• Proceedings of the Korea Multimedia Society Conference
• /
• 2003.05b
• /
• pp.691-694
• /
• 2003

오늘날 많은 조직들이 자신들의 조직에 대하여 위험 수준 평가를 하고 이를 통하여 조직의 위험을 관리할 수 있는 위험 분석을 실시하고 있다. 이런 위험 분석의 실시하기 전에 조직의 위험 수준을 파악하기 위하여 설문 등의 방법을 통해 위험 수준을 측정한다. WAP 기술을 기반으로 한 설문 시스템은 무선 인터넷 기술로 시간과 장소에 구애받지 않고 설문이 가능하고, 빠른 회수가 가능하다. 본 논문에서는 이 WAP 기술을 바탕으로 근래 많은 가입자를 확보하고 있는 무선 인터넷을 통하여 보안 수준을 측정할 수 있는 설문을 제시한다.

• Convergence Security Journal
• /
• v.20 no.5
• /
• pp.75-80
• /
• 2020

Damage caused by ransomware has continued to increase since last year, but cyber operations are managed without any separate classification of ransomware types in the military's guidelines for carrying out cyber operations. However, unlike other malware, ransomware is a threat that could paralyze all defense operations in one moment, and the military should reevaluate ransomware and take countermeasures. Accordingly, this paper aims to analyze the assets, vulnerabilities, and threats related to defense information service based on information security risk management, and propose alternatives to ensure continuity of defense work from ransomware threats.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.617-636
• /
• 2017

Many businesses have adopted the standard security management structure such as ISO27001 and K-ISMS for strengthening business's security management structure to protect their core information assets and have acquired partial output from such effort. However, many risk factors such as recent advances in Information Technology and evolution of intrusion methods have increased exponentially requiring the businesses to response even more quickly with better accuracy. For such purpose, a study of 'Real Time Security Management Structure for Business' based on security management process optimization, defining a set of security index for managing core security area and calculation of risk indices for precognition of intrusion risk area has been made. Also, a survey on opinions of an expert panel has been conducted. The effectiveness of studied structure was analyzed using AHP method as well. Using this study, security personnels of a company can improve efficiency of the preemptive responsive and quicker measure from the current security management structure.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 1994.11a
• /
• pp.288-302
• /
• 1994

A security risk analysis provides all information system with the capability to investigate and estimate the status of its security, and gives a guideline for establishing a safeguard against any means of security threats. The information system needs tile judicious and accurate why for performing a risk analysis since security policy and risk analysis of tile information system are based on risk analysis, The risk analysis is composed of two methods. mathematical approach and diagramming technique. Mathematical approach cannot yield a precise description of the real world. However, diagramming technique is more pragmatic since it overcomes this limitation. In this paper, we studied tile security risk analysis methods proposed in overseas such as INFOSEC [4], SRAG [5], FIPS65[6], and JRAM[7].

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.8
• /
• pp.1911-1919
• /
• 2009

Currently, the evaluation technology for the security systems of risk analysis level measurement is maintained by only the developed countries including U.S and U.K, and the evaluation technology and its infrastructure are insufficient for the evaluation technology of security threat analysis level measurement in Korea. Therefore this paper presents the development of the security control items and the evaluation tool(ISSPET) for the security level performance. It is expected to evaluate the security management level of the current system and its security environment through analyzing the security management level of security systems using ISSPET.

• Korean Security Journal
• /
• no.34
• /
• pp.89-113
• /
• 2013

Travel by airplane using airport in globalized modern society is familiar to our life but such airport can be a target of terrorists who would threaten our safety. However, aviation terrorism which is represented by 9.11 terror gives horror beyond our imagination to modern people. Since the first airplane hijacking in Peru in 1931 happened, security organization in each nation has taken various prevention measures to block aviation terrorism. The most realistic measures to prevent aviation terrorism would be security check activity to control approach of terrorist that passengers on airplane and cargos are checked to find out dangerous article like explosive etc. But security check activity in Korea shifted to security check activity focused on private security for efficiency of airport operation differently from security check activity in advanced countries where public interests is strengthened according to risk of terror after 9.11 system. That is, since Incheon airport opened in March 2001, security check system focused on the police was changed. Now Incheon international airport Corporation instructs and supervises security check job and private security personnel are in charge of actual security check activity. But this check system has limitation in blocking terror activity by terrorists which is systematized and intelligent as time passes due to deteriorated job satisfaction of private security personnel and confusing supervising system. Accordingly, it is suggested to introduce risk management skill which is one of management strategy of private corporation for security check activity to prevent terror activity. With this skill, risk factors of aviation terror are identified and analyzed regularly, and each process such as setting of priority, activity to reduce risk, and assessment of security is carried out. And it would be necessary to do efforts, for example, to properly change level of security check according to threat of terror such as to place policeman at airport security in case threat of terror is severe. On the other hand, it is necessary to establish national police organization for good communication of security check activity in field and supervising function, which can encourage systematization and specialization of aviation security job.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.871-873
• /
• 2003

정보시스템의 위험을 관리하기 위해서는 위험을 식별 및 측정하는 위험분석이 선행되어야 한다 본 논문에서는 위험수준 평가, 보안대책에 의한 위험감소 및 잔여위험 분석이 가능한 정량적 위험분석 방법을 제안하며, 이를 적용한 위험분석 도구를 설계 및 구현하여 보인다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2005.05a
• /
• pp.1209-1212
• /
• 2005

본 연구는 기업의 사업연속성 확보를 위한 관점에서 정보보호 영역의 통합보안관리 기능을 확장, 제시한다. 기업은 윤리경영을 기초로 사업과 서비스를 통한 수익창출을 목적으로 하며, 기업이 사업의 중단을 가져올 여러 요인을 사전 파악하여 예방, 대응하는 것은 기업의 생존에 직결된다. 기업의 사업연속성에 관련된 요인은 다양하고 복합적으로 관련되어 있어 조기 파악하고 관리하는 것은 어려운 일이다. 그러므로 사업연속성에 영향을 미치는 위험 요소에 대한 기능들이 개별적으로 운영되기 보다, 종합적으로 연계되고 일관적으로 관리되어지는 것이 필요하다. 대부문의 기업이 자사의 사업 및 서비스를 정보화에 의한 정보통신 및 정보처리 환경에서 운영하고 있어, 주요 경영정보 및 고객정보의 유출 및 해킹으로 인한 보안사고는 기업의 사업연속성에 점점 심각한 영향을 미치고 있다. 종합적인 보안관리를 위한 통합보안관리의 기능은 매우 중요하나, 현재 정보보호의 범위안에서 보안관제를 주 기능으로 활용하고 있으며, 구축된 보안관리 기능도 제한적으로 활용되고 있는 상황이다. 그러므로, 사업연속성 확보를 위한 기업의 통합보안관리 기능과 환경에 대한 개선 및 재검토가 요구된다. 이를 위해 사업연속성 확보를 고려한 통합보안관리의 기능항목과 구성을 정의하고 통합보안관리의 추진 방향과 기 구축된 통합보안관리 환경의 개선사항을 제시하여 통합보안관리가 기업의 사업연속성 확보에 실질적인 역할을 하게 함에 있다.

• Management & Information Systems Review
• /
• v.32 no.2
• /
• pp.213-235
• /
• 2013

This study investigates proper solution available for flexibly management pointing out reality a lack of understanding and interest for executing security management while importance of firm security management gets bigger. Accordingly, this study suggests 4 exogenous variables such as organizational commitment, experience of security risks, perceived benefits, partner interdependence as factors of having influence upon development and implementation in security management. It suggests IT volatility as moderating variable, which will intensify between development and implementation. The research model was tested by using Structural Equation Modeling, via Amos 19.0 analysis on a sample collected from 209 firms. As a result, the remaining variables except partner interdependence showed statistically positive influence. The implications of the findings suggest a new theoretical framework of the security management and offers important solutions for the practical application guidelines.

• Review of KIISC
• /
• v.30 no.4
• /
• pp.77-89
• /
• 2020

이 연구는 우리나라 정부의 공공데이터 공개 제도에 따른 공공데이터 품질관리체계를 이해하고, 공공기관이 신뢰성 있는 데이터를 위해 품질 점검을 시행하면서도 효과적인 관리를 하기 위한 방안에 관한 것이다. 공공데이터법과 공공데이터 품질관리체계를 이해하고, 저품질 공공데이터의 오류와 발생원인에 대해 알아본다. 오류 데이터 분석을 통한 보안위협에 따른 위험 분류를 통해 효과적인 대응방안을 도출하는 것을 목표로 한다. 이를 위해 공공데이터를 데이터 품질 점검하여 도메인별 오류데이터를 살펴보고, 오류데이터 발생원인에 대한 분석을 통해 보안위협과 공공데이터를 사용하는 사용자 측면과 기관 측면의 보안 문제를 분류하였다. 분류된 오류 발생원인별 보안문제를 기준으로 데이터 품질관리를 통한 개선방향을 제시하고, 품질관리 오류 개선방향별 데이터보안 정책별 보안기술을 비교 정리하여, 데이터 보안기술을 통한 품질관리 오류 개선 연계 대응방안을 제안하였다.