• The Journal of the Korea Contents Association
• /
• v.10 no.5
• /
• pp.314-324
• /
• 2010

As our nation's economy had grown in size and its possession of the cutting-edge science and technology had increased over the years, the damages received from the outflow of our industrial technology has become a serious issue. As of today, the outflow of Korea's industrial technology has reached a serious level, but in reality there were no adequate countermeasures carried out against it. Also, it is not too much to say that the effort to prevent the outflow of the university-developed industrial technology, which is one of the main pillars for the development of the nation's technological prowess, had been carried out in passive and lukewarm manner. Therefore, as a part of the industrial security activity, we have analyzed the overall situation and major cases related to industrial security activities that have been carried out so far, in order to emphasize the importance of those universities. Also, we tried to find appropriate solutions for the universities to invigorate the industrial security activities needed.

• Korean Security Journal
• /
• no.20
• /
• pp.291-311
• /
• 2009

Amid intensified global competition, securing high technologies is becoming a prerequisite towards achieving developed nation status. Korea has made tremendous efforts into developing technologies for decades and it has now obtained a leading position in many fields. As a result, however, Korea has become a major target of industrial espionage and not a few Korean businesses have already suffered from it. In order to effectively counter industrial espionage, this research explores the use of polygraph security screening as an internal control method through literature review, and discusses matters which need to be considered before the introduction of it into Korea, focusing on the accuracy of security screening. Since polygraph security screening generates deterrent effect by increasing certainty and celerity of punishment, it makes a valuable contribution to the control of industrial espionage. However, the most important problem with the use of the polygraph in security screening is errors of the examination. Thus, polygraph security screening should be used as a part of comprehensive security management program to reduce the possibility of errors. In addition, because factors such as countermeasures and examiner's experience are known to influence the accuracy of the examination, the issues surrounding them should also be addressed.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.13 no.5
• /
• pp.2313-2318
• /
• 2012

With the widely applications of tactical radio networks, end-to-end secure speech communication in the heterogeneous network has become a very significant security issue. High-grade end-to-end speech security can be achieved using encryption algorithms at user ends. However, the use of encryption techniques results in a problem that encrypted speech data cannot be directly transmitted over heterogeneous tactical networks. That is, the decryption and re-encryption process must be fulfilled at the gateway between two different networks. In this paper, in order to solve this problem and to achieve optimal end-to-end speech security for heterogeneous tactical environments, we propose a novel mechanism for end-to-end secure speech transmission over ultra high frequency (UHF) and public switched telephone network (PSTN) and evaluate against the performance of conventional mechanism. Our proposed mechanism has advantages of no decryption and re-encryption at the gateway, no processing delay at the gateway, and good inter-operability over UHF and PSTN.

• Convergence Security Journal
• /
• v.10 no.4
• /
• pp.39-48
• /
• 2010

In a complex, secure IT system environment there will be groups of data that be segregated from one another, yet reside on the same system. Users of the system will have varying degrees of access to specific data. The Configuration Management(CM) of the information architecture, the physical architecture, user privileges and application security policies increases the complexity for operations, maintenance and security staff. This pager describes(current work to merge the capabilities of a network CM toll with those of a Computer Aided System Engineering(CASE) tool. The rigour of Systems Engineering(SE) modelling techniques can be used to deal with the complexities of multi-level information security. The SE logical and physical models of the same system are readily tailorable to document the critical components of both the information architecture and physical architecture that needs to be managed. Linking a user-friendly, physical CM tool with the extended capabilities of a CASE tool provide the basis for improved configuration management of secure IT systems.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37 no.2C
• /
• pp.119-131
• /
• 2012

Recently smart phones have been proliferating widely and quickly. Since the number of mobile apps that are being developed and deployed to domestic/international app stores is rising, more apps are being installed and deleted by users without any difficulty. The deployed apps are each attested through distinct verification framework of specific app stores. However, such verification frameworks are insufficient in checking security concerns. Unfortunately, the security verification framework is necessary since the incidents of leaking privacy and confidential information are being increased in lately. The aim of this paper is to provide the security verification framework that assures security and reliability of the e-government mobile apps. In order to verify proposed verification framework, a few apps were selected and inspected through proposed framework and these inspection results are included in this paper.

• Journal of Digital Convergence
• /
• v.14 no.12
• /
• pp.471-476
• /
• 2016

Recently, important information related with smart work such as office and video conference are handled in smart device quite a lot compare with before. Also, execution environment of smart devices is getting developed as open software environment. It brought convenience to download and use any kind of application software. By that, security side of smart devices became vulnerable. This paper will discuss characteristics of smart device security technology based on virtualization that is a mobile device platform with isolated secure execution area based on TEE (Trusted Execution Environment). Also, this paper will suggest an implementation method about safe smart device security platform based on domain separation for application software which can be executed in smart devices. The domain separation based smart device security platform technology in this paper blocks unauthorized access and leakage of sensitive information in device. Also it will be the solution can block transmission and execution of malicious code in various area including variety of IoT devices in internet rather than just smart devices.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.01a
• /
• pp.179-182
• /
• 2018

최근 여기어때, 인터파크 등 전자상거래 기업을 대상으로 발생한 개인정보 해킹사고 사례를 보면, 사람의 취약점을 노리는 지능화지속위협(APT) 공격과 알려진 해킹 기술이 복합적으로 이루어지고 있다. 해킹사고가 발생한 기관은 한국인터넷진흥원(KISA) 정보보호관리체계(ISMS) 의무대상 기관으로써 정보보호관리체계를 유지 관리하고 있었다. 그럼에도 불구하고 대형의 개인정보 유출사고가 발생한 주요 원인은 정보보호관리체계가 적용되지 않았던 정보시스템과 인력을 대상으로 해킹이 이루어졌기 때문이다. 해킹 위협의 변화에 따라 전자상거래 보안 수준도 변화해야 하는데, 개인정보보호 관련 규제 준수도 전자상거래 기업에서는 힘든 상황이다. 고객의 개인정보 유출 사고는 일반인을 매출 기반으로 서비스하고 있는 전자상거래 기업에서는 치명적이다. 안전한 전자상거래 플랫폼 기반에서 고객에게 서비스를 제공하기 위해서는 무엇보다도 중요 자산인 고객의 개인정보보호를 위해 역량을 집중해야 한다. 한정된 예산과 자원으로 안전한 서비스를 제공하기 위해서는 기존에 구축된 정보보호관리체계를 기반으로 IT보안감사체계를 전사적으로 확대하여 지속적으로 모니터링 할 필요가 있다. 이에 본 연구에서는 최신 사이버 보안 위협 동향과 전자상거래 기업 대상으로 발생한 최근 개인정보유출사고 사례를 분석을 통해 시사점을 도출하여 전자상거래 개인정보 보호를 위한 IT보안감사체계를 제시하였다.

• Convergence Security Journal
• /
• v.13 no.4
• /
• pp.53-59
• /
• 2013

As the hacking technology for cyber-terror and financial fraud evolves, the research and development for advanced and standardized information security technology is growing to be more and more important. In this paper, the domestic level of technology and standardization for information security as compared to advanced country is diagnosed, and future policy is presented by analyzing the influence effect for market and technology. The information security is classified into information security-based & user protection, network & system security, and application security & evaluation validation with details of OTP-based validation, smart-phone app security, and mobile electronic finance, etc. The analytic results indicate that domestic level is some poor for advanced country, the technological development and standardization capability for smart-phone app security and mobile electronic finance is needed, and finally the government's supporting policy for the future Internet is urgently needed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.2
• /
• pp.353-371
• /
• 2014

We already have seen many studies and articles about the methodology responding the security risks and threats. But we still have some controversial subjects to be settled. Now, we are living in the era that we should focus on how to use the security systems instead of how to make it. In this point of view, a company need to find out the answer for these questions, which security risks have to be handled in a corporate, which system is better for responding the security threats, and how we can build necessary security architecture in case of developing systems. In this article, we'd like to study on-site scenarios threatening the corporate assets, the limit on dealing with these threats, and how to consolidate the security events and information from enormous assets. Also, we'd like to search for the direction form the actual cases which have shown the desired effect from converging the assets and network informations.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.973-985
• /
• 2021

South Korea has been guaranteed the efficiency and the convenience of administrative work based on long-term experience and well-established ICT infrastructure. Vice versa, South Korea is always exposed to various scale cyber-attacks. It is an important element of national competitiveness to secure cybersecurity resilience and response in the public sector. For this, the well-trained cybersecurity professionals' retention and support for their capacity development through retraining are critical. As the Special Act on Balanced National Development, most public agencies moved to provincial areas, but the provincial areas are not ready for this, thus the workforce can't get enough retaining courses. We study to analyze whether there is a gap in cybersecurity educational opportunities or needs in the public sector depending on regions, institution type, and personal traits. This paper aims to suggest solutions for the cybersecurity education gap in the public sector based on the empirical analysis results.