• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.6
• /
• pp.1189-1206
• /
• 2020

Recently, ICT companies do not directly design, develop, produce, operate, maintain, and dispose of products and services, but are outsourced or outsourced companies are increasingly in charge. Attacks arising from this are also increasing due to difficulties in managing vulnerabilities for products and services in the process of consignment and re-consignment. In order to respond to this, standards and systems for security risk management of ICT supply chain are being established and operated overseas, and various case studies are being conducted. In addition, research is being conducted to solve supply chain security problems such as Software Bill of Materials (SBOM). International standardization organizations such as ISO have also established standards and frameworks for security of ICT supply chain. In this paper, we presents ICT supply chain security management items suitable for domestic situation by comparing and analyzing ICT supply chain security standards and systems developed as international standards with major countries such as the United States and EU, and explains the necessity of cyber security framework for establishing ICT supply chain security system.

• Convergence Security Journal
• /
• v.24 no.2
• /
• pp.9-17
• /
• 2024

This paper examines the security threats to enterprise Generative Artificial Intelligence systems and proposes countermeasures. As AI systems handle vast amounts of data to gain a competitive edge, security threats targeting AI systems are rapidly increasing. Since AI security threats have distinct characteristics compared to traditional human-oriented cybersecurity threats, establishing an AI-specific response system is urgent. This study analyzes the importance of AI system security, identifies key threat factors, and suggests technical and managerial countermeasures. Firstly, it proposes strengthening the security of IT infrastructure where AI systems operate and enhancing AI model robustness by utilizing defensive techniques such as adversarial learning and model quantization. Additionally, it presents an AI security system design that detects anomalies in AI query-response processes to identify insider threats. Furthermore, it emphasizes the establishment of change control and audit frameworks to prevent AI model leakage by adopting the cyber kill chain concept. As AI technology evolves rapidly, by focusing on AI model and data security, insider threat detection, and professional workforce development, companies can improve their digital competitiveness through secure and reliable AI utilization.

• Korean Security Journal
• /
• no.56
• /
• pp.9-30
• /
• 2018

Crime prevention strategies are introduced to reduce the loss caused by crimes, and Target hardening against domestic burglary attacks is broadly accepted as one of such physical security strategies. In terms of business and home security, target hardening is one of the suite of protective measures that are included in crime prevention through environmental design(CPTED). This can include ensuring all doors and windows are sourced and fitted in such a way that they can resist forcible and surreptitious from the attack of intruder. Target hardening with certified security doors, security windows and secure locks are revealed to be much more effective to deter burglary attacks than other security devices, such as CCTV, lightings and alarms which have largely psychological and indirect impact. A pilot program of target hardening utilizing certified security window and locks was carried out in Ansan city, South Korea in 2016. This study is based on the quasi-experimental design of this program for a residential area. The researchers tried to verify the crime displacement effect of the target hardening program and the diffusion effects of crime prevention benefits by analysing the crime statistics. The evaluation utilized WDQ(Weighted Displacement Quotient) technique to analyze whether the crime displacement occurred, compared the crime statistics of the experimental area with that of buffer zone and controlled areas. The result showed that the target hardening program was significantly effective in crime prevention. The number of burglary in the experimental site with target hardening intervention reduced by 100%, although the areas without the intervention showed reduction in the burglary. The crime displacement was not found at all, and the number of burlary at the buffer zone also reduced significantly.

• The Journal of Society for e-Business Studies
• /
• v.20 no.3
• /
• pp.113-125
• /
• 2015

Information Security Incidents that have recently happen rapidly spread and the scale of that incidents' damage is large. In addition, as it proceeds to the era of converged industry in the future environment and the virtual cyber world expands to the physical world, new types of security threats have occurred. Now, it is time to supply security professionals who have a multi-dimensional security capabilities that can manage the strategies of technological security and physical security from the management point of view, rather than the ones who primarily focus on the traditional technologic-centered strategies to solve new types of security threats. In conclusion, in this paper we try to produce the curriculum of information security featured in the occupational classification system and analyze the subjects that are additionally required for those who move to other occupations to cultivate security professionals who suited to the converged-industrial environment. It is expected that multi-dimensional security professionals who suited to the converged-industrial environment will be cultivated by harmoniously integrating information security subjects from technological and business/managerial perspectives, and education training courses will be developed that effectively provide core knowledges per occupational classification when people moves to other occupations in the areas of information security.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.5
• /
• pp.59-69
• /
• 2011

Since power analysis attack which uses a characteristic that power consumed by crypto device depends on processed data has been proposed, many logics that can block these correlation originally have been developed. DRP logic has been adopted by most of logics maintains power consumption balanced and reduces correlation between processed data and power consumption. However, semi-custom design is necessary because recently design circuits become more complex than before. This design method causes unbalanced design pattern that makes DRP logic consumes unbalanced power consumption which is vulnerable to power analysis attack. In this paper, we have developed new logic style which adds another discharge phase to discharge two output nodes at the same time based on DyCML to remove this unbalanced power consumption. Also, we simulated 1bit fulladder to compare proposed logic with other logics to prove improved performance. As a result, proposed logic is improved NED and NSD to 60% and power consumption reduces about 55% than any other logics.

• Convergence Security Journal
• /
• v.15 no.3_2
• /
• pp.59-70
• /
• 2015

This study aims at exploring relation of social security network building, civil culture and community unity. To achieve the purpose, this study selected the general citizens in Seoul Region (Gangdong, Gangseo, Gangnam and Gangbuk) from Jul. 15 to Sept. 15, 2014 as population and sampled 400 people using cluster random sampling. Excluding unhonest data, the number of cases used for the final analysis is 337 people. The collected data were analyzed for the study purpose using SPSSWIN 18.0, as statistical techniques, factor analysis, reliability analysis, correlation analysis, t-test, one-way ANOVA, multiple regression analysis, path analysis etc. were used. First, social security network building has an effect on civil culture. That is, the more activated voluntary crime prevention activity, the higher order law-abiding spirit. The more activated local government security education, police public order service, the higher awareness of participation becomes. First, social security network building has an effect on civil culture. That is, the more activated voluntary crime prevention activity, the higher order law-abiding spirit. The more activated local government security education, police public order service, the higher awareness of participation becomes. The more activated voluntary crime prevention activity, street CCTV facilities, police public order service, the higher tolerance spirit becomes. On the contrary, street CCTV facilities reduce citizens' autonomy. Second, social security network building has an effect on community unity. The more activated street CCTV facilities, police public order service, crime prevention design, the higher a sense of stability becomes. The more activated local government security education, police public order service, crime prevention design, the higher awareness of community becomes. The more activated voluntary crime prevention activity, government security education, police public order service, crime prevention design, the higher community institution becomes. Third, civil culture has an effect on community unity. That is, the more activated awareness of community, tolerance spirit, the higher a sense of stability, awareness of community and community system become. Fourth, social security network building has an effect on civil culture and community unity. That is, social security network building has a low effect community institution directly, but if civil culture is enhanced through social security network building, then it has a high effect on community unity.

• International Journal of Computer Science & Network Security
• /
• v.22 no.1
• /
• pp.21-26
• /
• 2022

This study touched on the effect of the different electronic course designs on the programming skills of university students. The researcher used the experimental research design of a quasi-experimental of two experimental groups to achieve the objectives of the study. The first group underwent an electronic course designed in the holistic pattern, and the second group was taught a course in a sequential pattern. This experimental design was intended to measure the impact of these two learning modes on the learners' cognitive and performance achievement of programming skills. An achievement test and observational form were the data collection tools. Data were analyzed statistically using Pearson correlation, Mann Whitney Test, and Alpha Cronbach. The findings revealed statistically- significant differences between the mean scores of the students of the first and second experimental groups in favor of the former concerning the observational form and the latter in the cognitive test. Based on the findings, some recommendations are suggested. Due to their effectiveness in the educational process, expanding using the e-courses at universities is vital. The university teachers are highly recommended to design e-courses and provide technical and material support to the e-courses user to fulfill their design purpose.

• The Journal of Korean Association of Computer Education
• /
• v.18 no.6
• /
• pp.33-42
• /
• 2015

Based on the Construal Level Theory, this study aims to investigate how information security vaccine users' selection intentions differ from each other according to the selection time of information security vaccine, advertisement message types, and information security knowledge levels. For the foregoing, this study conducted an experiment by applying an experimental design of 2(knowledge level: high/low) ${\times}2$(temporal distances: short distance/long distance) ${\times}2$(advertisement message types: how(concrete)/why(abstract)) on computer security vaccine softwares. As a result, this study confirmed that the selection intentions about information security vaccines differed from each other according to the temporal distance and advertisement message type, and also varied according to the information security knowledge level. In conclusion, this study provides an implication that the consideration of well-timed persuasive message is especially important for the users at the high level of knowledge. Also, this research implies the necessity of development of abstract thinking ability based on temporal distance for the users at the low level of knowledge.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.10
• /
• pp.185-195
• /
• 2014

In this paper, we designed a role-based emergency medical information security system REMISS added the security concept to the existing emergency medical information system. Also we suggested a REMISS protocol based on HL7 for using the emergency medical information and the security information. The procedure of security consists of user authentication phase and role/permission assign phase in the REMISS. The REMISS can supply proper security service since the REMISS assign proper permissions to each users of emergency medical information system and allow the user to access the permitted emergency medical information by using security information of the REMISS. There are some advantages that REMISS can adapt to the changing of the role of each user by dynamic exchanging the security information and assigning permissions to each user.

• Convergence Security Journal
• /
• v.6 no.3
• /
• pp.21-28
• /
• 2006

Beginning flag security it was limited in Firewall but currently many information security solutions like Anti-virus, IDS, Firewall are come to be many. For efficiently managing different kinds of information security products ESM (Enterprise Security management) are developed and operated. Recently over the integrated security management system, TMS (Threat Management System) is rising in new area of interest. It follows in change of like this information security product and also collection information is being turning out diversification. For managing cyber threats, we have to analysis qualitative information (like vulnerabilities and malware codes, security news) as well as the quantity event logs which are from information security products of past. Information Threats and Vulnerability Auto Collector raises the accuracy of cyber threat judgement and can be utilized to respond the cyber threat which does not occur still by gathering qualitative information as well as quantity information.