• Journal of Information Technology Applications and Management
• /
• 제11권2호
• /
• pp.45-64
• /
• 2004

Many researchers have proved that information systems auditing is a very effective tool for improving information systems quality. However, information system auditing in Korea still includes many subjective judgements. This study deals with applying a quantitative model to improve information system auditing quality on security domain. First of all, we have looked at previous researches on information systems audit, especially on security audit. Based on this survey, we have come up with solutions to improve the evaluation efficiency on security audit. We have merged the security audit guidelines of NCA and KISA, and developed a quantified evaluation scheme. We have proved the validity of this model by interviews with experts and by case studies.

• 한국IT서비스학회지
• /
• 제23권1호
• /
• pp.11-25
• /
• 2024

In the field of information security management systems, one of the representative certifications in Korea is ISMS-P certification, and internationally, ISO/IEC 27001 certification is recognized. When companies acquire both ISMS-P (or ISMS) and ISO/IEC 27001 certifications, budget and manpower are duplicated in similar areas. Therefore, it is necessary for the company to choose and invest in a certification that is suitable for its conditions. This paper proposes a strategy for obtaining information security management system certification that is suitable for the characteristics of the company, allowing for effective information security management based on the company's conditions. To achieve this, data were collected from the Ministry of Science and ICT's Information Security Disclosure System (ISDS), the Korea Internet & Security Agency (KISA), and the Financial Supervisory Service's Data Analysis, Retrieval and Transfer System (DART), and Probit regression analysis was conducted. During the Probit regression analysis, the relationships between seven independent variables and five cases of ISMS-P (or ISMS) acquisition, ISMS-P acquisition, ISMS acquisition, ISO/IEC 27001 acquisition, and both ISMS-P (or ISMS) and ISO/IEC 27001 acquisition were analyzed. The analysis results revealed the relationship between company characteristics, including industry, and certification acquisition in the ISMS field. Through this, strategies for certification acquisition based on company types could be suggested.

• Journal of Information Technology Applications and Management
• /
• 제14권4호
• /
• pp.121-138
• /
• 2007

This study proposes a method to improve network security systems based on critical success factors for systems development. To accomplish the research objective, the study analyzes required functions of network security systems and reviews existing methods to improve network security systems. Based on the analyses and literature review, critical success factors for development of network security systems are identified and a new method to improve network security systems based on the critical success factors is proposed. The proposed method to improve network security systems is based on utilizing multi-core processors. A prototype is developed and validated. This study will provide a good case in the network security area where research incorporating both engineering and management disciplines lacks.

• Journal of Information Technology Applications and Management
• /
• 제26권4호
• /
• pp.19-30
• /
• 2019

Many organizations need to comply with ISMS-P for information systems and personal information management for ISMS-P certification. Organizations should safeguard vulnerablities to information systems. However, as the kinds of information systems are diversified and the number of information systems increases, management of such vulnerabilities manually accompanies with many difficulties. SCAP is a protocol to manage the vulnerabilities of information system automatically with security standards. In this paper, for the introduction of SCAP in domestic domains we verify the applicability of server-oriented system which is one of ISMS-P certification targets. For SCAP applicability, For obtaining this goal, we analyze the structures and functions of SCAP. Then we propose schemes to check vulnerabilities of the server-oriented system. Finally, we implement the proposed schemes with SCAP to show the applicability of SCAP for verifying vulnerabilities of the server-oriented system.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제9권12호
• /
• pp.5116-5134
• /
• 2015

In this paper, due to the network security defense is mainly static defense, a dynamic classification network security defense strategy model is proposed by analyzing the security situation of complex computer network. According to the network security impact parameters, eight security elements and classification standard are obtained. At the same time, the dynamic classification algorithm based on fuzzy theory is also presented. The experimental analysis results show that the proposed model and algorithm are feasible and effective. The model is a good way to solve a safety problem that the static defense cannot cope with tactics and lack of dynamic change.

• 한국정보시스템학회지:정보시스템연구
• /
• 제29권1호
• /
• pp.23-50
• /
• 2020

Purpose As information management grows in importance around the world, organizations are investing in information security technology. However, the higher the level of information security technology in an organization, the higher the techno-stress of employees. The purpose of this study is to suggest stress factors related to information security technology that affect the reduction of employees' intention to comply with information security and to suggest ways to alleviate stress. Design/methodology/approach The research presented a model for mitigating technical stress related to information security based on technical stress theory and person-organization fit theory. 346 questionnaire data were analyzed from the members of the organization who applied the information security technology, and the research hypothesis was verified through the structural equation modeling. Findings The hypothesis test confirms that security-related techno-stress reduces the information security compliance intention of employees, organizational technical support mitigates technical stress, and person-organization fitness mitigates the negative relationship between techno-stress and compliance intention. The results of the study contribute to the organization's strategy for minimizing the reduction of the information security compliance intention of employees, and are meaningful in that the theoretical basis for mitigating techno-stress is provided in the field of information security.

• Journal of Information Technology Applications and Management
• /
• 제10권3호
• /
• pp.93-108
• /
• 2003

As Electronic Commerce is popularized, crimes related to Electronic Commerce are also increasing, Electronic shopping malls and payment gateways focus their attention on network security of payment information or the sizes of encryption keys, In real world, however, the payment-related crimes in electronic shopping malls are not based on the security hole of encryption mechanism of the payment systems, but on the customers carelessness or the insecurity of server systems of merchants or financial institutes. So, this research analyzes the structure of current electronic payment systems, investigates the payment-related crimes, addresses the structural problems of the Korean electronic payment systems, and suggests an alternative general architecture for secure payment systems by incorporating the concept of separation of order information and payment information.

• Journal of Information Technology Applications and Management
• /
• 제27권4호
• /
• pp.1-19
• /
• 2020

Infringement of information security has caused the corporate image to be damaged and share price to fall, and it is emerging as an organizational risk. The value of information assets in enterprises has led to a higher level of security than in the past. As a result, companies are aware of the need for officers to protect information and to oversee a security management system. However, despite the growing importance of information security officers, there is a lack of research on their roles and characteristics. This study validates the relationship between determinants that affect the performance of information security. And a structural equation model was presented and empirically analyzed to see the impact of the internal and external characteristics of the staff in charge of information security on the organization's information security performance.

• 정보보호학회논문지
• /
• 제22권5호
• /
• pp.1191-1204
• /
• 2012

정보보안시스템을 무력화하는 공격이 나타남에 따라, 정보보안제품의 취약성을 분석하는 보안 테스팅에 대한 관심이 높아지고 있다. 보안제품 개발의 주요 단계인 침투 테스팅은, 공격자가 악용할 수 있는 취약성을 찾기 위해 컴퓨터 시스템을 실제적으로 테스팅하는 것이다. 침투 테스팅과 같은 보안 테스팅은 대상 시스템에 대한 정보 수집, 가능한 진입점 식별, 침입 시도, 결과 보고 등의 과정을 포함한다. 따라서 취약성 분석 및 보안 테스팅에서 일반성, 재사용성, 효율성을 극대화하는 것이 매우 중요하다. 본 논문에서는, 정보보호제품이 자신의 보안 기능을 무력화하거나 우회하는 공격에 대응할 수 있는 자체보호기능 및 우회불가성을 제공하는 가를 평가할 수 있는 위협분석 기반의 소프트웨어 보안 테스팅을 제안한다. 위협분석으로 취약성을 식별한 후, 보안 테스팅의 재사용성과 효율성을 개선하기 위해 소프트웨어 모듈과 보안 기능에 따라 테스팅 전략을 수립한다. 제안기법은 위협 분석 및 테스팅 분류, 적절한 보안테스팅 전략 선정, 보안 테스팅으로 구성된다. 사례연구와 보안테스팅을 통해 제안 기법이 보안 시스템을 체계적으로 평가할 수 있음을 보였다.

• 지능정보연구
• /
• 제26권3호
• /
• pp.37-50
• /
• 2020

사물 인터넷, 빅데이터, 클라우드, 인공지능 등 다양한 정보통신기술이 발전하면서, 정보보호의 대상이 증가하고있다. 정보통신기술의 발전에 비례해서 정보보호의 필요성이 확대되고 있지만, 정보보호 투자에 대한 관심은 저조한 상황이다. 일반적으로 정보보호와 관련된 투자는 효과를 측정하기 어렵기 때문에 적절한 투자가 이루어지지 않고 있으며, 대부분의 조직은 투자 규모를 줄이고 있다. 또한 정보보호 대책의 종류와 특성이 다양하기 때문에 객관적인 비교와 평가가 힘들고, 객관적인 의사결정 방법이 부족한 실정이다. 하지만 조직의 발전을 위해서는 정보보호와 관련된 정책과 의사결정이 필수적이며 적정 수준의 투자와 이에 대한 투자 효과를 측정 할 필요가 있다. 이에 본 연구에서는 게임 이론을 이용하여 정보보호 대책 투자 포트폴리오를 구성하는 방법을 제안하고 선형계획법을 이용하여 최적 방어 확률을 도출한다. 2인 게임 모형을 이용하여 정보보호 담당자와 공격자를 게임의 경기자로 구성한 뒤, 정보보호 대책을 정보보호 담당자의 전략으로, 정보보호 위협을 공격자의 전략으로 각각 설정한다. 게임 모형은 경기자의 보수의 합이 0인 제로섬 게임을 가정하고, 여러개의 전략 사이에서 일정한 확률 분포에 따라 전략을 선택하는 혼합 전략 게임의 해를 도출한다. 여러 종류의 위협이 존재하는 현실에서는 한 개의 정보보호 대책만으로 일정 수준 이상의 방어가 힘들기 때문에, 다수의 정보보호 대책을 고려해야한다. 따라서 다수의 정보보호 위협에 따른 정보보호 대책이 배치된 환경에서 정보보호 대책의 방어 비율을 이용하여 정보보호 대책 투자 포트폴리오를 산출한다. 또한 최적화된 포트폴리오를 이용하여 방어 확률을 최대화하는 게임 값을 도출한다. 마지막으로 정보보호 대책의 실제 성능 데이터를 이용하여 수치 예제를 구성하고, 제안한 게임 모델을 적용하고 평가한다. 본 연구에서 제시한 최적화 모델을 이용하면 조직의 정보보호 담당자는 정보보호 대책의 방어 비율을 고려하여 정보보호 대책의 투자 가중치를 구할 수 있고, 효과적인 투자 포트폴리오를 구성하여 최적의 방어 확률을 도출 할 수 있을 것이다.