• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.2
• /
• pp.109-116
• /
• 2010

We consider an information system where its throughput deteriorates due to security threats and evaluate information security investment portfolios. We assume that organizations adopt information security countermeasures (or portfolios consisted of countermeasures) to lessen the damage resulted from the productivity (or throughput) deterioration. A probability model is used to derive the system throughput and the average number of repairs according to the occurrence rate of security threats. Considering the revenue from throughput, the repair cost, and the investment for the security system, the net present value for each portfolio is derived. Organizations can compare information security investment portfolios and select the optimal portfolio.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.10a
• /
• pp.349-352
• /
• 2017

Since the early 2000s, many information security professionals have sought to measure the effectiveness of information security investments. Such efforts have devised a number of ways to calculate the return in ROSI (Return On Security Investment) including the Gordon & Loeb method for calculating cyber damage. However, due to the characteristics of information security structure, the lack of relate information sharing, and many qualitative factors are included, the damage calculation is inaccurate.. This study reviews related studies, analyzes the Gordon & Loeb method and the Shin-Jin method, which are considered to be the most efficient of the existing methods, and designs improved methods.

• Review of KIISC
• /
• v.28 no.6
• /
• pp.39-44
• /
• 2018

우리나라 방위산업은 고등훈련기, 잠수함 등을 수출할 정도로 발전했으며, 방산 기술력은 선진국 대비 80% 수준으로 평가받고 있다. 이렇게 방위산업이 발전함에 따라 국가 안보상 중요한 정보를 유출하려는 시도도 증가하고 있다. 이러한 상황에서 정부는 방산업체에서 보유한 중요 정보를 보호하기 위한 정책들을 시행하고 있으나 방산업체별 다양한 특성을 고려하지 않은 채 획일화된 정책을 추진함으로써 투자 대비 효과성이 떨어지는 것이 현실이다. 따라서, 본 논문에서는 보안에 대한 투자 대비 효과성을 높이기 위해 방산업체 특성을 고려한 차등화 된 보안정책 개발에 활용할 수 있도록 핵심 평가 요소를 도출하고 요소별 가중치를 산출하는데 목적이 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.6
• /
• pp.1271-1284
• /
• 2014

This paper classifies technical, administrative and physical areas of defects and advices made by an external audit (ISO27001) and internal audit (performed by a security team) in a company which has the management system of information security. With the classified data it finds the correlation between the budget and investment of information security, and analyze the correlation. As a result of the analysis, it has been found that as time goes on there is a consistent correlation between a administrative area and technical area of security. Specially, it has been confirmed that the relation between the scale of the budget which is not executed and the number of the defects and advices made by the audit is in direct proportion. Therefore, in this paper, so as to provide a model that can be used for validating the effectiveness of the protective investment information by statistically calculating the similarity based on the results of correlation analysis. This research is intended to help that a company makes a precise decision when it establishes a policy of information security and systematic methodology of the investment in information security.

• International Commerce and Information Review
• /
• v.15 no.4
• /
• pp.217-240
• /
• 2013

The investment environment in Korea and U.S. dramatically changed since Korea-US FTA. The key reasons for this successful change were liberalization and strengthened protection of investment along with trade liberalization which also brought investment market expansion. As the result of trade-diversion effect, investments between two countries have been enormously increased. Through a FTA with the big economy like US, Korea's FTA network has been largely expanded. Korea further needs to utilize this outcome when competing with other countries in investment markets.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.3
• /
• pp.821-835
• /
• 2016

This study investigates the domestic and international research trends to analyze the economic effects of various information security certification systems. Results of the study can suggest future research topics for researchers, and help make rational decision-making on introducing information security management systems for practitioners.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.07a
• /
• pp.173-174
• /
• 2018

EU의 GDPR(General Data Protection Regulation) 발효로 인해 유럽국가의 개인 정보 데이터를 활용하는 다국적 기업들이 규정에 맞는 데이터 보호정책을 수립하고 보안 투자를 강화하고 있다. 그러나 대다수의 기업들은 해커 등에 의한 사이버 보안을 위해서는 천문학적인 투자를 하고 있지만 기업 내 많은 직원들에 의한 실수나 고의에 의한 개인 정보 유출 방지에 대해서는 대처를 하고 있지 않다. 본 논문에서는 디지털 포렌식 기반의 앤드 포인트 실시간 모니터링 및 인간 행위 분석을 통한 앤드 포인트 개인 정보 보호 기능을 제공하여 기존의 사이버 보안에 국한된 통합 보안 관제의 효율성을 높이는 방안을 제안한다.

• Digital Contents
• /
• no.8 s.135
• /
• pp.67-67
• /
• 2004

한국소프트웨어진흥원(KIPA)과 한국컨설팅협회(KCA)가 주최하고 정보통신부가 후원한‘2004년 상반기 SW 디지털콘텐츠 투자마트’가 지난 6월 24일 코엑스에서 개최됐다. 이번 투자마트에는 정보보호기술, 아이온커뮤니케이션즈, 마크애니, 엔로그소프트,윌로우소프트 등 유망 벤처기업들과 호서벤처투자, LG벤처투자, KTB네트워크, 한미창투 등 기관투자자들이 참석했다.

• Knowledge Management Research
• /
• v.22 no.1
• /
• pp.309-330
• /
• 2021

The information security disclosure system (ISDS) has been implemented since 2016 to ensure the protection of stakeholders and the right to know, and to promote voluntary investment in information protection by companies. Regarding the information security disclosure system, there have been studies that urge the implementation of the system, but studies that analyze the contents disclosed after the implementation of the system or suggest improvement directions are few. In this study, the contents of the information security disclosure system that had been announced on the information security industry promotion portal until 2019 were analyzed, the current status was summarized, and the direction of system improvement was suggested. In some cases, companies that disclosed information through the disclosure system increased the number of personnel in charge and obtained certifications related to information security, but did not find any effect on the increase/decrease in investment. The current disclosure system has not been activated because it has difficulty in giving individual companies incentives to disclose. Thus, this study suggests the inclusion of ISDS to information security management system (ISMS), which is currently mandatory for certain companies. In the current disclosure system, it is difficult for the company's stakeholders or customers to check the contents of the disclosure. As a way to do this, a method of including in the contents of the personal information processing policy or the notification of the use of personal information was suggested.

• Agrochemical news magazine
• /
• v.20 no.1 s.148
• /
• pp.22-25
• /
• 1999