• Korean Security Journal
• /
• no.56
• /
• pp.165-185
• /
• 2018

Because financial industry is closely related to the daily lives of people, internal fraud such as embezzlement by the employees can cause serious damage to the national economy, including credit crunch and contagious bankruptcy, as once demonstrated in the Savings Bank Scandal in 2011. Therefore, the importance of financial industry security is being emphasized and developed into converged security that combines physical, human and cyber security. In this study, to prevent fraud caused by internal employees in Korean financial sector, in-depth semi-structured interviews were conducted with a total of 16 participants including bankers, officials of financial regulators, and security experts, who were in charge of risk management in the industry. The collected data were analyzed at three stratification levels such as individual, organization, and socio-cultural factor. Based on this analysis, policy recommendations were suggested for the development of financial industry security and reducing internal fraud in banking institutions.

• Proceedings of the Korea Society of Information Technology Applications Conference
• /
• 2005.11a
• /
• pp.259-262
• /
• 2005

This paper addresses the problem of protecting security policies in security mechanisms, such as the detection policy of an Intrusion Detection System. Unauthorized disclosure of such information might reveal the fundamental principles and methods for the protection of the whole network. In order to avoid this risk, we suggest two schemes for protecting security policies in Snort using the symmetric cryptosystem, Triple-DES.

• Ocean Systems Engineering
• /
• v.4 no.2
• /
• pp.137-150
• /
• 2014

In the marine industry although there has been significant growth towards safety, security and risk assessments or risk-based strategies such as marine insurance and regulations to avoid the risks of damage to properties and the environment or the prospect of premature death caused by accidents etc, the moves toward managing the risks which are linked directly to the business functions and decision making processes have been very slow. Furthermore in the marine industry most perceptions, methodologies and frameworks of dealing with hazards, risks, safety and security issues are for their assessment rather than their management. This trend reveals the fact that in different marine industry sectors such as logistics and shipping there is a lack of coherent risk management framework or methodology from which to understand the risk-based decisions especially for the purpose of design, construction, operation, management and even decommissioning of the marine related applications. On the other hand risk management is not yet viewed holistically in the marine industry in order to, for example, assign a right person, i.e. risk manager, who can act as a coordinator and advisor with responsibilities that are only specific to risk management. As a result this paper, by examining the present physical borders and risk-based activities in the marine industry, aims to propose an appropriate risk management methodology in addition to the emergent role of risk managers which will enable the industry users initially to become familiar with the concept of risk management at its holistic level. In the later stages this eventually can lead to development of risk management capabilities at an exclusive level and its integration into the marine industry functions in future.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.9
• /
• pp.143-150
• /
• 2020

The purpose of this study is to investigate the human error of bodyguards caused in the process of performing access control activities between security missions, focusing on multiple risk cases, and to suggest countermeasures accordingly. To verify this, after arranging the sequence of events in a time series, the VTA technique and Why-Why analysis technique that can easily identify the problem centered on the variable node were used. In addition, environmental factors and personal factors that cause human errors were extracted through M-SHEL Metrix. As a result of analyzing multiple risk cases through such a method, the security environment factors that cause access control accidents include lack of time (impatience), prejudice against visitors, intensive work methods, lack of security management, unattended travel, and familiar atmosphere. (Relaxation), formal work activities, convenience provision, and underestimation were surveyed. In addition, human errors caused by personal security guards were investigated as low alertness, formal work, negligence of inspection, and comfortable coping.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2008.10a
• /
• pp.261-264
• /
• 2008

IPv6 has been proposed and deployed to cater the shortage of IPv4 addresses. It is expected to foresee mobile phones, pocket PCs, home devices and any other kind of network capable devices to be connected to the Internet with the introduction and deployment of IPv6. This scenario will bring in more challenges to the existing network infrastructure especially in the network security area. Firewalls are the simplest and the most basic form of protection to ensure network security. Nowadays, firewalls' usage has been extended from not only to protect the whole network but also appear as software firewalls to protect each network devices. IPv6 and IPv4 are not interoperable as there are separate networking stacks for each protocol. Therefore, the existing states of the art in firewalling need to be reengineered. In our context here, we pay attention only to the IPv6 firewalls configuration anomalies without considering other factors. Pre-evaluation of security risk is important in any organization especially a large scale network deployment where an add on rules to the firewall may affect the up and running network. We proposed a new probabilistic based model to evaluate the security risks based on examining the existing firewall rules. Hence, the network administrators can pre-evaluate the possible risk incurred in their current network security implementation in the IPv6 network. The outcome from our proposed pre-evaluation model will be the possibilities in percentage that the IPv6 firewall is configured wrongly or insecurely where known attacks such as DoS attack, Probation attack, Renumbering attack and etc can be launched easily. Besides that, we suggest and recommend few important rules set that should be included in configuring IPv6 firewall rules.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.6
• /
• pp.1189-1206
• /
• 2020

Recently, ICT companies do not directly design, develop, produce, operate, maintain, and dispose of products and services, but are outsourced or outsourced companies are increasingly in charge. Attacks arising from this are also increasing due to difficulties in managing vulnerabilities for products and services in the process of consignment and re-consignment. In order to respond to this, standards and systems for security risk management of ICT supply chain are being established and operated overseas, and various case studies are being conducted. In addition, research is being conducted to solve supply chain security problems such as Software Bill of Materials (SBOM). International standardization organizations such as ISO have also established standards and frameworks for security of ICT supply chain. In this paper, we presents ICT supply chain security management items suitable for domestic situation by comparing and analyzing ICT supply chain security standards and systems developed as international standards with major countries such as the United States and EU, and explains the necessity of cyber security framework for establishing ICT supply chain security system.

• Asia pacific journal of information systems
• /
• v.21 no.4
• /
• pp.27-43
• /
• 2011

This article explores economic models that show the optimal level of information security investment in the presence of interdependent security risks, Using particular functional forms, the analysis shows that the relationship between the levels of security vulnerability and the levels of optimal security investments is affected by externalities caused by agents' correlated security risks. This article further illustrates that, compared to security investments in the situation of independent security risks, in order to maximize the expected benefits from security investments, an agent should invest a larger fraction of the expected loss from a security breach in the case of negative externalities, while an agent should spend a smaller fraction of the expected loss in the case of negative externalities.

• Journal of Korean Society of societal Security
• /
• v.1 no.3
• /
• pp.69-76
• /
• 2008

The object of this study is to develop a tool for quantifying risks related to the rail transportation of hazardous commodities and to present mitigation measures. In this study, the Quantitative Risk Assessment (QRA) is used as a risk analysis tool. Based on the previous explosion history (Iri explosion) and consideration of its high risk, Iksan-si is selected as a model city. The result, expressed as average individual risk for exposed people with various distance, indicates that the model city is considered to be safe according to the nuclear energy standard. Also, the mitigation measures are provided since Societal risk of Iksan-si is set within ALARP. Risk reduction measures include rail car design, rail transportation operation, demage spread control as well as derail prevention and alternative routes for reducing accident frequencies. Finally, it is expected to achieve high level of public safety by appling the risk reduction measures.

• Journal of Korean Society of Disaster and Security
• /
• v.10 no.2
• /
• pp.35-41
• /
• 2017

Recently chemical intoxication related with the use of chemical extinguishing agents occurs frequently. With the industrialization, high-rising of building and increase of fire risk, we use the various extinguishing agents and the safe use become important. In this study I carried out the risk assessment of representative chemical extinguishing agents (HCFC-123, HFC-125) using the CHARM and got the meaningful qualitative outcome. This study is significant in that the risk assessment of chemicals was conducted using CHARM, chemical risk assessment tool. It is expected that the results will be utilized as the basic data for the national chemical safety management.

• Journal of Platform Technology
• /
• v.9 no.2
• /
• pp.10-25
• /
• 2021

Although many studies have been conducted on risk analysis and evaluation in the on-premises environment in information security, studies on effective methodologies of risk analysis and evaluation for cloud computing systems are lacking. In 2015, the Cloud Computing Development Act was enacted, which served as an opportunity to promote the introduction of cloud computing. However, due to the increase in security incidents in the cloud computing system, activation is insufficient. In addition, the cloud computing system is not being actively introduced because of the difficulty in understanding the cloud computing system technology of the person in charge who intends to introduce the cloud computing system. In this regard, this study presented an effective risk analysis and evaluation method by examining the characteristics, concepts, and models of cloud computing systems and analyzing how these characteristics affect risk analysis and evaluation.