• The KIPS Transactions:PartD
• /
• v.10D no.5
• /
• pp.773-780
• /
• 2003

SecuROS(Secure & Reliable Operating System) prevents and blocks possible system cracking by implementing additional security functions in FreeBSD 4.3 operating system (OS) kernel, including access control, user authentication, audit trail, encryption file system and trusted channel. This paper describes access control technique, which is one of core technologies of SecuROS, introduces the implementations of DAC, MAC and RBAC, all of which are corresponding access control policies, and show security and results of performance measurement on the basis of application of access control policies. Finally, security and performance between conventional OS environment and environment adopting access control policy is described.

• Convergence Security Journal
• /
• v.7 no.4
• /
• pp.15-21
• /
• 2007

As the amount of flash memory being used in embedded device is increased and embedded devices become more important in many computing environments, embedded file system security becomes more important issue. Moreover embedded devices can be easily stolen or lost because of it's high portability. If the lost embedded device has very important information, there's no means to protect it except data encryption. For improving embedded devices' security this paper propose design and implementation of flash cryptographic file system. For this purpose YAFFS is used. By the modified YAFFS cryptographic file system, the security of embedded devices can be improved.

• Informatization Policy
• /
• v.23 no.1
• /
• pp.20-37
• /
• 2016

As the numbers of various cyber-crimes have sharply increased, the importance of securing information has also been emphasized. Despite the government's constant efforts to solve the issue, they hardly work in practice, and cases related to information security are still on the rise. This study investigates the reasons for the discrepancy that occurs when a solution is put to action. The research analyzes the recent shift in the administrative system with regard to information security and officials' awareness of the shift, focusing on members of local government. The results of the study confirm a steady attempt including changes in institutions at the level of the central government. However, there is still a lack of personnel and budget support at the local government level as well as not much change in the awareness of information security.

• Journal of Information Management
• /
• v.36 no.1
• /
• pp.125-154
• /
• 2005

Due to the development of Internet and the collection and usage of the individual information, the infringements of the personal data have been increased rapidly. Regarding the personal data protection in the medical industry, it is clearly described in 'Act on Promotion of Information and Communication Network Utilization and information Protection, etc.'. the law is ratified on the basis of the service provider, therefore, it has its own limitation to be applied to medical industry. Therefore, this paper is to set the security standard and to discuss the range of legal application and considerations on its basis for the domestic medical institution at the electronic medical record system. We exemplify specific applicable content of the electronic signature in the electronic medical record also, present a security assessment item in electronic medical system and set the criteria for the security standard in the medical industry.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.149-164
• /
• 2019

Digital Transformation and the Fourth Industrial Revolution, electronic financial services should be provided safely in accordance with rapidly changing technology changes in the times of change. However, telecommunication finance fraud (voice phishing) accidents are currently ongoing, and various efforts are being made to eradicate accidents such as legal amendment and improvement of policy system in order to cope with continuous increase, intelligence and advancement of accidents. In addition, financial institutions are trying to prevent fraudulent accidents by improving and upgrading the abnormal financial transaction detection system, but the results are not very clear. Despite these efforts, telecommunications and financial fraud incidents have evolved to evolve against countermeasures. In this paper, we propose an intelligent over - the - counter financial transaction system modeled through scenario - based Rule model and artificial intelligence algorithm to prevent financial transaction accidents by voice phishing. We propose an implementation model of artificial intelligence abnormal financial transaction detection system and an optimized countermeasure model that can block and respond to analysis and detection results.

• Nuclear Engineering and Technology
• /
• v.45 no.5
• /
• pp.637-652
• /
• 2013

Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security.. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system.

• Convergence Security Journal
• /
• v.5 no.2
• /
• pp.57-63
• /
• 2005

According to rapid development of computer and wired-wireless internet, information exchange of networking is growing. Also according as size of industry related e-commerce is bigger, it is Required the necessity of convenient user authentication system. So, the study of new authentication method to have a security and convenience is progressing systematically. Smart card of new authentication method overcome problem of established scheme. So it prospect that will be replaced One Card to have a high security and multi-function. In this papar, we suggest about the implementation of One Card System that the security of smart card and usable in all fields.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.125-134
• /
• 2020

The potential security threat is increasing as the supply of ICT products to the defense sector increases with the development of information and communication technology. Attempts to neutralize, such as intelligence gathering and destruction, through attacks on the defense power support system and the intelligence system of the weapons system could pose a fatal threat.Therefore, security measures of supply chain shear system that take into account ICT product production and operation stage to maintenance stage are needed in defense field. In the paper, technical and administrative measures for responding to 12 ICT supply chain security threats at each stage of the defense ICT supply chain life cycle were presented.

• Journal of KIISE:Databases
• /
• v.31 no.1
• /
• pp.1-12
• /
• 2004

As network systems are developed rapidly and network architectures are more complex than before, it needs to use PBNM(Policy-Based Network Management) in network system. Generally, architecture of the PBNM consists of two hierarchical layers: management layer and enforcement layer. A security policy server in the management layer should be able to generate new policy, delete, update the existing policy and decide the policy when security policy is requested. And the security policy server should be able to analyze and manage the alert messages received from Policy enforcement system in the enforcement layer for the available information. In this paper, we propose an alert analyzer using data mining. First, in the framework of the policy-based network security management, we design and implement an alert analyzes that analyzes alert data stored in DBMS. The alert analyzer is a helpful system to manage the fault users or hosts. Second, we implement a data mining system for analyzing alert data. The implemented mining system can support alert analyzer and the high level analyzer efficiently for the security policy management. Finally, the proposed system is evaluated with performance parameter, and is able to find out new alert sequences and similar alert patterns.

• Journal of Convergence for Information Technology
• /
• v.11 no.7
• /
• pp.7-13
• /
• 2021

Recently, due to the many features and advantages of cloud computing, cloud service is being introduced to countless industries around the world at an unbelievably rapid pace. With the rapid increase in the introduction of multi-cloud based services, security vulnerabilities are increasing, and the risk of data leakage from cloud computing services are also expected to increase. Therefore, this study will propose an AWS Well-Architected based security architecture configuration method such as AWS standard security architecture, AWS shared security architecture model that can be applied for personal information security including cost effective of cloud services for better security in AWS cloud service. The AWS security architecture proposed in this study are expected to help many businesses and institutions that are hoping to establish a safe and reliable AWS cloud system.