• The Journal of the Korea institute of electronic communication sciences
• /
• v.9 no.2
• /
• pp.267-271
• /
• 2014

Nuclear power plant data networks and their associated safety systems are being modernized to include many information technology (IT) networks and applications. Along with the advancement of plant data networks (PDN), instrumentation and control systems are being upgraded with modern digital, microprocessor-based systems. However, nuclear PDN is confronted significant side-effects, which PDN is exposed to prevalent cyber threats typically found in IT environments. Therefore, cyber security vulnerabilities and possibilities of cyber incidents are dramatically increased in nuclear PDN. Consequently, it should be designed fully ensuring the PDN meet all reliability, performance and security requirements in order to overcome the disadvantages raised from adaption of IT technology. In this paper, we provide technical security criteria should be used in design and evaluation of secure PDN. It is believed PDN, which is designed and operated along with these technical security critera, effectively protect against possible outside cyber threats.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.5
• /
• pp.737-750
• /
• 2022

The demands of Unmanned Aerial Vehicles (UAVs) are growing very rapidly with the era of the 4th industrial revolution. As the technology of the UAV improved with the development of artificial intelligence and semiconductor technology, it began to be used in various civilian fields such as hobbies, bridge inspections, etc from being used for special purposes such as military use. MAVLink (Macro Air Vehicle Link), which started as an open source project, is the most widely used communication protocol between UAV and ground control station. However, MAVLink does not include any security features such as encryption/decryption mechanism, so it is vulnerable to various security threats. Therefore, in this study, the block cipher is implemented in UAV to ensure confidentiality, and the results of the encryption and decryption performance evaluation in the UAV according to various implementation methods are analyzed. In addition, we proposed the security requirements in accordance with Common Criteria, which is an international recognized ISO standard.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.5
• /
• pp.969-974
• /
• 2014

CC (Common Criteria) requires collecting vulnerability information and analyzing them by using penetration testing for evaluating IT security products. Under the time limited circumstance, developers cannot help but apply vulnerability analysis at random to the products. Without the systematic vulnerability analysis, it is inevitable to get the diverse vulnerability analysis results depending on competence in vulnerability analysis of developers. It causes that the security quality of the products are different despite of the same level of security assurance. It is even worse for the other IT products that are not obliged to get the CC evaluation to be applied the vulnerability analysis. This study describes not only how to apply vulnerability taxonomy to IT security vulnerability but also how to manage security quality of IT security products practically.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.109-113
• /
• 2007

With increasing the mont of processed information over the network, the importance of database system increases rapidly. There are two types of security system for database, access control and data encryption. However, it is hard to evaluate security of database systems using the Common Criteria(CC) as there is no protection profile(PP) for these systems. In this paper, we propose a protection profile for secure database systems which can be used in formal evaluation using the Common Criteria. The proposed protection profile can be used by both developer and consumer to evaluate security of database systems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.4
• /
• pp.61-74
• /
• 2007

In Common Criteria evaluation scheme, sponsor and evaluator should estimate evaluation cost and duration of IT security system evaluation in contracting the evaluation project. In this paper, We analyzed study result that achieve at 2003 and 2005, and utilized part of study result. And we empirically estimate relative evaluation effort ratios among evaluation assurance levels($EAL1{\sim}EAL7$) in CC v2.3 and CC v3.1. Also, we estimate the ratios from 'developer action elements', adjusted 'content and presentation of evidence elements', and 'evaluator action elements 'for each assurance component. We, especially, use ratio of amount of effort for each 'evaluator action elements', that was obtained from real evaluators in KISA in 2003. Our result will useful for TOE sponsor as well as evaluation project manager who should estimate evaluation cost and duration for a specific EAL and type of TOE, in a new CC v3.1 based evaluation schem.

• Convergence Security Journal
• /
• v.7 no.3
• /
• pp.25-30
• /
• 2007

CC ver.3 is widening evaluation range extent about Security product. As a result, The security product evaluation research need more definite standard that serves to evaluate composition style product. The paper propose a development guide for composition style TOE. This research is suitable in evaluation basis of CC ver.3, and presents Korean-made composition style product estimation plan. This paper used European ITSEM component guide and TOE analysis to present estimation guide method of composition style product.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.167-172
• /
• 2004

In the process of presenting the additional criteria, ISST, developed to evaluate teachers' capacity of applying information, suggests the criteria without considering teacher's own task. Information Ethics and Security Model is made up of two parts. In one part, it deals with four areas concerning with Information Ethics evaluation to measure the sensibility of Information Ethics of Information Teacher In another part, it is divided Information Security Evaluation into three areas which estimate technical method to secure the information system tying in the environment of information-oriented education.

• Convergence Security Journal
• /
• v.3 no.1
• /
• pp.23-30
• /
• 2003

As IT industries grow rapidly, many kinds of problems related to information security have gained force. Demands for information security products such as firewall, Intrusion Detection System have grown and the reliability and the safety of information security products is gathering strength. The evaluation for information security products is putting in operation, but developers have a difficulty in timely presenting their products due to long time for the evaluation. In this paper, we suggest the efficient elevation method for information security product by improving the development process in order to meet the assurance requirements of the Common Criteria.

• The Journal of the Korea Contents Association
• /
• v.10 no.6
• /
• pp.156-165
• /
• 2010

ESM(Enterprise Security Management) is representing domestic security management, and there is requirement to enhance it. This paper will evaluate quality of ESM products, understand its quality level, and derive method to improvement so as to develop security evaluation model and test methodology which can support quality enhancement. In addition, it presented the performance test cases and evaluation method to measure product's security quality, and to perform research on the judgement method for the results based on appropriate criteria. Developed quality evaluation model is expected perform important role in evaluating and enhancing the quality of intrusion prevention system.

• The Journal of the Korea Contents Association
• /
• v.13 no.4
• /
• pp.389-398
• /
• 2013

This study aims to support rational security investment decision making through prioritizing on operational level of management measures strategically, in carrying out industrial security activities. For this, AHP survey is conducted against industrial security professionals and analyzed. Thereafter, the importance and the priority of industrial security management measures are determined. As a result, in a comparison evaluation among the criteria, 'ICT service management' represents the highest weight (0.54). And the sub-criteria could be divided into three groups (Group I, II, III), depending on their importance. The sensitivity analysis results show that if the weight of the criterion, 'ICT systems/networks access control' is doubled, the sub-criteria, 'O/S access control', 'application access control', and 'wired/wireless network access control' are enter into top rank group. In case of the criterion, 'physical/environmental security' is doubled, the sub-criteria, 'protection zoning/access control' and 'disaster prevention on business equipment/counter-terrorism' are enter into the top rank group, 'securing utilities' is enter into the mid rank group.