• Review of KIISC
• /
• v.29 no.2
• /
• pp.23-28
• /
• 2019

산업제어시스템은 물리적인 현장장치의 상태를 기반으로 시스템과 시스템 내부의 프로세스들을 제어, 유지하는 CPS(Cyber Physica System)으로 볼 수 있다. 하지만 IT 시스템의 유입과 더불어 IT 시스템이 보유하고 있는 보안위협 또한 상속되었고 그에 따라 IT 시스템에서 사용하는 보안 대응책을 산업제어시스템에도 적용해야 한다. 본 논문에서는 산업제어시스템과 유사한 CPS인 교통신호제어시스템의 표준규격서에 통신보안으로 규격화 되어있는 SSL VPN을 산업제어시스템에 적용할 때 만족하는 보안요구사항을 살펴보고, 더불어 산업제어시스템에서의 보안 적용 시 반드시 고려해야 하는 가용성과 관련한 성능측정 결과를 보이고 결과분석을 수행한다.

• Proceedings of the Korea Society for Industrial Systems Conference
• /
• 2008.10b
• /
• pp.91-95
• /
• 2008

본 연구의 목적은 신규 금융보안서비스(OTP, HSM)의 채택에 있어 개인사용자에게 영향을 미치는 요인을 도출하고자 함에 있다. 연구방법으로는 기술수용모형(TAM)을 기반으로 새롭게 보안에 관한 변수를 추가하여 확장된 기술수용모형을 사용하였다. 현재 등급별 이체한도에 따라 기업의 거래이용수단에 적용되는 제약은 향후 개인사용자에게의 확대될 예정이다. 따라서 본 연구는 개인사용자를 대상으로 하여 실증적인 연구를 실시하였다. 분석 결과, 신규 금융보안서비스의 채택에 있어서 개인사용자는 인지된 편의성과 보안성을 직접적으로 수용의도에 반영하지는 않지만 인지된 유용성을 통해 간접적으로 반영하고 있으며 직접적으로 수용의도에 영향을 미치는 요인으로는 인지된 유용성만이 유일한 것을 밝혀내었다. 따라서 본 논문은 금융보안서비스가 개인에게 확장될 경우 가장 중요한 요인이 인지된 유용성이라는 사실과 인지된 유용성은 보안성보다는 사용자의 용이성에 더 많은 영향을 받음을 확인함으로써 향후 실사용자가 될 대상에게 더 유용하고 용이한 금융보안서비스를 제공해야 함을 시사하는 바이다.

• Korean Security Journal
• /
• no.56
• /
• pp.165-185
• /
• 2018

Because financial industry is closely related to the daily lives of people, internal fraud such as embezzlement by the employees can cause serious damage to the national economy, including credit crunch and contagious bankruptcy, as once demonstrated in the Savings Bank Scandal in 2011. Therefore, the importance of financial industry security is being emphasized and developed into converged security that combines physical, human and cyber security. In this study, to prevent fraud caused by internal employees in Korean financial sector, in-depth semi-structured interviews were conducted with a total of 16 participants including bankers, officials of financial regulators, and security experts, who were in charge of risk management in the industry. The collected data were analyzed at three stratification levels such as individual, organization, and socio-cultural factor. Based on this analysis, policy recommendations were suggested for the development of financial industry security and reducing internal fraud in banking institutions.

• Korea Information Processing Society Review
• /
• v.22 no.5
• /
• pp.36-45
• /
• 2015

금융과 IT의 융합을 의미하는 핀테크(Fintech) 열풍이 전세계적으로 뜨겁게 불고 있다. 핀테크를 통해 신기술들이 금융 산업 전반에 융합되면서 새로운 형태의 금융서비스가 등장하고 기존의 금융 시스템들이 가져왔던 문제점들을 개선하는데 기여할 것으로 보인다. 하지만 핀테크 산업 활성화를 위한 지속적 규제 완화와 이용자 편의성을 위한 각종 절차의 간소화 그리고 채널 서비스 기술간의 융복합이 일어나는 환경에서 제공되는 핀테크 서비스의 안전성에 대해 우려가 있다. 핀테크 시대에 정보보안은 성장의 인프라이며 금융상품을 선택하는 중요한 기준이 될 것이므로 보안리스크의 정량화와 단계별 통제 방안을 수립하고 사용자 인증, 결제정보 보안, API(Application Programming Interface) 보안 등 필요한 보안요소를 사업모델에 맞게 적용함으로써 편리성과 보안성을 함께 확보할 수 있어야 한다. 본 연구에서는 정보보안 관점에서 핀테크의 서비스의 특징과 보안 취약점을 분석하고 관련 위험을 줄이기 위한 대응방안을 모색해 보았다.

• The Journal of Society for e-Business Studies
• /
• v.23 no.4
• /
• pp.87-107
• /
• 2018

In March 2017, the State of New York became the first state to implement regulation specific to cybersecurity for financial institutions. Unlike previous regulations regarding information security, it has set a minimum requirements to establish cybersecurity program based on risk assessment results, protect Nonpublic Information, designate of CISO, and report to regulatory entity. This paper presents a need for a new cybersecurity policy in Korea by examining newly adopted cybersecurity regulation in the United States. Finally, the paper identify policy suggestions based on the United States's approach as they have successfully implemented the program.

• Journal of Korea Society of Industrial Information Systems
• /
• v.26 no.1
• /
• pp.83-95
• /
• 2021

In this study, major research trends at home and abroad were compared and analyzed in order to derive key research fields in the financial security field and to suggest directions. To this end, 689 domestic and 20,736 foreign data were collected from domestic and international academic journal DB, and major research fields related to financial security were extracted through LDA analysis. After that, hot & cold topics were derived through time series linear regression analysis. As a result of the analysis, studies related to government policy issues, personal information, and accredited certification were derived as promising research fields in Korea. In the case of foreign countries, related studies were drawn to develop advanced security systems such as cryptographic protocols and quantum security. Recently, it has become possible to apply various security technologies in Korea through the abolition of public certification. Accordingly, as changes in promising research fields are expected, the results of this study are expected to contribute to the establishment and development of a successful roadmap for domestic financial security.

• Korean Security Journal
• /
• no.53
• /
• pp.37-59
• /
• 2017

This study aims to contribute to the early detection of occupational fraud in the Korean financial industry by analyzing fraud symptoms. Firstly, the definition, cause of occupational fraud, and fraud symptoms were discussed through literature review. Secondly, survey data were collected from the employees of the financial industry such as bank, insurance, and securities companies to conduct statistical analysis. The result of analysis showed that the symptoms of 'excessive stock investment' and 'unsettled life style' were statistically significant predictors of fraud detection experience. Plus, 'tips and complaints' were the most frequent method for detecting occupational fraud in the Korean financial industry. The financial institutions can minimize the loss of occupational fraud by early detection through educating their employees and vendors on these important symptoms of occupational fraud.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.625-628
• /
• 2002

생체인식 정보관리 보안표준인 X9.84는 금융서비스에서 금융산업 서비스를 위하여 생체인식정보에 대한 안전한 운영관리를 목적으로 관리메커니즘 및 보안 고려사항 등을 정의하기 위하여 미국 ANSI에서 개발한 국가표준이다. 본 논문에서는 X.9.84에서 제시하는 적용범위, 준용표준, 관리 및 보안요구사항, Biometric 등록, 보안 고려사항 등을 분석하여 금융서비스, 전자상거래 등의 국내 사용자 인증서비스에 적용가능한 생체인식 보안표준으로 개발하기 위하여 준용사항과 암호학적 메커니즘 사용, 관리 및 보안요구 사항, Biometric 등록, 보안고려사항, 감사기록 형식 등의 국내 고려사항을 적용하여 국내 생체인식 정보관리 및 보안표준(K-X9.84)으로 개발하고자 한다.

• The Journal of Society for e-Business Studies
• /
• v.16 no.4
• /
• pp.53-73
• /
• 2011

Many governments have tried to develop a liability and compliance law that can improve cyber security in a sustainable way. This paper explores whether a liability and compliance law is effective in motivating firms' information security activities. In particular, I empirically investigate the impact of the 2007 Electronic Financial Transaction Act (EFTA), a liability and compliance law in Korea, on the information security activities of financial institutions and services providers. In spite of various criticisms of the effectiveness of EFTA, the empirical findings of this study clearly show that EFTA is having a positive impact on information security activities. From these findings, this article concludes that a liability and compliance law is likely to contribute to a certain degree to the achievement of sustainable development of cyber security.

• Journal of Platform Technology
• /
• v.8 no.1
• /
• pp.10-15
• /
• 2020

Recently, various industrial sectors have introduced cloud service actively in their business because cloud computing technology enables storage·management and analysis·utilization of data easily in anytime, anywhere. Especially in financial sector, the business provocatively adopted the service and creates various innovative cases; furthermore, already in abroad, the sector has been accelerating digitization of analysis in cases of credit risk, financial fraud data, stock trading etc. On the contrary, in the domestic financial industry, not only the cloud service introduction and innovation cases are underperformed, but most of them are focused on the back-office service. Most Korean financial corporations are burdened with the adoption of cloud service due to various conservative regulatory requirements, such as regulations on data storage and management, regulations on privacy, and other tasks such as developing decision models and establishing responsibility standard for security incidents and service failures. In this study, it would be aimed to contribute to promote the introduction of the cloud in the domestic financial sector by drawing up preemptive challenges and inspecting priorities.