DOI QR코드

DOI QR Code

Design of Comprehensive Security Vulnerability Analysis System through Efficient Inspection Method according to Necessity of Upgrading System Vulnerability

시스템 취약점 개선의 필요성에 따른 효율적인 점검 방법을 통한 종합 보안 취약성 분석 시스템 설계

  • 민소연 (서일대학교 정보통신공학과) ;
  • 정찬석 ((주)엔오비즈) ;
  • 이광형 (서일대학교 소프트웨어공학과) ;
  • 조은숙 (서일대학교 소프트웨어공학과) ;
  • 윤태복 (서일대학교 소프트웨어공학과) ;
  • 유승호 ((주)엔오비즈)
  • Received : 2017.06.02
  • Accepted : 2017.07.07
  • Published : 2017.07.31

Abstract

As the IT environment becomes more sophisticated, various threats and their associated serious risks are increasing. Threats such as DDoS attacks, malware, worms, and APT attacks can be a very serious risk to enterprises and must be efficiently managed in a timely manner. Therefore, the government has designated the important system as the main information communication infrastructure in consideration of the impact on the national security and the economic society according to the 'Information and Communication Infrastructure Protection Act', which, in particular, protects the main information communication infrastructure from cyber infringement. In addition, it conducts management supervision such as analysis and evaluation of vulnerability, establishment of protection measures, implementation of protection measures, and distribution of technology guides. Even now, security consulting is proceeding on the basis of 'Guidance for Evaluation of Technical Vulnerability Analysis of Major IT Infrastructure Facilities'. There are neglected inspection items in the applied items, and the vulnerability of APT attack, malicious code, and risk are present issues that are neglected. In order to eliminate the actual security risk, the security manager has arranged the inspection and ordered the special company. In other words, it is difficult to check against current hacking or vulnerability through current system vulnerability checking method. In this paper, we propose an efficient method for extracting diagnostic data regarding the necessity of upgrading system vulnerability check, a check item that does not reflect recent trends, a technical check case for latest intrusion technique, a related study on security threats and requirements. Based on this, we investigate the security vulnerability management system and vulnerability list of domestic and foreign countries, propose effective security vulnerability management system, and propose further study to improve overseas vulnerability diagnosis items so that they can be related to domestic vulnerability items.

Keywords

Diagnosis Script;Information Communication Infrastructure;Security;Vulnerability Inspection;Vulnerability Management System

Acknowledgement

Supported by : 중소기업청

References

  1. KISA, "IT Security Evaluation and Certification Guide", 2009.
  2. KISA, "Establishment of information technology management system for new technology", 2010.
  3. K. H. Han, I. S. Kim, "A Study on Threat Analysis of PC Security and Countermeasures in Financial Sector", The Journal of The Institute of Internet, Broadcasting and Communication(IIBC), vol. 15, no. 6, pp. 283-290, Dec. 2015. DOI: http://dx.doi.org/10.7236/JIIBC.2015.15.6.283 https://doi.org/10.7236/JIIBC.2015.15.6.283
  4. M. K. Yi, H. J. Hwang, "A Study on Security Weakness and Threats in Personal Health Record Services", The Journal of The Institute of Internet, Broadcasting and Communication (IIBC), vol. 15, no. 6, pp. 163-171, Dec. 2015. DOI: http://dx.doi.org/10.7236/JIIBC.2015.15.6.163 https://doi.org/10.7236/JIIBC.2015.15.6.163
  5. Moon-sung Hwang, Yong-Hee Lee, Jung-Ah Shim, Keun-Heiu Kim, "Study on Countermeasures and Security Vulnerability of Fintech Services", Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, vol. 6, no. 3, pp. 71-79, Mar. 2016. DOI: http://dx.doi.org/10.14257/AJMAHS.2016.03.24 https://doi.org/10.14257/AJMAHS.2016.03.24
  6. Hee-Hoon Cho, Dal-Soo Weon, Jong-Bae Kim, "A Study on the Security Vulnerability of Android", Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, vol. 5, no. 6, pp. 1-8, Mar. 2015. https://doi.org/10.14257/AJMAHS.2015.06.05
  7. S. H. Kim, "(The)critical information and communication infrastructure technical field vulnerability assessment improvements research", 2016.
  8. Security Trends, "Need to upgrade system vulnerability check", 2016.
  9. J. B. Kim, "A Study on the Successful Implementation about Vulnerability Supplmention and Effective Recovery from Damage related with web Application", Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, vol. 6, no. 1, pp. 53-60, Jan. 2016. DOI: http://dx.doi.org/10.14257/AJMAHS.2016.02.22 https://doi.org/10.14257/AJMAHS.2016.02.22
  10. J. T. Kim, "Analyses of Requirement of Security based on Gateway Architecture for Secure Internet of Thing", Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, vol. 6, no. 3, pp. 461-470, Mar. 2016. DOI: http://dx.doi.org/10.14257/AJMAHS.2016.03.02 https://doi.org/10.14257/AJMAHS.2016.03.02
  11. C. H. Cho, J. K. Bae, "An Exploratory Study on the Key Components of Financial Information Technology Compliance Systems: Focusing on the In-depth Interviews with Experts", Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, vol. 7, no. 6, pp. 785-795, Jun. 2017. DOI: http://dx.doi.org/10.14257/ajmahs.2017.06.48 https://doi.org/10.14257/ajmahs.2017.06.48
  12. Ministry of Future Creation and Science, "Vulnerability Analysis and Evaluation Criteria for Information and Communication Infrastructure Facilities", Ministry of Future Creation and Science, 2013-37, 2013.
  13. S. T. Park, et al., "Vulnerability Analysis and Evaluation Management for the Protection of Major IT Infrastructure", Journal of Information Security 19th volume no. 6, 2009.
  14. B. G. Joo,N. W. Min, M. S. Chang, C. K. Ahn, D. H. Yang, Development of Vulnerability Scanner using Search Engine, The Journal of The Institute of Webcasting, Internet Television and Telecommunication vol. 9 no. 1, pp. 19-24, 2009.
  15. H. K. Yang, A Study of Security Weaknesses of QR Codes and Its Countermeasures, The Journal of The Institute of Webcasting, Internet and Telecommunication vol. 12 no. 1, pp. 83-89, 2012. DOI: http://dx.doi.org/10.7236/JIWIT.2012.12.1.83
  16. B. W. Jin, J. O. Park, M. S. Jun, A Study on Authentication Management and Communication Method using AKI Based Verification System in Smart Home Environment, The Journal of The Institute of Internet, Broadcasting and Communication (IIBC), vol. 16, no. 6, pp. 25-31, Dec. 31, 2016. DOI: https://doi.org/10.7236/JIIBC.2016.16.6.25 https://doi.org/10.7236/JIIBC.2016.16.6.25
  17. H. W. Noh, "A Study on the effective management of Critical Information Infrastructure Protection ", Soongsil University Information and Communications University, Master Thesis, 2012.
  18. S. H. Jang, "A Study on Improvement of Evaluation Criteria for Information Security in Information Infrastructure", Dongguk University Graduate School of International Information Studies, Master Thesis, 2015.
  19. H. S. Lee, "Implementation of Shell Script to Improve Security Vulnerabilities of Linux Server", Kyungpook National University Graduate School of Industry, Master Thesis, 2012.
  20. N. K. Baik, Y. H. Lee, Design and caomparision of DDoS Attack and Defence Mechanism Classification system, Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, vol. 6, no. 12, pp. 595-604, Dec. 2016. DOI: http://dx.doi.org/10.14257/AJMAHS.2016.12.59 https://doi.org/10.14257/AJMAHS.2016.12.59
  21. KISA, "Strategies for the improvement of the protections of the major information and communications infrastructures", 2013.