• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.1
• /
• pp.123-139
• /
• 2020

In 1987, Computer Security Act was enacted, requiring computer security awareness and practical training for federal workforce. This is the beginning of US development of federal cybersecurity workforce. It has been strengthening the development of federal cybersecurity workforce policy by establishing OPM regulations and OMB circulation in cases where it is difficult to define by law. Through GISRA 2000 and FISMA 2002, which has been improved, it played a central role for development of federal cybersecurity workforce for more than 10 years. Since then, FISMA 2014 has been enacted as a necessity for supplementing technology and policy. In 2014, the importance of cyber security personnel in US federal agencies has been increased even more, by enacting a single law on cybersecurity workforce twice. We will review the current state of Korea's development of cybersecurity workforce by reviewing and analyzing the development and federal cybersecurity workforce in the United States.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.249-267
• /
• 2018

The US cybersecurity workforce policy is being pursued comprehensively and systematically, based on the NICE established initiated in 2010. Security Technologies, one of the eight areas of Advanced Technology Education(ATE) of the National Science Foundation(NSF) included in the STEM. This policy has been comprehensively promoted in conjunction with NICE, and this security technology field is operated with five detailed programs. In this paper, we examine in detail five cybersecurity workforce development programs supported by ATE, and compare them with the current status cultivation of cybersecurity workforce in Korea. After finding out the problems and improvements by comparison with the current situation of cybersecurity workforce development in Korea, we propose several implementations of nation-wide strategies for cultivating new cybersecurity workforce in Korea.

• The Journal of The Korea Institute of Intelligent Transport Systems
• /
• v.22 no.6
• /
• pp.299-312
• /
• 2023

Recently, the electronic control unit (ECU) has been integrating several functions into one beyond simple convenience functions. Accordingly, ECUs have more functions and external interfaces than before, and various cybersecurity problems are arising. The United Nations Economic Commission for Europe (UNECE) World Forum for Harmonization of Vehicle Regulations (WP.29) issued UN Regulation No.155 to establish international standards for vehicle cybersecurity management systems in light of the growing threats to vehicle cybersecurity. According to international standards, vehicle manufacturers are required to establish a Cybersecurity Management System (CSMS) and receive a Vehicle Type Approval (VTA). However, opinions were raised that the implementation period should be adjusted because domestic preparations for this are insufficient. Therefore, in this paper, we propose a web-based solution that maps a checklist to check the status of CSMS in the requirement and various vehicle security companies and solutions to mitigate the identified gap.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.12B
• /
• pp.1489-1497
• /
• 2011

As a way for defending against cyber security threats, there has been a research on cybersecurity information exchange between security management domains in order to raise security performance of the whole network. One of the hottest issues in exchanging cybersecurity information between security management domains is that the requirements of those domains on information sharing are different with each other because each is autonomous domain. This paper proposes a mechanism for effective cybersecurity Information exchange between independent security management domains, which can satisfy their requirements on information sharing through sharing policy and sharing policy control protocol, proposed in this paper. In this paper we have developed an integrated security control system that supports the proposed mechanism. Through the system the performance of the proposed mechanism is measured and evaluated.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2023.11a
• /
• pp.205-207
• /
• 2023

국제선급연합회(International Association of Classification Societies: IACS)에서는 2022년 선박 및 기자재시스템 사이버 복원력 달성을 위한 공통규칙 UR E26, E27을 발행하였으며, 이 규정은 2024년 1월 이후 건조 계약되는 선박에 의무적으로 적용될 예정이다. 현존선의 경우, OT 시스템 네트워크 변경 및 사이버보안 기능을 신규 구현하기가 어렵기 때문에 사이버 위험관리에 한계가 있으나, 본 규정을 통해 신조선 건조 단계에서 설계 보안 (secure by design)을 고려한 선박 사이버 복원력 네트워크 및 기능 구현이 가능하다. 사이버복원력 생태계가 잘 형성되기 위해서는 선주, 조선소, 제조사, 선급 등 주요 이해관계자의 역할이 중요하며 향후 다양한 프로젝트를 통한 사이버복원력 체계 내재화, 재직자 사이버보안 역량 강화, 선박 사이버안전 기술 지속적 연구가 필요하다.

• Review of KIISC
• /
• v.22 no.5
• /
• pp.28-34
• /
• 2012

원자력발전소(원전) 계측제어시스템은 원전을 안전하게 운전하기 위해 계측, 제어 및 보호, 감시 기능을 수행하는 설비로서, 2000년대에 들면서 아날로그 기술에서 컴퓨터와 데이터통신망을 기반으로 하는 디지털 기술로 변하고 있다. 디지털 기술의 도입은 원전에 많은 이점을 부여하였지만 한편으로는 최근 이란 핵시설 및 중국에서 발생한 사이버 사고를 통해 디지털 계측제어시스템이 사이버공격으로부터 취약함이 입증되었다. 이에 따라 사이버보안 기술을 도입하여 원전의 안전성을 확보하기 위한 방안이 요구되고 있다. 하지만 원전 계측제어시스템의 최상위 설계요건으로 요구되는 안전성 확보는 복잡한 기기검증 절차와 긴 시간이 요구되는 인허가 과정 등으로 인해 사이버보안 기술을 적용하는데 많은 어려움이 따른다. 본 논문에서는 원전 계측제어시스템의 특성을 살펴보고 현재 국내외에서 개발 및 적용중인 원전 사이버보안 기술동향을 소개한다.

• Convergence Security Journal
• /
• v.18 no.1
• /
• pp.3-11
• /
• 2018

The emerging field of Science of Security (SoS) is a new paradigm that emerged in the field of security as a research field that applied the scientific approach to cyber security. It is a direction to study the formal model and automation field to secure the security of such a network environment in the present that dynamic change of complex, large scale network environment and a lot of protocol and mechanism environment exists. Therefore, this study analyzes the latest cyber security research trends such as SoS and examines the research trends of advanced countries to examine a new approach to cyber security development direction in Korea. We also analyze the current state of domestic scientific research on the scientific security research methods for various cyber security paradigms and present directions for revitalizing domestic cyber security.

• Review of KIISC
• /
• v.26 no.4
• /
• pp.11-15
• /
• 2016

사이버 위협이 고도화, 지능화함에 따라 사이버 보안사고를 사전에 예방하는 것에는 한계가 있으며, 이제는 보안사고발생을 기정 사실화 하고 이로부터 얼마나 신속하게 사고를 탐지하고, 복구할 수 있는 역량을 구축하는 것이 필요하다. 이러한 현실적 필요성으로 인해 2010년경부터 레질리언스(resilience) 개념을 정보보안에도 접목시키려는 노력이 있었으며, 2016년 4월 템파에서 개최된 SC 27 회의에서도 사이버 레질리언스에 대한 국제표준화 작업이 많은 관심 속에서 논의되었다. 본 논문에서는 사이버 레질리언스에 대한 개념을 정리하고, 사이버 레질리언스 주요 모델과 구현 과제를 기술한다. 마지막으로 사이버 레질리언스 국제표준화 작업에서의 주요 이슈와 활동을 소개한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.2
• /
• pp.363-374
• /
• 2015

Instrumentation and control(I&C) system has been mainly designed and operated based on analog technologies in existing Nuclear Power Plants(NPPs). However, As the development of Information Technology(IT), digital technologies are gradually being adopted in newly built NPPs. I&C System based on digital technologies has many advantages but it is vulnerable to cyber threat. For this reason, cyber threat adversely affects on safety and reliability of I&C system as well as the entire NPPs. Therefore, the software equipped to NPPs should be developed with cyber security attributes from the initiation phase of software development life cycle. Moreover through cyber security assessment, the degree of confidence concerning cyber security should be measured and if managerial, technical and operational work measures are implemented as intended should be reviewed in order to protect the I&C systems and information. Currently the overall cyber security program, including cyber security assessment, is not established on I&C systems. In this paper, we propose cyber security assessment methods in the Software Development Life Cycle by drawing cyber security activities and assessment items based on regulatory guides and standard technologies concerned with NPPs.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2021.11a
• /
• pp.72-73
• /
• 2021

As discussions of the International Maritime Organization for the introduction of the Marine Autonomous Surface Ship (MASS) began in earnest, discussions were conducted to prioritize cybersecurity (Cyber Risk Management) when developing a system to support MASS operation at the 27th ENAV Committee Working Group (WG2). Korea launched a technology development project for autonomous ships in 2020, and has been promoting detailed tasks for cybersecurity technology development since 2021. MASS operation in a digital maritime communication system environment requires network security of various digital equipment that was not considered in the existing maritime communication environment. This study introduces the basic concept of network security equipment to support MASS operation in the detailed task of cybersecurity technology development, and defines the network security equipment interface for MASS ship application in the basic stage.