元大金控 元大金控 元大金控

In order to continuously improve the information security governance system, in addition to complying with domestic and international information security laws and regulations, Yuanta FHC, Yuanta Securities, Yuanta Bank, Yuanta Life, Yuanta Funds, and Yuanta Futures have all adopted the ISO 27001:2022 Information Security Management System (ISMS) standard.Subsequently, an independent third-party external organization conducts annual renewals and triennial re-audits. We all have already been certified in 2024, and the certificates are valid and continue to strengthen the monitoring and management of information security with the PDCA (Plan-Do-Check-Act) quality management framework. The validity period of Yuanta FHC’s certificate is from December 2023 to December 2026.
(Note: Yuanta Securities, Yuanta Bank, Yuanta Life, Yuanta Funds, and Yuanta Futures account for 99.97% of the Group’s total capital.)

In line with the Financial Cyber Security Action Plan of Taiwan’s Financial Supervisory Commission (FSC) and to increase the capacity of business continuity management, Yuanta Bank, Yuanta Life, Yuanta Securities, and Yuanta Funds have adopted the international standard for business continuity management (ISO 22301).Subsequently, an independent third-party external organization conducts annual renewals of the certification.All have been certified in 2024, and the certificates will continue to be valid. Based on a risk-oriented approach, we combine business-side and system-side resources to ensure that operational standards can be maintained under any circumstances, to reduce the risk of business interruption, and to make the organization more resilient.

We have upgraded our network and information system protection capabilities and established a multi-layered defense-in-depth framework, including network firewalls, software application firewalls, intrusion detection systems, spam filtering, email APT, Internet behavior management, anti-virus systems, anti-phishing websites and counterfeit APP monitoring mechanisms, endpoint detection and threat response mechanisms (EDR), and network detection and response (NDR) to ensure the security of our information systems.

Yuanta FHC and major subsidiaries regularly perform vulnerability scanning, penetration testing, distributed denial-of-service (DDoS) drills, social engineering drills, and computer system information security evaluations on a regular basis through independent third parties in order to safeguard the stability and security of the information system and the completeness and effectiveness of the existing controls.

With the rapid development of financial technology, information security has become an important risk management issue for organizations. In order to keep abreast of emerging information and security trends, Yuanta FHC and major subsidiaries have joined the Financial Information Security Information Sharing and Analysis Center (F-ISAC) and participated in the Financial Security Operation Center (F-SOC) for cross-domain joint defense and sharing of information security events to effectively enhance the overall information security defense capability. We have also introduced Security Information and Event Management (SIEM) to ensure the effectiveness of information security protection and monitoring.

In order to improve the timeliness and effectiveness of network abnormal behavior detection and alerts, and in line with the FSC’s Financial Cyber Security Action Plan, Yuanta FHC and subsidiaries have commissioned a third-party professional organization to build a security operations center (SOC) monitoring mechanism. Through 7x24 real-time monitoring, we provide pre-emptive threat alerts, real-time threat warnings, and post-threat analysis and recommendations to boost our ability to respond to information security incidents and to achieve the effectiveness of joint defense and coordinated operation of information security monitoring. We have also built information security management monitoring dashboards to instantly keep track of changes in information security risk indicators such as computer viruses, hacking, and data leakage, in order to achieve Yuanta Group’s goal of information security monitoring joint defense.

In order to evaluate our defense-in-depth capability and to comply with the FSC’s Financial Cyber Security Action Plan, Yuanta has organized the Group’s red and blue team attack and defense exercises. We have commissioned a professional third party to conduct a target-oriented information security exercise using hacking techniques without affecting our operations to verify the effectiveness of information security protection, monitoring, and defense, to enhance our employees’ ability to deal with new types of attacks, and to carry out remedial or compensatory measures for the weaknesses identified in the exercise. We also implemented remedial or compensatory measures for weaknesses identified during the exercise. In addition, the feasibility of the recommendations made by the professional third party has been assessed and corresponding measures have been planned, with a view to further strengthening Yuanta FHC’s information security defense and reducing the impact of information security incidents.

In order to evaluate our defense-in-depth capability and to comply with the FSC’s Financial Cyber Security Action Plan, Yuanta has organized the Group’s red and blue team attack and defense exercises. We have commissioned a professional third party to conduct a target-oriented information security exercise using hacking techniques without affecting our operations to verify the effectiveness of information security protection, monitoring, and defense, to enhance our employees’ ability to deal with new types of attacks, and to carry out remedial or compensatory measures for the weaknesses identified in the exercise. We also implemented remedial or compensatory measures for weaknesses identified during the exercise. In addition, the feasibility of the recommendations made by the professional third party has been assessed and corresponding measures have been planned, with a view to further strengthening Yuanta FHC’s information security defense and reducing the impact of information security incidents.

Yuanta FHC and major subsidiaries have completed three (3) hours of information security education and training for general employees and fifteen (15) hours of information security professional training courses for information security specialists in 2024 to strengthen information security capabilities. Furthermore, we also hold email social engineering exercises regularly to raise the information security awareness of all employees.

Internal data shall be classified (e.g., confidential, sensitive, general, and public) and labeled with a rating to ensure protection based on the importance of the data. Confidential and sensitive data are encrypted for storage and transmission (e.g., using TLS/SSL, AES encryption, etc.), and data leakage detection and prevention (DLP) and intrusion detection and prevention systems (IDS/IPS), etc. are established to detect and prevent unauthorized intrusions. Furthermore, based on the attributes and importance of the application system, local and off-site backup operations for the system are established, and backup drills and stress tests are performed regularly, and records are kept, to ensure the effectiveness of the backup procedures.

For access control and identity verification, the principles of least privilege, formal authorization, identifiability, and auditability are adopted. Permissions are assigned based on job duties and role requirements to prevent unauthorized access, and user permissions are reviewed regularly to remove unnecessary permissions.

For network access, the networks used by information services, users, and information systems are separated. For open networks and networks that cross organizational boundaries, users’ ability to connect to the network is restricted based on access control policies and operational application requirements to ensure the security of computer connections and information transmission.