• Journal of Information Processing Systems
• /
• 제10권2호
• /
• pp.240-255
• /
• 2014

Cloud computing has increasingly been drawing attention these days. Each big company in IT hurries to get a chunk of meat that promises to be a whopping market in the future. At the same time, information is always associated with security and risk problems. Nowadays, the handling of these risks is no longer just a technology problem, with a good deal of literature focusing on risk or security management and framework in the information system. In this paper, we find the specific business meaning of the BMIS model and try to apply and leverage this model to cloud risk. Through a previous study, we select and determine the causal risk factors in cloud service, which are also known as CSFs (Critical Success Factors) in information management. Subsequently, we distribute all selected CSFs into the BMIS model by mapping with ten principles in cloud risk. Finally, by using the leverage points, we try to leverage the model factors and aim to make a resource-optimized, dynamic, general risk control business model for cloud service providers.

• Journal of Information Processing Systems
• /
• 제13권4호
• /
• pp.689-702
• /
• 2017

The Structured Query Language (SQL) Injection continues to be one of greatest security risks in the world according to the Open Web Application Security Project's (OWASP) [1] Top 10 Security vulnerabilities 2013. The ease of exploitability and severe impact puts this attack at the top. As the countermeasures become more sophisticated, SOL Injection Attacks also continue to evolve, thus thwarting the attempt to eliminate this attack completely. The vulnerable data is a source of worry for government and financial institutions. In this paper, a detailed survey of different types of SQL Injection and proposed methods and theories are presented, along with various tools and their efficiency in intercepting and preventing SQL attacks.

• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2014년도 추계학술발표대회
• /
• pp.464-465
• /
• 2014

Analysis of characteristics in software vulnerabilities can be used to assess security risks and to determine the resources needed to develop patches quickly to handle vulnerability discovered. Being a new research area, the quantitative aspects of software vulnerabilities and risk assessments have not been fully investigated. However, further detailed studies are required related to the security risk assessment, using rigorous analysis of actual data which can assist decision makers to maximize the returns on their security related efforts. In this paper, quantitative software vulnerability analysis has been presented for major Web browsers (Internet Explorer (IE), Firefox (FX), Chrome (CR) and Safari (SF)) with respect to the Common Vulnerability Scoring System (CVSS). The results show that, almost all the time, vulnerabilities are compromised from remote networks with no authentication required systems, and exploitation aftermath is getting worse.

• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2023년도 춘계학술발표대회
• /
• pp.101-103
• /
• 2023

With the recent advances in communication technology and Internet of Things (IoT) infrastructure, home automation systems have emerged as a new paradigm for providing users with convenient smart home services. The IoT ecosystem has merged digital systems with the physical world, dramatically changing the way people live and work. However, at the same time, security remains one of the most significant research issues in IoT, as the deployment and application of high-availability systems come with various security risks that cause serious threats to users. Among them, the security issues arising from the interaction among devices/applications should not be underestimated. Attackers can exploit interactions among devices/applications to hack into the user's home. In this paper, we present a survey of research on detecting various types of interactions among devices/applications in IoT.

• 정보보호학회논문지
• /
• 제25권4호
• /
• pp.951-960
• /
• 2015

현대의 의료분야는 스마트기기의 확산과 통신 기술의 발달로 스마트화 됨에 따른 의료보안 문제가 대두되고 있다. 그 중에서 원격의료는 의사-의사 간(D2D, Doctor to Doctor), 의사-환자 간(D2P, Doctor to Patient) 의료정보가 상호 교환되기 때문에 원격의료에서 발생할 수 있는 보안위험을 식별, 평가 및 통제하기 위한 위험관리 방안이 필요하다. 본 논문에서는 1차 의원, 보건소, 보건지소, 보건진료소 등에서 운용하고 있는 원격의료기기와 원격의료시스템을 현장에서 확인 한 결과를 토대로 공격트리(Attack tree) 방법론을 적용하여 원격의료에서 발생할 수 있는 보안위험 분석 및 평가 방법을 연구 제안한다.

• 한국콘텐츠학회논문지
• /
• 제19권5호
• /
• pp.194-204
• /
• 2019

최근 모바일 결제 앱 시장이 점차 확대되고 있으나 보안과 프라이버시에 대한 염려로 인하여 모바일 결제 앱 사용률이 서비스 제공자들의 기대에 미치지 못하고 있다. 본 연구는 모바일 결제 앱을 사용하는 개인의 성향과 결제 앱 자체의 보안 신호가 사용자들의 인지된 개인정보 유출 위험과 보안 위험에 어떠한 영향을 주며, 이러한 요인들이 최종적으로 어떻게 모바일 결제 앱의 신뢰에 영향을 주는지 설문을 통하여 살펴보았다. 그 결과, 프라이버시 염려도는 인지된 개인정보 유출 위험을 증가시키고 모바일 시스템 보안 정도를 감소시키는 반면, 친숙도, 인지된 명성, 보안 마크는 인지된 개인정보 유출 위험을 감소시키고 모바일 시스템 보안 정도를 증가시키는 것으로 나타났다. 마지막으로 인지된 개인정보 유출 위험의 감소와 모바일 시스템 보안의 증가가 모바일 결제 앱의 신뢰도에 긍정적 영향을 미친다는 점을 밝혔다.

• Journal of the Korean Data and Information Science Society
• /
• 제22권2호
• /
• pp.207-215
• /
• 2011

정보 자산에 대한 위험 분석은 주로 한국정보통신기술협회나 국제표준화기구의 표준에 따라 이루어지고 있다. 그 과정은 자산분석, 위협분석, 취약성분석, 대응책분석의 순서로 이루어져있다. 이 과정은 분석 대상, 즉 자산을 명확히 파악하는 것부터 시작된다. 기존의 방법은 그 대상을 물리적 자산에 따라 분류하는 것이 일반적이다. 한편, 국제결제은행 규약이 제시하는 방법에 따르면 위험 분석의대상을 운영에 따른 분류를 통해 규명하게 된다. 본 논문에서는 물리적 자산 중심의 기존 방법과 더불어 업무 중심의 분석 방법이 유용할 수도 있음을 보이고자 하였다. 컨조인트 분석 기법을 활용하여 상황에 따라 물리적 자산 중심의 방법과 업무 중심의 방법의 유용성의 차이를 예를 들어 분석하였다.

• 디지털산업정보학회논문지
• /
• 제15권1호
• /
• pp.77-86
• /
• 2019

Comparative analysis to secure safety of Blockchain Many investors have invested in virtual currency such as bit coins as a new investment due to increased popularity of virtual currency around the world. Also, virtual currency such as bit coin has a security technology and it has been relatively proved. popularity of virtual currency is rising as a new investment alternative because of this reason. This paper focused on the block chain's transparency and security of distributed ledger technology, which is relatively safe without third party's intervention. Many governments and companies around the world are developing and working on block chain technological development to introduce due to these reasons However, there are some suggestion that block chain has minor risks to its security. In this paper, it will examine security vulnerabilities from importance of security of Blockchain which relates to transactions of Bitcoin which stored by governments and companies around the world. This paper will propose measure which will improve safety and efficiency of Blockchain technology such as the existing Blockchain method, Blockchain proposal, traceability and awareness about hacking.

• International Journal of Computer Science & Network Security
• /
• 제21권9호
• /
• pp.1-10
• /
• 2021

The Internet of things (IoT) is the main advancement in data processing and communication technologies. In IoT, intelligent devices play an exciting role in wireless communication. Although, sensor nodes are low-cost devices for communication and data gathering. However, sensor nodes are more vulnerable to different security threats because these nodes have continuous access to the internet. Therefore, the multiparty security credential-based key generation mechanism provides effective security against several attacks. The key generation-based methods are implemented at sensor nodes, edge nodes, and also at server nodes for secure communication. The main challenging issue in a collaborative key generation scheme is the extensive multiplication. When the number of parties increased the multiplications are more complex. Thus, the computational cost of batch key and multiparty key-based schemes is high. This paper presents a Secure Multipart Key Distribution scheme (SMKD) that provides secure communication among the nodes by generating a multiparty secure key for communication. In this paper, we provide node authentication and session key generation mechanism among mobile nodes, head nodes, and trusted servers. We analyzed the achievements of the SMKD scheme against SPPDA, PPDAS, and PFDA schemes. Thus, the simulation environment is established by employing an NS 2. Simulation results prove that the performance of SMKD is better in terms of communication cost, computational cost, and energy consumption.

• 품질경영학회지
• /
• 제51권3호
• /
• pp.435-444
• /
• 2023

Purpose: To attain advanced performance certification, safety aspects along with functionality and performance are essential. Hence, this study suggests radiation leakage assessment methods for aviation security equipment during its performance certification. Methods: Detection technology guided the choice of radiation leakage assessment targets. We then detailed measurement and evaluation methods based on equipment type and operation mode. Equipment was categorized as container or box types for establishing measurement procedures. Results: We've developed specific radiation leakage assessment procedures for different types of aviation security equipment, crucial for ensuring airport safety. Using these procedures allows efficient evaluation of compliance with radiation leakage standards. Conclusion: The suggested radiation leakage assessment method aims to enhance aviation security and reliability. Future research will focus on identifying risks in novel aviation security equipment detection technologies and establishing safety standards.