• The KIPS Transactions:PartC
• /
• v.18C no.5
• /
• pp.317-326
• /
• 2011

This study is meaningful in that it standardizes various security and defense policies and devices, newly defines characteristics of defense policies and defense techniques, and specify and report various kinds of security polities and devices in order for administrators or users to add and apply the policies when introducing new security policies including the implementation of existing network infra and applying additionally. Therefore, this study aims to divide the policies into ONSU-MF(One Network Security Unit-Multi Function) that classifies one network security device-based policies and OSD-MD(One Security Device-Multi Defense), which implements various security methods by using one security device, and suggest network security infra improvement mechanism through the standardization implementation technique integrating the two methods.

• The KIPS Transactions:PartC
• /
• v.9C no.6
• /
• pp.823-830
• /
• 2002

Enterprise security management system proposed to properly manage heterogeneous security products is the security management infrastructure designed to avoid needless duplications of management tasks and inter-operate those security products effectively. In this paper, we propose the model of generalized security policies. It is designed to help security management build invulnerable security policies that can unify various existing management infrastructures of security policies. Its goal is not only to improve security strength and increase the management efficiency and convenience but also to make it possible to include different security management infrastructures while building security policies. In the generalization process of security policies. we first diagnose the security status of monitored networks by analyzing security goals, requirements, and security-related information that security agents collect. Next, we decide the security mechanisms and objects for security policies, and then evaluate the properness of them on the basis of security goals, requirements and a policy list. With the generalization process, it is possible to integrate heterogeneous security policies and guarantee the integrity of them by avoiding conflicts or duplications among security policies. And further, it provides convenience to manage many security products existing in large networks.

• Journal of the Korea Society for Simulation
• /
• v.18 no.2
• /
• pp.1-8
• /
• 2009

Enterprise security management system proposed to properly manage heterogeneous security products is the security management infrastructure designed to avoid needless duplications of management tasks and inter-operate those security products effectively. In this paper, we defined the security policies using Z-Notation and the detection algorithm of policy conflict for managing heterogeneous firewall systems. It is designed to help security management build invulnerable security policies that can unify various existing management infrastructures of security policies. Its goal is not only to improve security strength and increase the management efficiency and convenience but also to make it possible to include different security management infrastructures while building security policies. With the process of the detection and resolution for policy conflict, it is possible to integrate heterogeneous security policies and guarantee the integrity of them by avoiding conflicts or duplications among security policies. And further, it provides convenience to manage many security products existing in large networks.

• Korean Security Journal
• /
• no.39
• /
• pp.241-268
• /
• 2014

This paper is a study on the industrial security specialists of organizations in possession of industrial technology and their compliance motivations towards security policies. The focus is on organizational justice, organizational attachment and empowerment based on our hypothesis that compliance motivations are shaped, not only by the organization itself but, also by the attitude and principle of the organization's members. The objective is to propose a direction for administrative security policy to increase prevention of industrial technology leakage by identifying the factors' significance through hypothesis testing and thereafter investigating the influencing relationship. Survey questionnaires are collected from the participants of a regular educational program provided by the Korean Association for Industrial Technology Security (KAITS) and analyzed using SPSS 21.0 and AMOS 21.0 software. Through various statistical analyses, following results are acquired. First, procedural fairness and organizational attachment are found to motivate security supervisors to comply with security policies. Particularly, the relationship between procedural fairness and compliance motivations towards security policies is fully mediated by organizational attachment, suggesting that improved fairness at the organizational level will lead to an increase in organizational attachment, which will encourage the individuals to comply with security policies. Additionally, empowerment of the individuals in organizations partially mediates the relationship between procedural fairness and organizational attachment, confirming that procedural fairness empowers each individual and increases his organizational attachment. Specifically, in order to maximize compliance of security policies, businesses should demonstrate procedural fairness when compensating their employees for their work to empower them and increase their organizational attachment, which can increase their will to comply with existing security policies. This research provides insights into how to encourage security supervisors to comply with security policies by increasing their empowerment and organizational attachment.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.5 no.6
• /
• pp.625-630
• /
• 2010

With regard to the examples of establishing various sorts of information security, it can be seen that there are gradual, developmental procedures including Firewall and VPN (Virtual Private Network), IDS (Intrusion Detection System), or ESM(Enterprise Security Management). Each of the security solutions and equipments analyzes both defense and attack for information security with the criteria of classifying the problems of security policies by TCP/IP layers or resulted from attack patterns, attack types, or invasion through specialized security technology. The direction of this study is to examine latency time vulnerable to invasion which occurs when L2-stratum or lower grade equipments or policies are applied to the existing network through TCP/IP layer's L3-stratum or higher grade security policies or equipments and analyze security holes which may generate due to the IP preoccupation in the process of establishing policies to limit particular IP area regarding the policies for security equipments to figure out technological problems lying in it.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.9 no.6
• /
• pp.1364-1370
• /
• 2005

There are many security models for database systems using policy-based access control. RBAC (Role-based Access Control) is used for complementing MAC (Mandatory Access Control) and DAC (Discretionary Access Control) and is for performing flexibly security policies meet applied environment. We implemented the database security system that applies DAC, MAC, and RBAC to meet security requirements of users. However, security policies are constructed redundantly whenever security policies are needed to each user in this system. Even though the proposed security system can flexibly control more complicated 'read' access to various data sizes for individual users, it is obvious that there is a possibility that a new policy can be a duplication of existing policies. In this paper, we introduce the problem of policy duplication and propose the policy management module. With this proposed module, constructed policies are checked for duplication and deleted or merged with existing policies.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.355-370
• /
• 2022

This research investigates the impacts of information security (IS) culture and management leadership styles on employee's security behaviors (IS policies compliance, IS participation) in financial institutions. This study use the survey data collected from 236 employees of financial institutions. This research shows that IS culture has a positive effect on both behavioral intentions to comply with IS policies and the intentions to actively participate in information security activities. Transactional leadership has a positive impact on the IS policies compliance intentions and to participate in information security activities. In contrast, transformational leadership has a positive impact on the intentions to participate in information security activities, but not on the IS policies compliance intentions.

• Korean System Dynamics Review
• /
• v.4 no.2
• /
• pp.5-44
• /
• 2003

The focus of this paper is comparing relative effects of government policies for upbringing information security industry from the dynamic point of view. For the purpose of simplicity, these policies are classified into three groups, and then the relative effectiveness of these policy groups is examined using System Dynamics. The three policy groups are composed of technology development policies (TDP), human resource development policies (HDP), and direct supporting policies for overseas expansion (DSP). From the result of the analysis, DSP appears to be the most effective and HDP is the second-best group. By the way, for successful carrying into effect of DSP, marketing manpower should be strengthen. However, current HDP has been focusing on the bringing up technical experts. Therefore, overseas marketing manpower should be reared as well as technicians. Also, the existing infrastructure for overseas expansion for other industries should be shared for DSP of information security industry, because this is essential for success of DSP in terms of timing and costing. Finally, in spite of its low effect, TDP should be maintained continuously. The importance of information security technology is increasing and some countries have already considered these technologies as a core of future national defense. Therefore, we should acquire the competitiveness for a few technologies through continuous development of selected technologies at least.

• The Journal of Information Systems
• /
• v.15 no.1
• /
• pp.145-168
• /
• 2006

Current computer viruses are one of the most serious problems in information age due to their potential demage and impact on use of information systems. To make the problem worse, virus development technology has been advanced rapidly, and use of network systems has expanded widely. Therefore computer viruses are much more complex and use of anti-virus software(AV S/W) is not enough to prrevent virus incidents. It implies that computer viruses as well as other information security matters are not solely a technical problem but also a managerial one. This study emphasized on computer virus controls from managerial perspective of information security and investigated factors influencing the effectiveness of computer virus controls. Organization's comprehensive security policies provide guidelines on how organization or individual can protect themselves from computer viruses. Especially, user's education has positive impact on user's security related characteristics. Based on the analysis of research model using structural equation modeling technique, security policies were influencing security controls and improving user's computer viruses related awareness. Also security controls had positive impact on security effectiveness. However, no significant relationship was found between user's security related characteristics and security effectiveness.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.4
• /
• pp.123-133
• /
• 2008

Information securiry is considered important due to the side effect generated from the expansion of information system and rapid increase of the use of internet. Nevertheless, we are getting unconscious of the importance of information security. The purpose of this research is to empirically analyze that the effects of security policies, security awareness and individual characteristics on password security effectiveness. Based on the analysis of research model using structural equation modeling technique, security policies were influencing individual characteristics and improving user's security awareness. Also individual characteristics and security awareness had positive impact on security effectiveness.