KIPS Transactions on Computer and Communication Systems (정보처리학회논문지:컴퓨터 및 통신 시스템)

Korea Information Processing Society (한국정보처리학회)
권호 표지
DOI QR코드

DOI QR Code

Improvement of ISMS Certification Components for Virtual Asset Services: Focusing on CCSS Certification Comparison

안전한 가상자산 서비스를 위한 ISMS 인증항목 개선에 관한 연구: CCSS 인증제도 비교를 중심으로

  • 김은지 (성균관대학교 정보보안학과) ;
  • 구자환 (성균관대학교 소프트웨어융합대학) ;
  • 김응모 (성균관대학교 소프트웨어융합대학)
  • Received : 2022.04.05
  • Accepted : 2022.04.22
  • Published : 2022.08.31
Download PDF
⟨ Previous Next ⟩

Abstract

Since the advent of Bitcoin, various virtual assets have been actively traded through virtual asset services of virtual asset exchanges. Recently, security accidents have frequently occurred in virtual asset exchanges, so the government is obligated to obtain information security management system (ISMS) certification to strengthen information protection of virtual asset exchanges, and 56 additional specialized items have been established. In this paper, we compared the domain importance of ISMS and CryptoCurrency Security Standard (CCSS) which is a set of requirements for all information systems that make use of cryptocurrencies, and analyzed the results after mapping them to gain insight into the characteristics of each certification system. Improvements for 4 items of High Level were derived by classifying the priorities for improvement items into 3 stages: High, Medium, and Low. These results can provide priority for virtual asset and information system security, support method and systematic decision-making on improvement of certified items, and contribute to vitalization of virtual asset transactions by enhancing the reliability and safety of virtual asset services.

비트코인이 등장한 이후, 다양한 가상자산이 가상자산 거래소의 가상자산 서비스를 통해 활발하게 거래되고 있다. 최근 가상자산거래소에 대한 보안사고가 자주 발생하고 있어 정부는 가상자산 거래소의 정보보호 강화를 위해 Information Security Management System (ISMS) 인증획득을 의무화하고 있으며, 이를 위한 56개 특화항목을 추가로 제정하였다. 본 논문에서는 ISMS와 암호화폐를 이용하는 모든 정보시스템에 대한 요구사항을 담고있는 CryptoCurrency Security Standard (CCSS)의 도메인 중요도를 비교하고 상호매핑을 한 후 그 결과를 분석하여 각 인증제도의 특성을 통찰하였으며, 도출된 개선항목의 중요도 평가를 통해 개선항목에 대한 우선순위를 High, Medium, Low 등 3단계로 분류하여 High Level 4가지 항목에 대한 개선사항들을 도출하였다. 이러한 결과는 가상자산 및 정보시스템 보안에 대한 우선순위를 제공하고 인증항목 개선에 대한 방법 및 체계적인 의사결정을 지원할 수 있을 뿐만 아니라 가상자산서비스에 대한 신뢰성 및 안전성을 제고하여 가상자산 거래 활성화에 기여할 수 있을 것으로 보인다.

Keywords

References

  1. S. Nakamoto, "A peer-to-peer electronic cash system," Decentralized Business Review, pp.21260, 2008.
  2. Y. S. Chung and J. S. Cha, "The security risk and countermeasures of blockchain based virtual currency trading," The Journal of Korea Institute of Information, Electronics, and Communication Technology, Vol.11, No.1, pp.100-106, 2018. https://doi.org/10.17661/jkiiect.2018.11.1.100
  3. Hedgewithcrypto, Cryptocurrency Exchange Hacks (Up-dated 2022 List) [Internet], https://www.hedgewithcrypto.com/cryptocurrency-exchange-hacks/.
  4. Strategy and Finance Committee, "Analysis of government audit issues," National Policy Committee, Vol.4, 2020.
  5. K. Grobys, "When the blockchain does not block: On hackings and uncertainty in the cryptocurrency market," Quantitative Finance, Vol.21, Iss.8, pp.1267-1279, 2021. https://doi.org/10.1080/14697688.2020.1849779
  6. L. Konig, S. Unger, P. Kieseberg, and S. Tjoa, "The risks of the blockchain a review on current vulnerabilities and attacks," Journal of Internet Services and Information Security, Vol.10, Iss.3, pp.110-127, 2020. https://doi.org/10.22667/JISIS.2020.08.31.110
  7. Y. Maleh, M. Shojafar, M. Alazab, and I. Romdhani, "Blockchain for cybersecurity and privacy: Architectures, challenges, and applications," Eds., CRC Press, 2020.
  8. J. H. Lee, "Systematic approach to analyzing security and vulnerabilities of blockchain systems," Massachusetts Institute of Technology, Diss, 2019.
  9. B. Y. Kim, "Positions and responses of major countries on cryptocurrency," in Capital Market Focus, Korea Capital Market Institute, Vol.25, 2017.
  10. R. Zhang, R. Xue, and L. Liu, "Security and privacy on blockchain," ACM Computing Surveys (CSUR), Vol.52, Iss.3, pp.1-34, 2019.
  11. N. Amiet, "Blockchain vulnerabilities in practice," Digital Threats: Research and Practice, Vol.2, Iss.2, pp.1-7, 2021. https://doi.org/10.1145/3407230
  12. A. Mense and M. Flatscher, "Security vulnerabilities in ethereum smart contracts," Proceedings of the 20th International Conference on Information Integration and Web-based Applications & Services, pp.375-380, 2018.
  13. H. Poston, "Mapping the OWASP top ten to blockchain," Procedia Computer Science, Vol.177, pp.613-617, 2020. https://doi.org/10.1016/j.procs.2020.10.087
  14. M. Al. Ketbi, K. Shuaib, E. Barka, and M. Gergely, "Es-tablishing a security control framework for blockchain technology," Interdisciplinary Journal of Information, Knowledge, and Management, Vol.16, pp.307, 2021.
  15. J. Bucko, D. Palova, and M. Vejacka, "Security and trust in cryptocurrencies," Central European Conference in Finance and Economics, pp.14-24, 2015.
  16. G. Bello and A. J. Perez, "Adapting financial technology standards to blockchain platforms," Proceedings of the 2019 ACM Southeast Conference, pp.109-116, 2019.
  17. T. Hardjono, A. Lipton, and A. Pentland, "A contract service provider model for virtual assets," The Journal of FinTech, Vol.1, No.2, Iss.2150004, 2022.
  18. V. Tumas, R. Norvill, D. Magoni, and R. State, "VaVite: Verifiable information exchange for virtual asset service providers," 2020 Principles, Systems and Applications of IP Telecommunications (IPTComm), pp.1-8, 2020.
  19. T. Hardjono, A. Lipton, and A. Pentland, "Privacy-preserving claims exchange networks for virtual asset service providers," 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.1-8, 2020.
  20. T. Hardjono, A. Lipton, and A. Pentland, "Toward a public-key management framework for virtual assets and virtual asset service providers," The Journal of FinTech, Vol.1, No.1, Iss.2050001, 2021.
  21. T. Hardjono, "Future directions for regulated private wallets and VASP trust infrastructures," 2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.1-3, 2021.
  22. T. Hardjono, "Attestation infrastructures for private wallets," arXiv preprint arXiv:2102.12473, 2021.
  23. G. Soana, "Regulating cryptocurrencies checkpoints: Fighting a trench war with cavalry?," Economic Notes, Vol.51, No.1, 2022.
  24. CoinMarketCap, All Cryptocurrencies [Internet], https://coinmarketcap.com/all/views/all/.
  25. CoinMarketCap, Bitcoin [Internet], https://coinmarket-cap.com/currencies/bitcoin/.
  26. C. Decker and R. Wattenhofer, "Bitcoin transaction malle-ability and MtGox," In European Symposium on Research in Computer Security, Springer, Cham, pp.313-326, 2014.
  27. Y. Tsuchiya and N. Hiramoto, "How cryptocurrency is laundered: Case study of Coincheck hacking incident," Forensic Science International: Reports, Vol.4, Iss.100241, 2021.
  28. CoinMarketCap, Top Cryptocurrency Spot Exchanges [Internet], https://coinmarketcap.com/rankings/exchanges/
  29. I. S. Choi, "A study on the regulation of risks associated with the use of virtual currencies," Ph.D. dissertation, Yonsei University Law School, Seoul, Republic of Korea, 2019.
  30. Korea Internet & Security Agency, Introduction of the certification system [Internet], https://isms.kisa.or.kr/main/isms/intro/.
  31. Korea Ministry of Government Legislation, Act on Promotion of Information and Communications Network Utilization and Information Protection, [Internet], https://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EC%A0%95%EB%B3%B4%ED%86%B5%EC%8B%A0%EB%A7%9D%EC%9D%B4%EC%9A%A9%EC%B4%89%EC%A7%84%EB%B0%8F%EC%A0%95%EB%B3%B4%EB%B3%B4%ED%98%B8%EB%93%B1%EC%97%90%EA%B4%80%ED%95%9C%EB%B2%95%EB%A5%A0/(20211209,18201,20210608)/%EC%A0%9C47%EC%A1%B0.
  32. Korea Internet & Security Agency, Announcement of detailed inspection items for ISMS for virtual asset business [Internet], https://isms.kisa.or.kr/main/ispims/notice/?boardId=bbs_0000000000000014&mode=view&cntId=12.
  33. CryptoCurrencyCertificationConsortium, Crpto Currency Security Standard [Internet], https://cryptoconsortium.github.io/CCSS/.
  34. ISO, ISO 31000:2018(en) Risk management - Guidelines, https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-2:v1:en.