• 정보처리학회논문지C
• /
• 제11C권4호
• /
• pp.485-496
• /
• 2004

광범위한 인터넷의 보급에 따라 컴퓨터 및 네트워크 시스템의 취약점을 이용한 해커들의 통신 웹을 경유한 공격이 쉽게 되었다. 본 논문에서는 통합 보안관리가 가능한 LISS(Linux-based Integrated Security System)라고 이름 붙여진 통합 보안 시스템을 설계하고 구현한다. 이 시스템은 공개 운영 체제인 Linux에 기반하고 있으며, Linux 기반 서버의 보안관리에 효과적인 공개 보안 도구들로 구성되어 있다. LISS의 성능을 시험하기 위하여 테스트베드를 구성하여 시험한 결과, 구현된 시스템이 네트워크 매퍼로부터 발생되는 모든 공격 패턴들을 포획하는 것으로 나타났다.

• Journal of Information Technology Applications and Management
• /
• 제22권2호
• /
• pp.171-199
• /
• 2015

This study proposes the practical information security measures that help IT personnel of banks comply the information security policy. The research model of the study is composed of independent variables (clarity and comprehensiveness of policy, penalty, dedicated security organization, audit, training and education program, and top management support), a dependent variable (information security policy compliance intention), and moderating variables (age and gender). Analyses results show that the information security measures except 'clarity of policy' and 'training and education program' are proven to affect the 'information security policy compliance intention.' In case of moderating variables, age moderated the relationship between top management support and compliance intention, but gender does not show any moderating effect at all. This study analyzes information security measures based solely on the perception of the respondents. Future study may introduce more objective measurement methods such as systematically analyzing the contents of the information security measures instead of asking the respondents' perception. In addition, this study analyzes intention of employees rather than the actual behavior. Future research may analyze the relationship between intention and actual behavior and the factors affecting the relationship.

• Asia pacific journal of information systems
• /
• 제21권3호
• /
• pp.51-69
• /
• 2011

Security has been considered one of the most critical issues for managing IT resources in many organizations. Despite a growing interest and extensive research on security at various levels, little research has focused on the comparison of security knowledge levels between different cultures. The current study investigates and compares the security knowledge level between Korea and the U.S. Based on the literature review of spyware, Hofstede's cultural dimensions, and security knowledge, this study identifies three constructs (i.e., security familiarity, spyware awareness, and spyware knowledge) to examine the difference of security knowledge levels between Korea and the U.S. Six hundred ninety-six respondents from Korea and the U.S. participated in the survey, and an in-depth analysis based on analysis of covariance (ANCOVA) was carried out. The results show that the levels of security familiarity, spyware awareness, and spyware knowledge are significantly lower in Korea than in the U.S., as expected. These findings present a significant association between national culture and security knowledge, and the degree of individualism (or collectivism) plays an especially critical role in the perception of security. A number of implications for academia and practitioners emerge. Limitations and future research directions are discussed in the conclusion.

• 한국산학기술학회논문지
• /
• 제10권8호
• /
• pp.1911-1919
• /
• 2009

현재의 정보보호시스템 위험 분석 수준 측정에 대한 시험 평가업무는 미국, 영국을 비롯한 선진국에서만 평가 기술을 확보하고 있으나, 국내의 경우 위험분석 수준측정을 위한 인프라와 평가기술이 부족한 실정이다. 따라서 본 논문에서는 정보보안 위험분석 수준 측정 기술 및 평가방법에 대해 연구하고 이를 이용하여 보안통제항목의 개발 및 이를 적용한 보안 수준 성능 평가 도구를 제시한다. 제시한 도구를 이용한 정보보호 시스템의 보안 관리 수준 분석을 통해 현 시스템과 보안 환경에 대한 보안 관리 수준을 평가할 수 있을 것으로 기대된다.

• International Journal of Advanced Culture Technology
• /
• 제11권4호
• /
• pp.34-41
• /
• 2023

The purpose of this paper is to consider the expansion of non-traditional security threats and the national-level response to the emergence of emerging security threats in ultra-uncertain VUCA situations. As a major research method for better analysis, the theoretical approach was referred to papers published in books and academic journals, and technical and current affairs data were studied through the Internet and literature research. The instability and uncertainty of the international order and security environment in the 21st century brought about a change in the security paradigm. Human security emerged as the protection target of security was expanded to individual humans, and emerging security was emerging as the security area expanded. Emerging security threatsthat have different characteristicsfrom traditionalsecurity threats are expressed in various ways, such as cyber threats, new infectious disease threats, terrorist threats, and abnormal climate threats. First, the policy and strategic response to respond to emerging security threats is integrated national crisis management based on artificial intelligence applying the concept of Foresight. Second, it is to establish network-based national crisis management smart governance. Third, it is to maintain the agile resilience of the concept of Agilience. Fourth, an integrated response system that integrates national power elements and national defense elements should be established.

• 디지털산업정보학회논문지
• /
• 제5권4호
• /
• pp.109-116
• /
• 2009

In the paper, we designed an automatic security diagnostic evaluation System(SeDES) based on a security diagnostic evaluation model(SeDEM) for an organization's security assurance. The SeDEM evaluates a security level of an organization quantitatively by a security evaluation formula which is composed of security variables and security index as applying the statistical CAEL model for evaluate risk level of banks. The SeDES has a good expandability as changing security variables according to an organization scale, characteristics and so on. And it also has a excellent usage because it inputs only numeric data got from statistical technique to security index. We can understand more a security level correctly than the existent risk assessment system because it is possible to assess quantitatively with an security grade as well as score. analysis.

• 정보보호학회논문지
• /
• 제22권6호
• /
• pp.1375-1391
• /
• 2012

스마트 그리드란 전력망에 정보통신기술을 적용하여 에너지 이용 효율을 극대화하는 차세대 지능형 전력망으로 최근 전 세계적으로 관련 기술 및 제도가 개발되고 있다. 정보보호는 스마트 그리드 개발에 필수적인 요소로써 지속적인 관리가 필요하다. 국내에서는 조직의 위험을 관리하기 위해 정보보호 관리체계 인증 제도가 이미 시행 중인 가운데 스마트 그리드에 적용할 수 있는 정보보호 관리체계 기준 마련의 필요성이 제기되고 있으나 구체적인 방법은 제시되지 않고 있다. 본 논문은 미국 스마트 그리드 제도와 비교 분석을 통해 기 시행중인 정보보호 관리체계 기반의 한국형 스마트 그리드를 위한 핵심 평가 기준과 추가적인 평가 기준을 제안한다. 기존의 정보보호 관리체계 인증을 받은 스마트 그리드 관련 사업자는 추가 평가 기준만으로 중복되고 불필요한 인증 평가 작업을 최소화할 수 있다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권1호
• /
• pp.240-263
• /
• 2021

One of the biggest challenges that the software industry is facing today is to create highly efficient applications without affecting the quality of healthcare system software. The demand for the provision of software with high quality protection has seen a rapid increase in the software business market. Moreover, it is worthless to offer extremely user-friendly software applications with no ideal security. Therefore a need to find optimal solutions and bridge the difference between accessibility and protection by offering accessible software services for defense has become an imminent prerequisite. Several research endeavours on usable security assessments have been performed to fill the gap between functionality and security. In this context, several Multi-Criteria Decision Making (MCDM) approaches have been implemented on different usability and security attributes so as to assess the usable-security of software systems. However, only a few specific studies are based on using the integrated approach of fuzzy Analytic Network Process (FANP) and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) technique for assessing the significant usable-security of hospital management software. Therefore, in this research study, the authors have employed an integrated methodology of fuzzy logic, ANP and TOPSIS to estimate the usable - security of Hospital Management System Software. For the intended objective, the study has taken into account 5 usable-security factors at first tier and 16 sub-factors at second tier with 6 hospital management system softwares as alternative solutions. To measure the weights of parameters and their relation with each other, Fuzzy ANP is implemented. Thereafter, Fuzzy TOPSIS methodology was employed and the rating of alternatives was calculated on the foundation of the proximity to the positive ideal solution.

• 정보보호학회논문지
• /
• 제32권6호
• /
• pp.1183-1192
• /
• 2022

정보 및 정보를 생산, 처리, 폐기하는 시스템은 정보의 총수명주기에 걸쳐 일정수준의 보안이 유지되어야 한다. 일정수준의 보안을 유지하기 위해 소프트웨어 및 자동차 개발, 미국 연방정부 정보체계 등 시스템 수명주기의 보안관리 프로세스를 적용하고 있으나, 우리나라에는 이와 유사한 보안관리 프로세스가 전무한 실정이다. 본 논문에서는 국방 분야 정보 및 정보 처리시스템의 총수명주기에 걸쳐 일정수준의 보안을 유지하기 위한 한국형 보안위험관리 프레임워크를 제안한다. 국방 분야에 적용할 수 있는 한국형 보안위험관리 프레임워크의 개발 목적과 적용방안을 소개함으로써 향후 국방 보안업무가 나가야 할 방향을 제시하고 보안 패러다임의 전환을 유도하고자 한다

• 디지털산업정보학회논문지
• /
• 제12권2호
• /
• pp.73-86
• /
• 2016

The purpose of this study is to examine a security investment for firms experienced in confidential information leak. Information security is an apparatus for protection of secret information. The competence of information security is a competitiveness to avoid information leakage in changing business environment. The type of information security is divided into administrative security, technical security and physical security. It is necessary to improve the incident correspondence competence through information security investment of the three types. Therefore, the investment of information security is to enhance information-asset protection of firms. To reinforce accident response competence, an organization discussed an establishment, security technology development, expand investment and legal system of the security system. I have studied empirically targeting the only information leak of firms. This data is a technical security competence and technology leakage situation of firms happened in 2010. During recovery of the DDos virus damage on countries, company and individual, the collected data signify a reality of information security. The data also identify a security competence of firms worrying information security management. According to the study, the continuous investment of information security has a high competence of accident correspondence. In addition, the most of security accidents showed a copy and stealing of paper and computer files. Firm on appropriate security investment is an accident correspondence competence higher than no security investment regardless of a large, small and medium-sized, and venture firm. Furthermore, the rational security investment should choose the three security type consideration for firm size.