Browse > Article
http://dx.doi.org/10.33778/kcsa.2020.20.2.029

XML Converter Design and Implementation for OCIL based Security Level Evaluation  

Kim, Jongmin (경기대학교/융합보안학과)
Kim, Sang-Choon (강원대학교 정보통신공학부)
Publication Information
Convergence Security Journal / v.20, no.2, 2020 , pp. 29-35 More about this Journal
Abstract
The cyber attacks targeting the systems of national and public organizations in the front line of cyber security have been advanced, and the number of cyber attacks has been on the constant rise. In this circumstance, it is necessary to develop the security evaluation technology to prevent cyber attacks to the systems of national and public organizations. Most of the studies of the vulnerability analysis on the information systems of national and public organizations almost focus on automation. In actual security inspection, it is hard to automate some parts. In terms of security policies for threats, many different plans have been designed and applied in the managerial, physical, and technical fields, giving particular answers no matter how they are subjective or situational. These tendencies can be standardized in OCIL(Open Checklist Interactive Language), and partial automation can be achieved. Therefore, this study tries to implement XML Converter in order for OCIL based security level evaluation with typical evaluation questions.
Keywords
OCIL; XML; ISMS; Security Level Assessment; NIST;
Citations & Related Records
연도 인용수 순위
  • Reference
1 http://www.datanet.co.kr/news/articleView.html?idxno=92177
2 최윤철, "금융 정보보호 수준향상을 위한 정보보호 수준측정 및 취약점 개선에 관한 연구", 연세대학교, 박사학위논문, 2015.
3 김협, 엄수정, 권혁준, "공공기관의 정보보안 솔루션 도입이 정보보안 수준 향상에 미치는 영향", 한국융합보안논문지, Vol.17, No.5, 2017, pp.19-25.
4 -국가사이버안전센터, "정보보안 관리실태 평가 소개", 한국정보보호학회논문지, Vol. 23, No. 5, 2013, pp. 9-11.
5 국방정보통신협회, '상호운용성 정보보증 평가기준 고도화 방안 연구', 2017.
6 http://www.law.go.kr/admRulLsInfoP.do?admRulSeq=2100000097878
7 김대호, 오일석, "미국 전자정부 정보보안 법제 동향", 한국정보보호학회논문지, Vol. 13, No. 3, 2003, pp. 15-22.
8 양정윤, 박상돈, 김소정, "미국의 법제도 정비와 사이버안보 강화 : 국가사이버안보보호법 등 제. 개정된 5개 법률을 중심으로", 입법과 정책, Vol. 7, No. 2, 2015, pp. 305-335.
9 최명길, 정재훈, "국외 정보보안관리 동향", 정보 보호학회논문지, Vol. 23, No. 5, 2013, pp. 12-19.
10 https://blog.naver.com/browbear/220617709359
11 백영호, "공공 부문 정보시스템 보안통제 취약성 점검 방안연구", 감사원 감사연구원
12 윤오준, "보안 중요도에 따른 정보자산 분류 방법론 연구", 건국대학교, 석사학위논문, 2013.
13 JOINT TASK FORCE, 'Guide for Applying the Risk Management Framework to Federal Information Systems', NIST Special Publication 800-37 Revision 1, February 2010.
14 https://csrc.nist.gov/Projects/Security-Content-Automation-Protocol/Specifications/ocil