists of ATT&CK-based attack scenario modeling, controlled simulation and emulation of attack behaviors, identification of valid attack paths, remediation and policy optimization, and continuous re-validation. Rather than replacing existing SIEM and FDS infrastructures, the framework enhances their effectiveness by feeding empirically validated insights back into security controls. The proposed approach shifts financial security operations from reactive detection to proactive validation, enabling organizations to eliminate structurally viable attack paths in advance. This study contributes to academic research by extending the conceptual scope of insider threats and offers practical implications for improving security governance and compliance in financial institutions.