• Convergence Security Journal
• /
• v.6 no.4
• /
• pp.133-140
• /
• 2006

For the verification of the security level against a IT product development environment, we should analyze the vulnerability and the various threatening factors which exists in the IT product development environment. Also we need the evaluation criteria and tools for the evaluation and improvement of the level of information security. For that, we need evaluation indices and the standard it will be able to improve the evaluation methodology in the actual IT product development environment which will reach it will be able to apply must be researched. In this study, our aims are the development of verification tools for the security level of IT product development environment.

• Journal of the Korean Society for information Management
• /
• v.25 no.4
• /
• pp.185-204
• /
• 2008

The Internet is now an integral part of the everyday lives of a majority of people. Web users are demanding web sites that offer credible information. This study tired to comprehensively extract the factors that affect the perception web credibility based on preceding researches and develop of indicators for evaluating the web credibility by goodness-fit analysis. I modified more than 100 factors which presented by preceding researches to 28 factors, and allocated these factors into the hierarchical categories like followings; trustworthiness, expertness, safety are categorized as first level factors, trustfulness and reputation are placed to sub-factors of trustworthiness, usefulness, timeliness and competency to sub-factors of expertness, security and reliability to sub-factors of safety as second level factors. Finally this study developed evaluating indicators for web credibility by goodness-of fit analysis.

• Review of KIISC
• /
• v.10 no.1
• /
• pp.51-62
• /
• 2000

본 연구의 목적은 취약성을 보안대책의 결핍으로 정의해서 정보보호지표의 개념을 도출한 후에, 정보자산가치에 따라서 가중치를 부여하는 정보자산가치가중치법에 의해서 정보보호지표를 계량화하는 절차를 제시하는 것이다. 이와 같은 정보보호지표에 근거해서 정보보호를 위한 기본적인 보호 대책(관리적, 기술적, 물리적 대책을 포함하는 기본통제)을 구현하고 특정 응용시스템을 위한 특수한 보호 대책을 구현함으로써, 조직 내외의 위협으로부터 안정적이고 신뢰성 있는 정보서비스를 제공할 수 있다.

• Convergence Security Journal
• /
• v.15 no.3_1
• /
• pp.91-97
• /
• 2015

When we estimate any organization, we can use scientific tool such as organizational effectiveness. It is very difficult to know the level of organizational goal. If you plan how to assess the effectiveness of your organization, It is a complex and difficult problem, because a few social scientist think that there are many point of view of an concept of organizational goals based on the relatively concrete concept of organizational effectiveness. Social scientist Campbell insist that it is impossible to estimate organizational effectiveness accurately. So we should develope the perfect method to measure the organization as a system, the member's self satisfaction, the efficiency of the team. To achieve a good organizational effectiveness, we should study the method of approach about organizational effectiveness. This is theoretical study and show that the concept and method of approach about organizational effectiveness.

• Convergence Security Journal
• /
• v.6 no.3
• /
• pp.135-144
• /
• 2006

Until now, most of the evaluation systems have performed evaluation with an emphasis on in-formation security products. However, evaluating information security level for an enterprise needs analysis of the whole enterprise organization, and a synthetic and systematic evaluation system based on it. In this study we subdivided the information security elements of the whole enterprise such as planning, environment, support, technology, and management; developed indices based on them; finally, made the information security level of the whole enterprise organization possible to be measured. And we tried to grasp the information security level of the whole enterprise organization and develop an evaluation system of information security level for suggesting a more developing direction of information security.

• The Journal of Society for e-Business Studies
• /
• v.16 no.2
• /
• pp.159-169
• /
• 2011

In order for agencies and companies at the IT service industry to check as well as to upgrade the current status of their information security programs, this paper suggests the assessment method for information security levels. The study developed 12 assessment fields and 54 assessment items derived from domestic and foreign cases including SP800-26, SP800-53, ISMS, and ISO27001. It categorized 54 assessment items into 5 levels for determining information security levels. Also, the study presents 7 strategies for performing their efficient evaluations. The proposed method and process in this paper can be useful guidelines for improving the national information security level.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.9
• /
• pp.21-29
• /
• 2020

In this paper, we propose quantitative evaluation method that enable security comparison between Security Container Runtimes. security container runtime technologies have been developed to address security issues such as Container escape caused by containers sharing the host kernel. However, most literature provides only a analysis of the security of container technologies using rough metrics such as the number of available system calls, making it difficult to compare the secureness of container runtimes quantitatively. While the proposed model uses a new method of combining the degree of exposure of host system calls with various external vulnerability metrics. With the proposed technique, we measure and compare the security of runC (Docker default Runtime) and two representative Security Container Runtimes, gVisor, and Kata container.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.11 no.4
• /
• pp.737-744
• /
• 2007

It need estimation model who is efficient and estimate correctly organization's information security level to achieve effectively organization's information security target. Also, estimate class information security level for this and need reformable estimation indicator or standard and estimation methodology of information security systems that application is possible should be studied in our country. Therefore many research centers including ISO are preparing the measuring and evaluating method for network duality. This study will represent an evaluating model for network security based on checklist. In addition, we propose ah measuring and evaluating method for network performance. The purpose of two studies is to present the evaluating procedure and method for measuring security of network on set workwill be identified and a measuring method and procedure will be proposed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.6
• /
• pp.1329-1335
• /
• 2014

The importance of information security is increasing in the public and private organizations. The interruption of the information system might cause massive disorder. To protect information systems effectively, information systems would be categorized and managed in terms of degree of importance. In this study, we suggest a new evaluation method that categorizes information systems based on the three nature of security, confidentiality, integrity and availability. For validation of the method, we use a case study in a public sector. Through the validation of method, the availability of applying the method for categorization information systems to other domains could be suggested.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.6
• /
• pp.143-152
• /
• 2016

Currently many central administrative agencies, municipalities and public and private institutions operate Managed security services to cope with cyber security incidents. These entities exert efforts in operating efficiencies rather than introduction of services as they used to. Accordingly, quite a few policies, directions and guidelines have been established for stable operation of Managed security services. Still, Managed security is operated by individuals, whose competencies influence the quality of Managed security services to a great extent. In this respect, the present article examines Managed security technology and methods and describes evaluation methods and examples relevant to human competencies, so as to seek for some potential courses for further development as well as more efficient approaches to human resource management in terms of institutional Managed security services.