• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.05a
• /
• pp.632-634
• /
• 2021

In proportion to the development of the Internet and the increase in users, the rate of cyber-incident using it is increasing. As a countermeasure, there is a network separation method that separates the system accessible to users and the system containing key information from each other. However, in the case of tasks that require the use of the Internet network, it is exposed to cyber attacks, and there are many loopholes in the method of data transmission between networks and the management and operation of the system, resulting in infection of the closed network. In this paper, we aim to enhance the safety of the networking system by investigating the types and cases of infringement accidents in these network separation environments.

• Information and Communications Magazine
• /
• v.34 no.5
• /
• pp.36-43
• /
• 2017

국가 및 사회 기반 시설의 제어를 하는 컴퓨터 시스템을 SCADA(Supervisory Control And Data Acquisition)이라 한다. 대부분의 SCADA 시스템은 과거 폐쇄망과 비공개 통신프로토콜을 사용하기 때문에 비교적 안전하다고 고려되어 시스템보안 및 침해사고 대응 강화는 등한시 되었던 것이 사실이다. 하지만 최근 발생되고 있는SCADA 시스템의 침해사고들은 SCADA 시스템들이 보안위협에 노출되어있음을 의미하며 통신기술이 발전함에 따라 무선통신을 사용하는 SCADA 시스템의 통신망을 통한 불법적인 접근경로는 더욱더 확대될 수 있다. SCADA 시스템은 국가 및 사회 기반 시설의 제어를 담당하는 시스템이기 때문에 침해사고 발생시 심각한 문제가 초래될 수 있기 때문에 관련 보안기술 및 정책 연구가 필요하다. 본 고에서는 이를 위해 SCADA 시스템의 구조 및 발전 단계를 소개하여 전반적인 시스템 이해를 돕는다. 또한 무선통신 기반 SCADA 시스템의 공격 기법을 소개하고 최근 몇 년간 발생한 보안위협 사례와 관련 연구 동향을 분석한다.

• Convergence Security Journal
• /
• v.19 no.1
• /
• pp.87-95
• /
• 2019

The damage is increasing due to many encroachment accidents caused by increasingly sophisticated cyber attacks. Many institutions and businesses lack early response to invest a lot of resources in the infrastructure for incident detection. The initial response of an intrusion is to identify the route of attack, and many cyber attacks are targeted at software vulnerabilities. Therefore, analyzing the artifacts of a Windows system against software vulnerabilities and classifying the analyzed data can be utilized for rapid initial response. Therefore, the remaining artifacts upon entry of attacks by software are classified, and artifact grouping is presented for use in analysis of encroachment accidents.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.199-213
• /
• 2018

Since 2008, large-scale personal information breach incidents have occurred frequently. Even though national education, policy, and laws have been enacted and implemented to resolve the issue, personal information breaches still occur. Currently, individuals cannot confirm detailed information about what personal information has been affected, and they cannot respond to the breaches. Therefore, it is desirable to develop various methods for preventing and responding to personal information infringement caused by breach and leakage incidents and move to privacy protection behaviors. The purpose of this study is to create understanding of personal information security and information breach, to present services that can prevent breaches of personal information, to investigate the necessity of and analyze the potential public demand for such services, and to provide direction for future privacy-related information services.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2011.06a
• /
• pp.335-338
• /
• 2011

최근 정보화가 고도화됨에 따라 해킹, 웜 바이러스 등 사이버 침해사고 또한 증가하고 있다. 이에 따라 사이버 침해사고를 예방하고 대응하기 위하여 보안관제의 필요성이 대두되고 있으며 이를 지원하기 위한 시스템이 등장하고 있다. 단순한 사이버 공격을 탐지하는 수준에서 벗어나 분석 및 대응 등 넓은 의미의 보안관제 활동을 수행하기 위한 시스템은 이기종 환경에서 대용량의 데이터를 처리하여 신속하고 정확한 탐지 결과를 보여줄 수 있어야 한다. 또한 다양한 보안관제 활동을 원활히 수행할 수 있는 기능을 제공하여야 한다. 본 논문에서는 이러한 요구사항을 반영하여 대용량 보안이벤트 데이터를 동적으로 상관 분석하여 탐지 효율성과 신속성을 향상시킬 수 있는 보안관제시스템을 설계 제안한다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.16 no.6
• /
• pp.43-54
• /
• 2016

The occurrence of cyber crime is on the rise every year, and the security control center, which should play a crucial role in monitoring and early response against the cyber attacks targeting various information systems, its importance has increased accordingly. Every endeavors to prevent cyber attacks is being attempted by information security personnel of government and financial sector's security control center, threat response Center, cyber terror response center, Cert Team, SOC(Security Operator Center) and else. The ordinary method to monitor cyber attacks consists of utilizing the security system or the network security device. It is anticipated, however, to be insufficient since this is simply one dimensional way of monitoring them based on signatures. There has been considerable improvement of the security control system and researchers also have conducted a number of studies on monitoring methods to prevent threats to security. In accordance with the environment changes from ESM to SIEM, the security control system is able to be provided with more input data as well as generate the correlation analysis which integrates the processed data, by extraction and parsing, into the potential scenarios of attack or threat. This article shows case studies how to detect the threat to security in effective ways, from the initial phase of the security control system to current SIEM circumstances. Furthermore, scenarios based security control systems rather than simple monitoring is introduced, and finally methods of producing the correlation analysis and its verification methods are presented. It is expected that this result contributes to the development of cyber attack monitoring system in other security centers.

• 정보보호뉴스
• /
• s.130
• /
• pp.12-12
• /
• 2008

• 정보보호뉴스
• /
• s.131
• /
• pp.14-14
• /
• 2008

• 정보보호뉴스
• /
• s.126
• /
• pp.10-10
• /
• 2008

• 정보보호뉴스
• /
• s.129
• /
• pp.12-12
• /
• 2008