• Review of KIISC
• /
• v.27 no.2
• /
• pp.57-68
• /
• 2017

원자력시설에 대한 사이버보안 위협이 증가됨에 따라 "원자력시설 등의 방호 및 방사능 방재 대책법"에 의거 원자력통제기술원은 사이버보안 이행에 관한 세부 기준을 제시하는 KINAC/RS-015 "원자력시설 등의 컴퓨터 및 정보시스템 보안기술기준"을 마련하고 원자력 사업자로 하여금 사이버보안계획(CSP)을 이행토록 하였다. 따라서 원자력사업자는 사이버공격으로부터 필수디지털자산(CDA)을 보호하기 위해 운영적 관리적 기술적 사이버 보안조치를 적용 및 이행하여야 한다. 본 논문에서는 원자력시설의 최상위 설계요건인 안전성 및 신뢰성 확보를 위해 사이버보안 기술을 적용하는데 많은 어려움이 따르는 기술적 보안조치인 접근통제, 감사 및 책임, 시스템 및 통신의 보호, 식별 및 인증, 시스템 보안강화에 대한 이행방안을 살펴보고자 한다.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.9 no.2
• /
• pp.267-271
• /
• 2014

Nuclear power plant data networks and their associated safety systems are being modernized to include many information technology (IT) networks and applications. Along with the advancement of plant data networks (PDN), instrumentation and control systems are being upgraded with modern digital, microprocessor-based systems. However, nuclear PDN is confronted significant side-effects, which PDN is exposed to prevalent cyber threats typically found in IT environments. Therefore, cyber security vulnerabilities and possibilities of cyber incidents are dramatically increased in nuclear PDN. Consequently, it should be designed fully ensuring the PDN meet all reliability, performance and security requirements in order to overcome the disadvantages raised from adaption of IT technology. In this paper, we provide technical security criteria should be used in design and evaluation of secure PDN. It is believed PDN, which is designed and operated along with these technical security critera, effectively protect against possible outside cyber threats.

• Review of KIISC
• /
• v.1 no.2
• /
• pp.102-112
• /
• 1991

• Journal of radiological science and technology
• /
• v.31 no.4
• /
• pp.347-353
• /
• 2008

This study is to prepare an evaluation standard about personal information protection and security management of a medical institution and to build up a grade standard of evaluation in PACS environment. We built up evaluation index based on 10 detailed items in four big categories (political security, technical security, data management security and physical security) by referring to ISO17799 (BS 7799), HIPPA (Health Insurance and Portability and Accountability Act of 1996) and domestic medical law. We have investigated at the thirty places where medical facility with the extracted security criteria and security evaluation index. Average score of physical security list, one of the big categories, was 18.5/20 (93%) at all medical institutions. Political security score was 18.5/30 (62%), data management security score was 12/20 (60%) and technical security score was 17.5/30 (58%). Therefore, security evaluation score was average 67 in 30 general hospitals, which was 4th level. The results showed that it is necessary to establish evaluation and management standard about personal information protection and security consciousness which are weak in PACS environment.

• Journal of the Korea Convergence Society
• /
• v.6 no.4
• /
• pp.33-40
• /
• 2015

According to arriving convergence environment which can create new value-added converged between industry and ICT technology, It has made economic growth and improve the quality of life. However this convergence environment provide not only advantage but also various security problems resulting from generating converged security threats. For resolving this security problem, we need to approach to security problem in the integrated view not the fragmentary view which cover only technical approach. So This study developed security governance framework which can manage trustful security governance in multidimensional view which cover strategy, managerial/operational and technical view. Therefore this framework can construct trustful security management system which can help top management team to engage in security management directly and organizational member to perform security activities and have responsibility for themselves as suggesting single standard for security management.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.167-172
• /
• 2004

In the process of presenting the additional criteria, ISST, developed to evaluate teachers' capacity of applying information, suggests the criteria without considering teacher's own task. Information Ethics and Security Model is made up of two parts. In one part, it deals with four areas concerning with Information Ethics evaluation to measure the sensibility of Information Ethics of Information Teacher In another part, it is divided Information Security Evaluation into three areas which estimate technical method to secure the information system tying in the environment of information-oriented education.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2011.05a
• /
• pp.467-470
• /
• 2011

최근 7.7 DDoS 사건과 해킹 사건 등으로 국가기관의 정보보호에 관한 중요성이 대두되고 있고, 정보보호 관련 법률이 국회에서 논의되고 있다. 하지만 국회사무처의 정보보호컨설팅 결과 61.2점으로 매우 낮게 평가 되었으며, H/W, S/W분야의 평가에서도 보안성이 취약한 것으로 나타났다. 본 논문은 입법지원 기관인 국회사무처의 인터넷 네트워크와 사용 시스템 등에 대한 관리적, 기술적, 물리적 보안 요소에 대한 현황을 기밀성, 가용성, 무결성 등의 보안기준에 따라 파악하고, 이를 분석한다. 그리고 입법지원 기관이 갖추어야 할 인터넷 네트워크와 사용 시스템 등에 대한 보안 강화를 위한 설계를 연구한다. 본 연구를 통해 입법지원기관의 보안 현황을 분석하고, 사회적인 책임기관으로서 역할과 보안 강화를 위한 자료를 제공하고자 한다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.6
• /
• pp.748-755
• /
• 2019

CCTV Systems have been operated in the variety of serveillance fields of the apartment, transportation, safety, physical security, and so on. And their uses are largely increasing as the CCTV transmission technology has been changed from analog to IP network way. Domestic industry has been working to upgrade from analog CCTV systems to High-Definition(HD) CCTV systems for recent years, which involves a few issues such as mixing with several transmission technologies and duplicated investment in each area because the technological analysis and criteria are specifically not arranged. This paper examines the technical issues of the transmission method between HD analog and HD IP CCTV systems, and induces the criteria of the cost analysis and its weighting factors for HD CCTV reformation. By simulating the cost analysis results of both the HD CCTV systems on apartment environment, this paper proposes the reference for the choice of HD CCTV system reformation.

• Convergence Security Journal
• /
• v.6 no.4
• /
• pp.101-112
• /
• 2006

It will not be able to guarantee the secure operation for the information and communication systems with only technical security. So, ISMS(Information Security Management System) research and standardization are active going on. Korea published "The national cyber security management regulation" and "The national cyber security manual" in 2005. According to the regulation and manual, the government organ and public institution must accomplish the security management assessment to itself for systematic management of an information security. We studied related standards and security management systems of the Australia and the USA, and analyzed the security management evaluation system in "The national cyber security manual" in efficient security management focus. We presented the improvement direction of national security evaluation system through the research. We propose the additional control, selective control set and improvement of the evaluation process for efficient security management. Proposed system possible composition of suitable to each organ and flexible adaptation of rapidly changed information environment.

• Review of KIISC
• /
• v.23 no.4
• /
• pp.7-14
• /
• 2013

영업비밀 관련 또는 특허문제로 소송이 빈번하게 발생하는 요즘 특허 전쟁에 있어서도 해당 정보를 적절하게 보호하고 유지하기 위한 특허정보 관리체계에 있어서의 정보보안은 매우 중요한 요인으로 인식되고 있다. 이러한 상황에서 보안사고가 발생했을 경우, 이에 효과적으로 대응하기 위한 방안들에 대해 기업 전반에 걸쳐 인지될 필요성 또한 부각되고 있으며 이를 가능하게 해주는 방안으로 국제인증 기준이 떠오르고 있다. 각종 정보보호의 중요성에 따른 기업 관리시스템들이 이러한 인증체계를 도입 및 운영하고 있는 추세이며 이를 뒷받침 해주기 위해 특허법을 비롯하여 관련 컴플라이언스를 준수하기 위한 개인정보보호법(안전성 확보조치), 정보통신망 이용촉진 및 정보보호 등에 관한 법률과 같은 정보보호 법률을 기준으로 제시할 수 있다. 사례 기업에서는 이 중 정보보호 국제인증의 대표격인 ISO27001을 바탕으로 현재 특허관련 기업에 필요한 정보보호관리체계를 정립 및 적용하였다. 해당 정보보호 관리체계는 특허관련 업무분장에서 주요하게 다루어지지 않았던 기술적, 관리적, 물리적 보안에 대한 부적합사항을 충족시키고 특허정보보호업무, 감사업무, 검사업무, 전산운영 등 분산된 업무를 일관된 업무로 통합하는 효과적인 관리체계가 될 수 있음을 제시하였다.