• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.10
• /
• pp.5260-5275
• /
• 2019

In the process of constructing the traditional offensive and defensive game theory model, these are some shortages for considering the dynamic change of security risk problem. By analysing the critical indicators of the incomplete information game theory model, incomplete information attack and defense game theory model and the mathematical engineering method for solving Bayes-Nash equilibrium, the risk-averse income function for information assets is summarized as the problem of maximising the return of the equilibrium point. To obtain the functional relationship between the optimal strategy combination of the offense and defense and the information asset security probability and risk probability. At the same time, the offensive and defensive examples are used to visually analyse and demonstrate the incomplete information game and the Harsanyi conversion method. First, the incomplete information game and the Harsanyi conversion problem is discussed through the attack and defense examples and using the game tree. Then the strategy expression of incomplete information static game and the engineering mathematics method of Bayes-Nash equilibrium are given. After that, it focuses on the offensive and defensive game problem of unsafe information network based on risk aversion. The problem of attack and defense is obtained by the issue of maximizing utility, and then the Bayes-Nash equilibrium of offense and defense game is carried out around the security risk of assets. Finally, the application model in network security penetration and defense is analyzed by designing a simulation example of attack and defense penetration. The analysis results show that the constructed income function model is feasible and practical.

• Journal of the Korean Institute of Gas
• /
• v.25 no.1
• /
• pp.30-39
• /
• 2021

Natural gas is globally emerging as an important energy source for environmental, political and regional reasons. In Korea, natural gas imported from oversea natural gas resources as a LNG, it is increased for an applications as a fuel and feedstock which replace the coal and nuclear energy. Because it is relied on the import market in Korea, it is very important to analyze the security for supply. Therefore, this study suggested a method for reducing supply risk and for providing stable supply and demand through risk analysis of Korea's import structure. In order to reduce the supply risk, the concentration of importing countries should be lowered and it is necessary to lower the proportion of countries with relatively low GSSI and increase the imports from Russia. Finally increasing the number of importing countries or maintaining friendly relations with countries where the supply is stable could give us the positive impact in terms of total GSSI.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.6
• /
• pp.67-81
• /
• 2011

In recently years, there are cyber-weapon aim to national infrastructure such as 'stuxnet'. Security experts of the world are paying attention to this phenomenon. The networks which controls traffic, subway, waterworks of the city are safe from threats such as computer virus, malware, because the networks were built on closed-networks. However, it's about time to develop countermeasure for the cyber-weapon. In this paper, we review status-quo of the control systems for metropolitan infrastructure and analyze the risk of industrial control system in SCADA(Supervisory Control And Data Acquisition) network. Finally, we propose a security model for control systems of metropolitan infrastructure.

• Asia pacific journal of information systems
• /
• v.27 no.3
• /
• pp.156-175
• /
• 2017

The proposed conceptual framework is based in the relationships among knowledge of personal information security, trust on the personal information security policies of parcel delivery service companies, privacy concern, trust in and risk of parcel delivery services, and user satisfaction with parcel delivery services. Drawing upon both cognitive theory of emotion and cognitive emotion theory that complement each other, we propose a research model and examine the relationships between cognitive and emotional factors and the usage of parcel delivery services. The proposed model is validated using data from customers who have previously used parcel delivery services. The results show a significant relationship between the cognitive and affective factors and the usage of parcel delivery services. This study enhances our understanding of parcel delivery services based on the consumers' psychological processes and presents useful implications on the importance of privacy and security in these services.

• International Journal of Railway
• /
• v.2 no.3
• /
• pp.113-117
• /
• 2009

Risk management is an important part of system assurance and it is widely used in safety-related system. Railway signal system is one kind of safety-related system and its most important goal is to guarantee the safety of railway system. The method based on risk management can find and solve the security issues of railway signal system more effectively. This paper introduces the basic conception of risk management, studies the whole process of risk management and related tools and techniques and discusses some key points qualitatively combining with the particularity of railway signal system.

• Information Systems Review
• /
• v.17 no.1
• /
• pp.117-140
• /
• 2015

Cloud Computing has drawn attention as one of 10 IT strategic technology trends and has various advantages such as cost reduction and enhancing business flexibility. However, corporations hesitate to adopt the service because of unexpected risks. Especially compared to large firm, medium and small ones use public cloud that security risk is high. Meanwhile, real option strategy has drawn attention as the method to hedge uncertainty in IT projects. Therefore, in this study causal relationships among technical, security, relational, and economic risks of cloud service will be investigated. Eventually, this study investigates how those risks influence the intention to choose the real option about the cloud service. For this study, five hypotheses is drawn, and a survey is conducted about the medium and small firms which are currently using cloud service to examine hypotheses. Since the study is at organizational level, 287 questionnaire replies are recalculated to 120 firms. For statistical analysis, Smart PLS and SPSS Statistics18 are used. As a result, technical risk of cloud service has significantly positive influence on security risk. Second, security risk and relational risk of cloud service has significantly positive influence on economic risk. Third, economic risk of cloud service has significantly positive influence on the intention to purchase the delay option or abandon option. Based on this result, this research discussed practical and academic implications and the limitations.

• Proceedings of the Korea Society for Industrial Systems Conference
• /
• 2002.06a
• /
• pp.408-416
• /
• 2002

네트워크의 발달과 인터넷의 생활화로 컴퓨터 보안이 시대적인 중요문제로 부각하고 있다. 요즘 해킹으로 발생하는 재정적 손실은 특별하게 큰 사건이 아닌 경우에 언론에 보도되지 않을 정도로 만성적인 현상으로 인식되고 있으며 컴퓨터 범죄는 어느정도 사회현상의 하나로 여겨질 정도다. 그러나 컴퓨터 범죄를 퇴치하고 컴퓨터보안의 완벽성을 유지하고자 하는 기술적인 노력은 지속적으로 전개되고 있으나 컴퓨터 범죄는 오히려 늘어가고 있는 추세다. 이에따라 컴퓨터 범죄등 컴퓨터보안관리가 기술적인 수준에 머물지 않는 성격을 갖추고 있다는 인식이 최근들어 확산하고 있다고 할 수 있다. 이 논문은 이런 인식에서부터 출발해 새로운 개념으로 등장한 전사적 보안관리 (Enterprise Security Planning)와 컴퓨터 보안 위험 관리(Computer Security Risk Management)의 개념에 대한 이해를 중점적으로 제기했다. 또 컴퓨터 보안위험관리의 과정을 단계별로 검토해 컴퓨터 보안위험관리를 체계적으로 이해할수 있도록 제시했다. 마지막으로 본 논문은 전사적 보안관리와 컴퓨터 보안위험 관리차원에서 기업이 보안관리를 위해 갖춰야 할 새로운 흐름들, 예를 들어 보안관리자(Chief Security Officer) 제도와 보안보험 가입등 보안정책을 제시함으로써 컴퓨터범죄로부터 기업이 최대한의 안전성을 확보할 수 있는 경영전략의 틀을 제시했다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.4
• /
• pp.779-791
• /
• 2021

Common web services have been continuously targeted by hackers due to an access control policy that must be allowed to an unspecified number of people. In order to cope with this situation, companies regularly check web vulnerabilities and take measures according to the risk of discovered vulnerabilities. The risk of these web vulnerabilities is calculated through preliminary statistics and self-evaluation of domestic and foreign related organizations. However, unlike static diagnosis such as security setting and source code, web vulnerability check is performed through dynamic diagnosis. Even with the same vulnerability item, various attack results can be derived, and the degree of risk may vary depending on the subject of diagnosis and the environment. In this respect, the predefined risk level may be different from that of the actual vulnerability. In this paper, to improve this point, we present a web vulnerability risk assessment model based on the attack result centering on the cyber kill chain.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.2
• /
• pp.343-361
• /
• 2015

The financial industry in South Korea has witnessed a paradigm shift from selling traditional loan/deposit products to diversified consumption channels and financial products. Consequently, personification of financial services has accelerated and the value of finance-related personal information has risen rapidly. As seen in the 2014 card company information leakage incident, most of major finance-related information leakage incidents are caused by personnel with authorized access to certain data. Therefore, it is strongly required to confirm whether there are problems in the existing access control policy for personnel who can access a great deal of data, and to complement access control policy by considering risk factors of information security. In this paper, based on information of IT personnel with access to sensitive finance-related data such as job, position, sensitivity of accessible data and on a survey result, we will analyze influence factors for personnel risk measurement and apply data access control policy reflecting the analysis result to an actual case so as to introduce measures to minimize IT personnel risk in financial companies.

• Proceedings of the Korean Information Science Society Conference
• /
• 2007.10a
• /
• pp.118-119
• /
• 2007