• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.176-177
• /
• 2023

최근 USB 저장장치의 데이터 노출 및 탈취 문제를 해결하기 위하여, 보안 USB 저장장치가 등장하였으나, 데이터를 보호하기 위한 다양한 보안기술을 적용함에도 불구하고, 사용자 인증 우회나 비밀번호 노출과 같은 취약점으로 인하여, 보안 USB에 저장된 중요한 자료나 민감한 정보가 노출되는 문제점이 지속해서 발견되는 실정이다. 이에 따라, 보안 USB의 취약점 연구도 지속적으로 연구되고 있지만, 보안 USB 취약점을 분석하는 것은 수동적이고, 많은 노력과 시간이 소요되므로, 취약점을 자동으로 진단하고 분석하는 도구가 요구된다. 따라서, 본 논문에서는 자동화된 취약점진단 및 분석 도구를 제작하기 위하여, F 제품을 대상으로, 해당 제품에서 제공하는 비밀번호인증에서 발생하는 취약점을 분석하고 실증하며, 그 결과를 기반으로 최종적으로는 보안 USB 취약점 익스플로잇 도구 프로토타입을 개발한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2023.07a
• /
• pp.189-190
• /
• 2023

IT 산업의 발전으로 인하여, 이동식 저장장치의 빠른 발전에도 불구하고, 대중적으로 사용되는 USB 저장 장치의 분실 및 탈취로 인한 민감 데이터의 노출 문제가 발생하였다. 이러한 문제점을 해결하기 위하여, 다양한 인증 방식을 적용한 보안 USB 저장장치가 등장하였지만, 소프트웨어의 구조적인 문제점으로 인하여, 사용자 인증정보를 검증하는 함수가 노출되는 것과 같은 인증 과정에서 발생하는 취약점을 악용함으로써, 보안 USB 저장장치에 안전하게 저장된 민감한 데이터를 보호하지 못하는 보안 위협이 발생하는 실정이다. 따라서 본 논문에서는 보안 USB 저장장치 중, F 제품을 대상으로, 지문 인증과정에서 발생하는 취약점을 분석하고 실증한다. 본 논문의 결과는 보안 USB 저장장치의 데이터 보호 및 인증기술을 더욱 안전하게 향상시키기 위한 참고 자료로 활용될 것으로 사료된다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.1
• /
• pp.157-167
• /
• 2020

The big data and artificial intelligence technology, which has provided the foundation for the recent 4th industrial revolution, has become a major driving force in business innovation across industries. In the field of information security, we are trying to develop and improve an intelligent security system by applying these techniques to large-scale log data, which has been difficult to find effective utilization methods before. The quality of security log big data, which is the basis of information security AI learning, is an important input factor that determines the performance of intelligent security system. However, the difference and complexity of log data by various product has a problem that requires excessive time and effort in preprocessing big data with poor data quality. In this study, we research and analyze the cases related to log data collection of various firewall. By proposing firewall log data collection format standard, we hope to contribute to the development of intelligent security systems based on security log big data.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.5
• /
• pp.1191-1204
• /
• 2012

As attackers try to paralyze information security systems, many researchers have investigated security testing to analyze vulnerabilities of information security products. Penetration testing, a critical step in the development of any secure product, is the practice of testing a computer systems to find vulnerabilities that an attacker could exploit. Security testing like penetration testing includes gathering information about the target before the test, identifying possible entry points, attempting to break in and reporting back the findings. Therefore, to obtain maximum generality, re-usability and efficiency is very useful for efficient security testing and vulnerability hunting activities. In this paper, we propose a threat analysis based software security testing technique for evaluating that the security functionality of target products provides the properties of self-protection and non-bypassability in order to respond to attacks to incapacitate or bypass the security features of the target products. We conduct a security threat analysis to identify vulnerabilities and establish a testing strategy according to software modules and security features/functions of the target products after threat analysis to improve re-usability and efficiency of software security testing. The proposed technique consists of threat analysis and classification, selection of right strategy for security testing, and security testing. We demonstrate our technique can systematically evaluate the strength of security systems by analyzing case studies and performing security tests.

• International Commerce and Information Review
• /
• v.6 no.1
• /
• pp.25-50
• /
• 2004

This study attempts to find out what kind of service quality is considered important by customers in using the Internet shopping mall and suggests the way to activate the customer relationship. The findings based on empirical analysis are shown here. First, empirical analysis of the contextual factors such as gender, education, and experience levels, shows that what customers perceive as most important in the product purchase is security in terms of the payment and personal information service. The second important service quality factor perceived by customers is responsiveness, particularly the rapidity and accuracy of response to their needs and wants. The customers also considered price, quality and diversity of the product as being important. Furthermore, there is no big difference among other service quality factors. Second, in the different gender context, there is no significant difference between the genders. However, the male group shows an even distribution of factors valued in the service quality, whereas female respondents placed stronger emphases on particular aspects of service, such as security, response, reliability and product quality. Third, in the context of different education level, the payment method between graduates and non-graduates has a significant difference. That is, the non-graduates prefer the credit card and saving through ATM, while the graduates use dual payment method using credit card and another payment method together. Therefore, the various payment methods should be considered according to the customer type, namely graduates or non-graduates. Fourth, in the context of different experience level, the result of the empirical analysis of the factors of the service quality shows no great difference between experienced and inexperienced customers. Both types of customer perceive security as the most important. To sum up, the service quality perceived by the customers of Internet shopping malls is empirically analyzed in different contexts such as gender, education, and experience. Then, the device for the customer relationship activation is suggested. It can be utilized as a guideline for the continuing diffusion of the Internet shopping mall, giving it a competitive advantage against other companies.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.9
• /
• pp.464-472
• /
• 2017

In the ICT (Information and Communication Technology) convergence security environment, a lot of companies use an external public web system for the external disclosure and sharing of product information, manufacturing technology, service manualsand marketing materials. In this way, the web system disclosed on the Internet is an important aspect of cyber security management and has an always-on vulnerability requiringan information protection solution and IT vulnerability checks. However, there are limits to vulnerability detection management in anexternal environment. In this study, in order to solvethese problems, we constructed a system based on digital forensics and conducted an empirical study on the detection of important information in enterprises by using forensic techniques. It was found thatdue to the vulnerability of web systems operated in Korea and overseas, important information could be revealed,such as the companies' confidential data and security management improvements. In conclusion, if a system using digital forensic techniques is applied in response to theincreasing number of hacking incidents, the security management of vulnerable areas will be strengthened and the cyber security management system will be improved.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.10a
• /
• pp.375-378
• /
• 2009

DDoS attacks make people can't using normal internet service, because DDoS attacks cause exhaustion of network bandwidth or exhaustion of computer system resources by using many personal computers or servers which already infected computer virus from hackers. Recent DDoS attacks attack government brach, financial institution, even IT security company. IT security companies make Anti-DDoS product for defense from DDoS attack. But, There is no standard for BMT of Anti-DDoS product. In this dissertation, Anti-DDoS product quality characteristics of the survey analysis to evaluate them by comparing the assessment items were derived.

• International Journal of Computer Science & Network Security
• /
• v.23 no.3
• /
• pp.17-30
• /
• 2023

The current research aims to reveal the impact of using some participatory e-learning strategies (participatory product - classroom web simulation) in developing cognitive achievement, electronic course design skills, and - skills list - Torrance test of innovative thinking). The tools of innovative thinking among a sample of Information Science students. To achieve the objectives of current research, the researcher designed an educational website to train students to produce electronic courses via the web, according to the two participatory e-learning strategies. The researcher used a set of tools represented in (achievement test research and experimental treatment were applied to a sample of the Faculty of Computer students at Umm Al-Qura University. The results found that both participatory product strategy and web simulation have an imact on developing learning aspects discussed in the research. As for which of the two strategies had a greater impact than the other, it turned out that the web simulation strategy had a greater impact than the participatory product strategy in developing these aspects.

• Journal of Digital Convergence
• /
• v.10 no.4
• /
• pp.235-241
• /
• 2012

To improve educational excellence and quality, academies carry forward integrative security model related to academic affairs including personal information. This paper proposes an integrative security model for academic affairs database, which guarantees DBMS access control, confidentiality, integrity, and security inspection. This proposed model considered that most academies can't make good use of data security product and suggests a detailed measure to realize the confidentiality based on the function of DBMS.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.10
• /
• pp.1369-1374
• /
• 2021

Recently, controversy has been raised over the security and safety of Chinese-made network equipment (Huawei 5G), apps (TikTok, etc.). In particular, according to the results of the Ministry of Defense investigation in 2020, malicious codes were found in CCTVs made in China that were delivered as military surveillance equipment used as a coast guard system, and specific information was remotely transmitted to a Chinese server. The safety issues of these Chinese security products can be questioned as being systematically led by the state rather than by companies or individuals. In this paper, we perform network and process level analysis of 360 Total Security(360 TS), a Chinese antivirus software. In addition, it compares and analyzes the domestic cloud-based vaccine V3 Lite product. Through this, the safety of Chinese security solutions is checked and information leakage and risks are suggested.