• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.4
• /
• pp.187-194
• /
• 2008

This paper proposes an effective countermeasure to an intrinsic hardware vulnerability of the keyboard controller that causes sniffing problem on the password authentication system based on the keyboard input string. Through the vulnerability, some possible attacker is able to snoop whole the password string input from the keyboard even when any of the existing keyboard protection software is running. However, it will be impossible for attackers to gather the exact password strings if the proposed policy is applied to the authentication system though they can sniff the keyboard hardware protocol. It is expected that people can use secure Internet commerce after implementing and applying the proposed policy to the real environment.

• ETRI Journal
• /
• v.31 no.5
• /
• pp.554-564
• /
• 2009

In information security and network management, attacks based on vulnerabilities have grown in importance. Malicious attackers break into hosts using a variety of techniques. The most common method is to exploit known vulnerabilities. Although patches have long been available for vulnerabilities, system administrators have generally been reluctant to patch their hosts immediately because they perceive the patches to be annoying and complex. To solve these problems, we propose a security vulnerability evaluation and patch framework called PKG-VUL, which evaluates the software installed on hosts to decide whether the hosts are vulnerable and then applies patches to vulnerable hosts. All these operations are accomplished by the widely used simple network management protocol (SNMP). Therefore, system administrators can easily manage their vulnerable hosts through PKG-VUL included in the SNMP-based network management systems as a module. The evaluation results demonstrate the applicability of PKG-VUL and its performance in terms of devised criteria.

• The Journal of Information Technology
• /
• v.12 no.2
• /
• pp.1-12
• /
• 2009

China first started its mobile phone services in 1987, and the number of users has exponentially increased so that it reached 700 millions in January 2009. Currently China's 2G(GSM) users is 650 millions. These 2G (GSM) services have an advantage of the capability to use the mobile phone with a SIM (Subscriber Identity Modul) card, one kind of smart cards, inserted into it. However, due to the security vulnerability of SIM cards being used within China's 2G (GSM) services, SIM cards cloning. Problems concerning mobile phone surveillance towards a designated person by illegal cloning ESN and IMSI have recently risen to be a massive social issue within Korea as well. These studies have experimented the possibility of SIM cards clone in various mobile communication corporations using 2G (GSM) in China, and hence discovered the security vulnerability such as the incoming outgoing, SMS service and additional services on mobile phones using clone SIM cards.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.7 no.3
• /
• pp.117-128
• /
• 1997

When computer systems with mandatory access control mechanism are interconnected each other for enforcing the MHS(Message Handling System) security on the multilevel secure distributed network environment, illegal information flow may occurs due to the unexpected cascade vulnerability problem. In this paper, new MHS security policy and security property functions are proposed for preventing the cascade vulnerability.

• Journal of Digital Convergence
• /
• v.11 no.10
• /
• pp.31-45
• /
• 2013

The purpose of this study is to investigate the relationships among causes and effect of technostress creators and technostress creators. Rooted in the person-technology fit model, this research suggests cause of technostress creators such as system quality and system vulnerability. Furthermore, the research suggests outcome of technostress such as organizational commitment. The research found that system vulnerability has significant effects on the technostress creators. In addition, technostress creators influence significantly an organizational commitment. The conclusions and implications are discussed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.5
• /
• pp.131-139
• /
• 2007

Vulnerability analysis helps to remove discriminating vulnerabilities that exist in various equipment that composes operating information system. It is possible to explain representation and exclusion method about vulnerabilities of each equipment by vulnerability analysis. But it is difficult to display the weakness of whole information system. To do this, analyst synthesizes several information that achieved by vulnerability analysis. But the existing method does not provide fair evaluation because operators' personal opinion. In this paper, we explain about method that unites discriminatively vulnerable point and expresses whole weakness degree in numerical value by equipment, by system class, or by overall system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.6
• /
• pp.1449-1461
• /
• 2018

As the number of software vulnerabilities grows year by year, attacks on software are also taking place a lot. As a result, the security administrator must identify and patch vulnerabilities in the software. However, it is important to prioritize the patches because patches for all vulnerabilities are realistically hard. In this paper, we propose a scoring system that expands the scale of risk assessment metric by taking into consideration attack patterns or weaknesses cause vulnerabilities with the vulnerability information provided by the NIST(National Institute of Standards and Technology). The proposed scoring system is expanded based on the CWSS and uses only public vulnerability information to utilize easily for any company. In this paper, we applied the automated scoring system to software vulnerabilities, and showed the expanded metrics with consideration for influence of attack pattern and weakness are meaningful.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.135-141
• /
• 2020

The Ministry of National Defense is strengthening the power and capacity of cyber operations as cyber protection training is conducted. However, considering the level of enemy cyber attack capability, the level of cyber defense capability of the ministry of national defense is significantly low and the protection measures and response system for responding to cyber threats to military networks are not clearly designed, falling short of the level of cyber security capabilities of the public and private sectors. Therefore, this paper is to investigate and verify the establishment of a military internal network vulnerability mitigation system that applies the intention of attackers, tactics, techniques and procedures information (ATT&CK Framework), identified military internal network main threat information, and military information system security requirements with military specificity as factors that can establish a defense network vulnerability mitigation system by referring to the domestic and foreign cyber security framework It has the advantage of having.

• Journal of the Society of Naval Architects of Korea
• /
• v.48 no.5
• /
• pp.404-413
• /
• 2011

It is important to assess and improve the warship survivability for the weapon threats which have a critical effect on warship. The survivability of the warship is defined as the capability of a warship to avoid or withstand a man-made hostile environment. The survivability of the warship consists of three categories (Susceptibility, Vulnerability and Recoverability). Firstly, the susceptibility is defined as the inability of a warship to avoid radars, guns, missiles and etc. Secondly, the vulnerability is defined as the inability of a warship to withstand the man-made hostile environment. Finally, the recoverability is defined as the ability of a warship to recover the damaged components and systems. Among them, this paper has described the vulnerability assessment for the hypothetical system which is composed of critical components. Also, the procedure which is suggested to calculate the vulnerable probability of the damaged warship is based on the Vulnerable Area Method.

• Journal of Korea Multimedia Society
• /
• v.18 no.2
• /
• pp.199-206
• /
• 2015

Since security vulnerabilities newly discovered in a popular Web browser immediately put a number of users at risk, urgent attention from developers is required to address those vulnerabilities. Analysis of characteristics in the Web browser vulnerabilities can be used to assess security risks and to determine the resources needed to develop patches quickly to handle vulnerabilities discovered. So far, being a new research area, the quantitative aspects of the Web browser vulnerabilities and risk assessments have not been fully investigated. However, due to the importance of Web browser software systems, further detailed studies are required related to the Web browser risk assessment, using rigorous analysis of actual data which can assist decision makers to maximize the returns on their security related efforts. In this paper, quantitative software vulnerability analysis has been presented for major Web browsers with respect to the Common Vulnerability Scoring System. Further, vulnerability discovery trends in the Web browsers are also investigated. The results show that, almost all the time, vulnerabilities are compromised from remote networks with no authentication required systems. It is also found that a vulnerability discovery model which was originally introduced for operating systems is also applicable to the Web browsers.