• Nuclear Engineering and Technology
• /
• v.53 no.3
• /
• pp.879-887
• /
• 2021

The nuclear supply chain attack surface is a large, complex network of interconnected stakeholders and activities. The global economy has widened and deepened the supply chain, resulting in larger numbers of geographically dispersed locations and increased difficulty ensuring the authenticity and security of critical digital assets. Although the nuclear industry has made significant strides in securing facilities from cyber-attacks, the supply chain remains vulnerable. This paper discusses supply chain threats and vulnerabilities that are often overlooked in nuclear cyber supply chain risk analysis. A novel supply chain cyber-attack surface diagram is provided to assist with enumeration of risks and to examine the complex issues surrounding the requirements for securing hardware, firmware, software, and system information throughout the entire supply chain lifecycle. This supply chain cyber-attack surface diagram provides a dashboard that security practitioners and researchers can use to identify gaps in current cyber supply chain practices and develop new risk-informed, cyber supply chain tools and processes.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1089-1097
• /
• 2019

An era of smart manufacturing is coming through the rapid development of information and communication technology. As a result, many companies have begun to utilize a variety of hardware and software for the efficient business of the manufacturing process. At this time, the hardware and software used are supplied through manufacturing and distribution processes. These supply processes are exposed to a variety of security threats. As the recent cases of supply chain attacks have increased, foreign countries are establishing supply chain management systems and managing supply chain risks. In Korea, on the other hand, there was research on supply chain risk management in some fields. In this paper, we emphasizes the necessity of supply chain risk management through supply chain attack cases. In addition, we analyze trends of foreign supply chain management system and explains the necessity of domestic supply chain security strategy.

• Management & Information Systems Review
• /
• v.27
• /
• pp.149-172
• /
• 2008

Since the 9/11 terror attack, the event which caused supply chain disruption, supply chain security has becomes more important than ever before. Furthermore, such company's logistics strategies conflicting supply chain security as increased global sourcing, JIT manufacturing are increasing supply chain vulnerability. It could burden for global companies to strengthen supply chain security because not only it requires additional investment cost but also changes of companiy's global logistics strategy. However, on the other hand, supply chain visibility and resilience can be improved through supply chain security. In addition, it allows companies to stabilize supply chain structure as well as rapid and flexible response to market demand. The key issue is balancing between efficiency and supply chain security. To do this, identifying risk elements under the supply chain and assessing vulnerability of each supply chain components should be performed before developing efficient supply chain security management system without obstructing supply chain efficiency.

• Journal of Korea Multimedia Society
• /
• v.18 no.12
• /
• pp.1483-1491
• /
• 2015

Applications of Internet of Things (IoT) supply various conveniences, however unsolved security problems such as personal privacy, data manipulation cause harm to persons, even nations and an limit the applicable areas of Internet of IoT technology. Therefore, study about secure and efficient security system on IoT are required. This paper proposes ID-based remote user authentication scheme in IoT environments. Proposed scheme provides untraceability of users by using different pseudonym identities in every session and reduces the number of variables. Our proposal is secure against inside attack, smart card loss attack, user impersonation attack, server masquerading attack, online/offline password guessing attack, and so on. Therefore, this can be applied to the lightweight IoT environments.

• Convergence Security Journal
• /
• v.22 no.3
• /
• pp.13-18
• /
• 2022

With the rapid development of IT technology, integration with existing industries has led to an increase in smart manufacturing that simplifies processes and increases productivity based on 4th industrial revolution technology. Security threats are also increasing and there are. In the case of supply chain attacks, it is difficult to detect them in advance and the scale of the damage is extremely large, so they have emerged as next-generation security threats, and research into detection technology is necessary. Therefore, in this paper, we collect, store, analyze, and visualize logs in multiple environments in real time using ELK Stack and Sysmon, which are open source-based analysis solutions, to derive information such as abnormal behavior related to supply chain attacks, and efficiently We try to provide an effective detection method.

• Electronics and Telecommunications Trends
• /
• v.35 no.4
• /
• pp.149-157
• /
• 2020

Security threats in supply-chains can be targeted at all the users who use products related to these supply-chains as well as at single equipment or individuals. This implies that these security threats can cause nationwide economic and social damages. In particular, it is true that hardware security threat analysis technology in supply-chains has significant technical barriers due to the lack of software knowledge as well as the need to study and understand undisclosed hardware designs. In this paper, we discuss the future direction of studies by introducing basic concepts and attack cases, along with domestic and foreign technology trends related to supply-chain security technology.

• The Journal of Information Systems
• /
• v.29 no.2
• /
• pp.221-242
• /
• 2020

Purpose This study collects data of the recently activated online black market and analyzes it to present a specific method for preparing for a hacking attack. This study aims to make safe from the cyber attacks, including hacking, from the perspective of individuals and businesses by closely analyzing hacking methods and tools in a situation where they are easily shared. Design/methodology/approach To prepare for the hacking attack through the online black market, this study uses the routine activity theory to identify the opportunity factors of the hacking attack. Based on this, text mining and social network techniques are applied to reveal the most dangerous areas of security. It finds out suitable targets in routine activity theory through text mining techniques and motivated offenders through social network analysis. Lastly, the absence of guardians and the parts required by guardians are extracted using both analysis techniques simultaneously. Findings As a result of text mining, there was a large supply of hacking gift cards, and the demand to attack sites such as Amazon and Netflix was very high. In addition, interest in accounts and combos was in high demand and supply. As a result of social network analysis, users who actively share hacking information and tools can be identified. When these two analyzes were synthesized, it was found that specialized managers are required in the areas of proxy, maker and many managers are required for the buyer network, and skilled managers are required for the seller network.

• Electronics and Telecommunications Trends
• /
• v.36 no.6
• /
• pp.78-87
• /
• 2021

Information technology (IT) has been applied to various fields, and currently, IT devices and systems are used in very important areas, such as aviation, industry, and national defense. Such devices and systems are subject to various types of malicious attacks, which can be software or hardware based. Compared to software-based attacks, hardware-based attacks are known to be much more difficult to detect. A hardware Trojan horse is a representative example of hardware-based attacks. A hardware Trojan horse attack inserts a circuit into an IC chip. The inserted circuit performs malicious actions, such as causing a system malfunction or leaking important information. This has increased the potential for attack in the current supply chain environment, which is jointly developed by various companies. In this paper, we discuss the future direction of research by introducing attack cases, the characteristics of hardware Trojan horses, and countermeasure trends.

• THE INTERNATIONAL COMMERCE & LAW REVIEW
• /
• v.54
• /
• pp.45-80
• /
• 2012

Since the 9.11 terror attack, the event which caused supply chain disruption, supply chain security has become more important than ever before. With this as a momentum, a customs supply chain security paradigm emerged intended to guarantee secure flow of cargo across boarder. Under this circumstances Incoterms(R) 2010 rules have allocated obligations between the buyer and seller to obtain or to render assistances in obtaining security clearances. Thus, security related obligations such as providing advance manifest information is the mandatory requirements for any export and import. The impact on the seller and buyer of security related obligations under the Incoterms(R) 2010 rules environment is obvious. Assistance to provide the security information in advance has become indispensable obligations to the seller and buyer. As such assistances is at the cost and risk of the party responsible for the clearances of the goods, the choice of recognised partner and compliance with the relevant security program, in order to enjoy the relevant benefits, becomes paramount.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.3
• /
• pp.371-381
• /
• 2013

An encryption algorithm is executed to supply data confidentiality using a secret key which is embedded in a crypto device. However, the fault injection attack has been developed to extract the secret key by injecting errors during the encryption processes. Especially, an attacker can find the secret key of block cipher ARIA using about 33 faulty outputs. In this paper, we proposed a countermeasure resistant to the these fault injection attacks by checking the difference value between input and output informations. Using computer simulation, we also verified that the proposed countermeasure has excellent fault detection rate and negligible computational overhead.