• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 1994.11a
• /
• pp.277-287
• /
• 1994

많은 정보시스템이 점차적으로 전산망으로 연결되므로서, 보안성에 대한 위협이 더욱 증대되고 있다. 적절한 보안성을 유지하기 위해서는 시스템이 어느 정도 위험한지를 파악하여 이를 관리하는 노력이 필요하다. 이와 같은 노력의 가장 중심이 되는 것은 위험관리의 체계를 세우고 이에 따른 방법론을 개발하는 것이다. 본 논문은 기존의 위험관리 체계를 검토하고 분석하여, 이를 기초로 단순하면서도 실용적인 위험관리의 체계를 제시하고자 한다.

• Journal of the Society of Disaster Information
• /
• v.17 no.2
• /
• pp.375-390
• /
• 2021

Purpose: Most of cybersecurity breaches occur in SMEs. As the existing cybersecurity framework and certification system are mainly focused on financial and large companies, it is difficult for SMEs to utilize it due to lack of cybersecurity budget and manpower. So it is necessary to come up with measures to allow SMEs to voluntarily manage cyber risks. Method: After reviewing Cybersecurity market, cybersecurity items of financial institutions, cybersecurity framework comparison and cybersecurity incidents reported in the media, the criticality of cybersecurity items was analyzed through AHP analysis. And cybersecurity items of non-life insurers were also investigated and made a comparison between them. Result: Cyber risk management methods for SMEs were proposed for 20 major causes of cyber accidents. Conclusion: We hope that the cybersecurity risk assessment measures of SMEs in Korea will help them assess their risks when they sign up for cyber insurance, and that cyber risk assessment also needs to be linked to ERM standardization.

• Information Systems Review
• /
• v.17 no.3
• /
• pp.39-64
• /
• 2015

As information and information technology become more important in competitive corporate environments, the risk of information security breaches has increased accordingly. Although organizations establish security measures to manage information security risks, members of organizations do not comply with them well, and their information security behavior intention is unclear. Therefore, to understand the information security risk management intention of the members of organizations, the present study developed a research model using Protection Motivation Theory, Supervisory Authority Pressure, and Background factors. This study presents empirical research findings based on the analysis of survey data from 201 members of financial institutions. Perceived Severity, Self-efficacy, and Supervisory Authority Pressure had a positive effect on intention; however, Perceived Vulnerability and Response Efficacy did not affect intention. Security Avoidance Habit, which was considered a background factor, had a negative effect on all parameters, and did not have an effect on intention. Security Awareness Training, another background factor, had a positive effect on information security risk management intention and perceived vulnerability, self-efficacy, response efficacy, and supervisory authority pressure, and had no effect on perceived severity. This study used supervisory authority pressure and background factors in the field of information security, and provided a basis to use supervisory authority pressure in future studies on behavior of organizations and members of an organization. In addition, the use of various background factors presented the groundwork for the expansion of protection motivation theory. Furthermore, practitioners can use the study findings as a foundation for organization's security activities, and to improve regulations.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.41 no.6
• /
• pp.13-22
• /
• 2004

This study proposes a risk analysis methodology for information system security management in which the complexity on the procedure that the existing risk analysis methodology is reduced to the least. The proposed risk analysis methodology is composed of 3 phases as follows: beforehand processing phase, counter measure setting phase, post processing phase. The basic risk analysis phase is a basic security management phase in which fixed items are checked when the information security system is not yet established or a means for the minimum security control is necessary for a short period of time. In the detailed risk analysis phase, elements of asset a vulnerability, and threat are analysed, and using a risk degree production table produced from these elements, the risk degree is classified into 13 cases. In regard to the risk, the 13 types of risk degree will execute physical, administrative, and technical measures through ways such as accepting, rejecting, reducing, and transferring. Also, an evaluation on a remaining risk of information system is performed through a penetration test, and security policy set up and post management phase is to be carried out.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.513-517
• /
• 2003

올해 발생한 슬래머웜 등 인터넷웜은 감염스피드와 피해영향으로 인하여, 정보보호의 전략을 급격하게 수정하게 만들었다. 가장 큰 문제는 기존의 정보보호제품이 신종 취약점과 공격에는 무용지물임이 증명되었고, 결국 Practice에 근거한 관리 및 프로세스에 의한 보안이 중요함을 보이고 있다. 또한 그동안 보안관리는 온라인화 되지 않은 자산에 근거한 모델이 많았지만 현재는 온라인화 된 자산에 대한 실시간 보안관리 방법이 매우 중요해지고 있다. 실시간 취약점관리, 실시간 위협관리, 실시간 위험관리 등을 통하여, 실시간 보안관리의 해외동향과 이론적 근거에 바탕을 둔 프레임워크 설계를 보이고자 한다.

• The Journal of Society for e-Business Studies
• /
• v.15 no.4
• /
• pp.143-163
• /
• 2010

The purpose of this study is to investigate the user's perception of security risk and examine its impact on the usage of Knowledge Management Systems(KMS). The findings of this study are three-fold. First, the overall user's perception of security risk is not high. However, there is a considerably big difference in the perception of security risk among users. This finding means that user's perception of a security risk is not based on the actual security effects but one's individual perception. Another finding is that user's perception of a security risk has a negative impact on the usage of KMS through "trust", which is a mediating variable in our study. This finding corresponds with the existing theory that security risk is oneof the critical sources of trust, and trust is a critical factor of user's acceptance of KMS. Finally, the result of this study reveals that activities devoted to security do not decrease the effectiveness and productivity of KMS. Our long-held cognition that security activity hinders the effectiveness and productivity of an information system is not particularly applied to the KMS.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2001.11a
• /
• pp.29-32
• /
• 2001

본 논문에서는 현재 대두되고 있는 IT 보안정책중 위험관리의 한 분야인 위험분석 과정을 살펴보았다. 그 중에서도 위험분석의 핵심 역할을 수행하는 취약점 분석 과정에 대해서 연구하였다. 먼저 보안관리와 위험관리의 일반적인 개념을 설명하였고, 다음은 취약점 분석의 중요성을 설명하면서 효율적인 취약점 분석을 위해 단계별 분석과정을 도식화하였다. 그리고 각 분석 단계마다 간략한 모듈을 만들어 단순하면서도 체계적인 분석 방법을 제시하였다

• Convergence Security Journal
• /
• v.13 no.3
• /
• pp.79-84
• /
• 2013

In this study the improved service innovation model to solve the problems that appear from a vantage point of the providing security services process through the application and appeal process of convergence security technologies proposed. The model was in view of service science to resolves the limitations that facilities management and unmanned security of physical security field through the application of meteorological information on convergence security technologies. The contribution of this research: improved risk management based on convergence security technologies through service innovation management, evaluated the quantitative value of risk management activity using service effects, and development of physical security service providing methodology using meteorological information.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2019.11a
• /
• pp.134-136
• /
• 2019

The International Maritime Organization (IMO) issued 2017 Guidelines on maritime cyber risk management. In accordance with IMO's maritime cyber risk management guidelines, each flag State is required to comply with the Safety Management System (SMS) of the International Safety Management Code (ISM) that the cyber risks should be integrated and managed before the first annual audit following January 1, 2021. In this paper, to identify cyber security management targets and risk factors in the maritime sector and to conduct vulnerability analysis, we catagorized the cyber security sector in management, technical and physical sector in maritime sector based on the industry guidelines and international standards proposed by IMO. In addition, the Risk Matrix was used to conduct a qualitative risk assessment according to risk factors by cyber security sector.

• 한국경영정보학회:학술대회논문집
• /
• 2007.06a
• /
• pp.959-965
• /
• 2007

최근 정보시스템의 개방성과 접근성의 확대는 조직 내 외부로부터 보안위협을 증가시키고 있다. 일반적으로 정보시스템은 패스워드를 이용하여 사용자 인증과 자료의 접근을 제한하고 있으므로 패스워드의 선택은 정보보안에 있어서 매우 중요하다. 적절한 패스워드의 선택은 정보시스템의 오 남용 방지 및 불법적인 사용자의 제한 등의 보안효과를 가져올 것이다. 본 연구의 목적은 정보를 보호하기 위한 적절한 패스워드선택을 위한 사용자의 보안행위의도에 미치는 요인을 분석하는 것이다. 이를 위하여 정보시스템 사용자의 적절한 패스워드의 선택에 영향을 미치는 핵심적인 요인으로 위험분석 방법론을 토대로 한 위험을 활용한다. 또한 위험을 사용자의 보안의식과 패스워드 관리지침을 패스워드 선택의 태도에 영향을 미치는 요인으로 보고, 사용자의 적절한 패스워드의 보안행위의도를 TRA (Theory of Reasoned Action)를 기반으로 모형을 설계하였다. 본 연구를 분석한 결과 정보자산이 위험에 관련성이 없는 반면, 정보자산을 제외한 위협, 취약성, 위험, 사용자의 보안의식, 패스워드 보안상태, 보안행위의도는 요인간에 유의한 영향을 미치는 것으로 분석되었다.