• 한국정보보호학회:학술대회논문집
• /
• 한국정보보호학회 1994년도 종합학술발표회논문집
• /
• pp.288-302
• /
• 1994

정보시스템에 대한 위험분석 (risk analysis)은 정보시스템의 보안상태를 분석 및 평가하는 것으로 정보시스템의 보안상 취약부분을 보완하기 위한 보안대책을 수립하는데 안내자 역할을 하게 된다. 정보시스템의 보안대책 및 위험관리는 위험분석을 기초로 하므로 정보시스템은 합리적이고 정확한 위험분석을 수행해야 할 것이다. 위험분석기법은 수학적 기법과 다이어그램 기법이 있다. 수학적 접근방법 (mathematical approach)은 실제상황을 적절히 표현하기 어려우며 증명하기가 어렵다. 다이어그램기법 (diagraming techniques)은 이러한 수학적 접근방식의 한계를 극복함에 있어 휠씬 더 유용하다. 본 논문에서는 외국의 위험분석 기법(INFO SEC [4], SRAG [5], FIPS65 [6], JRAM [7]) 을 분석하였다.

• Journal of Information Processing Systems
• /
• 제2권2호
• /
• pp.95-100
• /
• 2006

While conventional business administration-based information technology management methods are applied to the risk analysis of information systems, no security risk analysis techniques have been used in relation to information protection. In particular, given the rapid diffusion of information systems and the demand for information protection, it is vital to develop security risk analysis techniques. Therefore, this paper will suggest an ideal risk analysis process for information systems. To prove the usefulness of this security risk analysis process, this paper will show the results of managed, physical and technical security risk analysis that are derived from investigating and analyzing the conventional information protection items of an information system.

• Asia pacific journal of information systems
• /
• 제18권4호
• /
• pp.1-26
• /
• 2008

Rapid progress of information technology and widespread use of the personal computers have brought various conveniences in our life. But this also provoked a series of problems such as hacking, malicious programs, illegal exposure of personal information etc. Information security threats are becoming more and more serious due to enhanced connectivity of information systems. Nevertheless, users are not much aware of the severity of the problems. Using appropriate password is supposed to bring out security effects such as preventing misuses and banning illegal users. The purpose of this research is to empirically analyze a research model which includes a series of factors influencing the effectiveness of passwords. The research model incorporates the concept of risk based on information systems risk analysis framework as the core element affecting the selection of passwords by users. The perceived risk is a main factor that influences user's attitude on password security, security awareness, and intention of security behavior. To validate the research model this study relied on questionnaire survey targeted on evening class MBA students. The data was analyzed by AMOS 7.0 which is one of popular tools based on covariance-based structural equation modeling. According to the results of this study, while threat is not related to the risk, information assets and vulnerability are related to the user's awareness of risk. The relationships between the risk, users security awareness, password selection and security effectiveness are all significant. Password exposure may lead to intrusion by hackers, data exposure and destruction. The insignificant relationship between security threat and perceived risk can be explained by user's indetermination of risk exposed due to weak passwords. In other words, information systems users do not consider password exposure as a severe security threat as well as indirect loss caused by inappropriate password. Another plausible explanation is that severity of threat perceived by users may be influenced by individual difference of risk propensity. This study confirms that security vulnerability is positively related to security risk which in turn increases risk of information loss. As the security risk increases so does user's security awareness. Security policies also have positive impact on security awareness. Higher security awareness leads to selection of safer passwords. If users are aware of responsibility of security problems and how to respond to password exposure and to solve security problems of computers, users choose better passwords. All these antecedents influence the effectiveness of passwords. Several implications can be derived from this study. First, this study empirically investigated the effect of user's security awareness on security effectiveness from a point of view based on good password selection practice. Second, information security risk analysis framework is used as a core element of the research model in this study. Risk analysis framework has been used very widely in practice, but very few studies incorporated the framework in the research model and empirically investigated. Third, the research model proposed in this study also focuses on impact of security awareness of information systems users on effectiveness of password from cognitive aspect of information systems users.

• Asia pacific journal of information systems
• /
• 제15권2호
• /
• pp.65-96
• /
• 2005

It is generally believed that, compared to traditional commerce, Electronic Commerce(EC) is more difficult to gain and sustain customers. One of the major reasons that customers do not use EC is lack of trust. Previous researches on the EC user's trust suggested that risk is an antecedent of trust and the concept of trust is highly related to risk. This study proposed a combined model in which includes the factors based on generic information security risk analysis methodology and trust factors in EC. The objectives of this study are follows; first, investigating the relationship between trust and risk that are antecedent factors of purchase intention, and second, examining the validity of information security risk analysis approach in EC environment. Based on the survey results of 143 MBA students statistical analysis showed that factors like threats and controls were significantly related to risk, but assets did not have statistically significant relationship with risk. Controls and knowledge of EC had meaningful effect on user's trust. This study found that risk analysis methodology which is generally used at organizational level is practically useful at user level on EC environment. In conclusion, the results of this study would be applied to generic situation of information security for analyzing and managing the risk. Besides, this study emphasized that EC vendors need to pay more attention to the information security risk to gain customer's trust.

• Industrial Engineering and Management Systems
• /
• 제13권1호
• /
• pp.87-100
• /
• 2014

Risk management is recognized as a significant element in Information Security Management while the failure mode and effects analysis (FMEA) is widely used in risk analysis in manufacturing industry. This paper aims to present the development work of the Information Security FMEA Circle (InfoSec FMEA Circle) which is used to support the risk management framework by modifying traditional FMEA methodologies. In order to demonstrate the "appropriateness" of the InfoSec FMEA Circle for the purposes of assessing information security, a case study at Hong Kong Science and Technology Parks Corporation (HKSTP) is employed. The "InfoSec FMEA Circle" is found to be an effective risk assessment methodology that has a significant contribution to providing a stepwise risk management implementation model for information security management.

• 정보보호학회논문지
• /
• 제18권4호
• /
• pp.135-141
• /
• 2008

사이버 침해사고와 해킹의 위험성이 증대되고 있다. 이를 해결하기 위하여 정보보호기술중에서 보안위험분석 분야의 연구가 활발하게 이루어지고 있다. 하지만 평가를 위해서는 적지 않은 평가비용, 수개월의 평가기간, 평가 참여인원, 평가후의 보안대책비용, 보안관리비용에 대한 부담이 클 수밖에 없다. 이에 따라, 본 논문에서는 정량평가 형태의 위험분석평가를 프로젝트단위로 관리하며, 평가기간 및 적정 평가자 선정을 위한 사례기반추론알고리즘을 이용한 위험분석방법론 제안한다.

• 정보보호학회논문지
• /
• 제14권4호
• /
• pp.61-74
• /
• 2004

위험분석모델은 정보시스템 보안과 관련된 위험을 자산, 위협, 취약성, 보안통제의 관계를 통해서 설명하는 체계화 된 방법이다. 그러나 위험분석모델의 실증적인 연구가 이루어진 경우는 상당히 드물며, 특히 위험분석모델의 타당성 논의는 거의 없는 실정이다. 구조방정식모델을 적용하여 전자상거래 환경에서 위험분석모델의 타당성에 대한 실증적 분석을 한 결과, 위험의 수준에 영향을 미치는 요인으로 언급되는 위협과 보안통제는 통계적으로 유의한 것으로 나타났다. 본 연구는 전자상거래 이용자의 위험인지에 영향을 미치는 요인을 위험분석 접근법을 이용하여 모델 화하여 검증함으로써 전자상거래 위험에 영향을 미치는 선행요인을 규명할 뿐만 아니라 위험분석접근법을 통한 전자상거래에 대한 새로운 관점에서의 접근을 가능하게 한다.

• 인터넷정보학회논문지
• /
• 제7권1호
• /
• pp.31-38
• /
• 2006

정보화 발전으로 정보통신 시스템에 대한 의존도가 높아지고, 이에 대한 위협, 취약성, 위험이 증가하고, 조직의 정보노출 및 보안침해 사고가 증가하고 있는 추세이다. 이러한 정보통신시스템에 대한 위협, 취약성, 위험을 분석하고 제거하기 위한 보안위험분석의 중요성이 부각되고 있다. 위험분석도구는 조직에 내재한 위험을 식별하여 보안침해 사고 발생을 사전에 예방하기 위한 도구로서 주요 정보시스템을 분석 평가하고, 위협, 취약성, 보안대책을 제시하여 조직의 위험 수준을 감소하는 데 도움을 준다. 본 논문은 국제공통평가기준 CC 스키마를 도입하여 정형화된 위험분석 프로세스를 정의하고, 정보보안 관리자가 쉽게 위험분석을 적용 할 수 있도록 보안위험분석 도구를 제안한다.

• 정보보호학회논문지
• /
• 제25권6호
• /
• pp.1595-1606
• /
• 2015

위험분석은 위험을 허용 가능한 수준으로 관리하기 위한 방안을 수립하는 데 활용된다. 이러한 위험관리 의사결정에 있어서 위험의 시각화는 중요하다. 그러나 기존의 위험 시각화 방식은 위험의 요소들을 고려하여 입체적으로 위험을 시각화하는 데 있어서 한계를 지닌다. 본 논문에서는 기밀성, 무결성, 가용성 측면에서 개별적 혹은 종합적으로 위험을 표현할 수 있는 개선된 위험도 3차원 시각화 방법을 제시한다. 제안된 방법을 기업의 위험분석 평가에 적용하여 유효성을 검증한다. 제안된 시각화 방법은 내부통제를 위한 정보보호 의사결정 과정에 효과적으로 활용될 수 있다.

• 대한산업공학회지
• /
• 제28권1호
• /
• pp.44-56
• /
• 2002

For the risk analysis and risk assessment techniques to be effectively applied to the field of information technology (IT) security, it is necessary that the required activities and specific techniques to be applied and their order of applications are to be determined through a proper risk management model. If the adopted risk management model does not match with the characteristics of host organization, an inefficient management of security would be resulted. In this paper, a risk management model which can be well adapted to Korean domestic IT environments is proposed for an efficient security management of IT. The structure and flow of the existing IT-related risk management models are compared and analysed, and their common and/or strong characteristics are extracted and incorporated in the proposed model in the light of typical threat types observed in Korean IT environments.