• Journal of Digital Convergence
• /
• v.17 no.5
• /
• pp.23-31
• /
• 2019

This study aims to build an AHP model that evaluates the priority of cyber security policies for the Azerbaijan information system. For this, 4 factors were constructed from components of ITU National Interest Model, whereas 5 alternatives were based on the best practices of the eight developed countries leading the cyber security field. Using the questionnaire, 24 security experts evaluated the strategic priority of such factors or alternatives. The analysis results using the AHP software showed that homeland defense and economic well-being were the dominant aspects of cyber security policy, whereas capacity building and infrastructure were the main concern of cyber security elements for Azerbaijan. This study presents the strategic priority of cyber security policies that can be adopted by Azerbaijan government. This study can contribute to developing the national cyber security guide of Azerbaijan.

• Proceedings of the Korean Information Science Society Conference
• /
• 2007.06d
• /
• pp.80-83
• /
• 2007

최근 들어 보안에 대한 피해의 급증으로 많은 기업들이 정보시스템에 막대한 기업 자원을 투입하고 있다. 뿐만 아니라, 다양한 ROI 평가 방법을 통해 투자대비 최대 수익률을 이끌어 내기 위해 끊임없이 시도하고 있다. 이는 많은 기업들이 정보시스템에 대한 투자를 유보하거나 정확한 평가 및 방법을 내리고 싶어한다는 증거이다. 이러한 기업의 추세는 최근 보안 분야에 있어 합리적인 보안 투자 방침을 세우는데 좋은 지침이 되어 지고 있다. 그러나. 지금의 대규모 정보 시스템 구축 및 웹기반의 인프라 환경에서는 적절한 보안 투자를 한다는 것은 쉽지 않다. 이러한 근본적인 이유 중 하나는 수익률을 측정하는 방법의 부재에서 찾을 수 있다. 따라서, 본 논문에서는 보안 분야에서 쓰이는 기존의 ROSI(Return On Security Investment)모델을 소개하고, 투자의 위험부담을 줄이기 위한 확률 기반의 개선된 ROSI(Probability based ROSI = PROSI) 방법론을 제안하고자 한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2001.11a
• /
• pp.459-463
• /
• 2001

정보기술의 발달과 함께 정보시스템을 보호하기 위한 정보보안관리문제는 모든 기관 및 조직에서 반드시 짚고 가야 하며, 조직 전반에 걸쳐 표준적인 관리지침을 통해 포괄적으로 검토되어야 하는 문제로 대두되고 있다. 그러나, 현행 국방관련조직은 전반적으로 보안관리방법과 관리모델이 정립되지 않은 실정이므로 정보보안관리를 위한 표준관리 지침이 요구된다. 이에 본 논문은 정보시스템을 운영하는 조직 전반의 보안상태를 평가하는데 유용한 방법론인 정보보안관리규격(BS7799)을 적용함으로서 전사적인 관점에서의 국방정보체계 정보보안관리모델을 제안하고자 한다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.8 no.5
• /
• pp.211-219
• /
• 2008

This paper is proposed context-aware based access control, model by extending original access control model. In this paper, we survey the recent researches about security model based context-aware such as xoRBAC and CAAC. For exactly policy evaluation, we make an addition Context Broker and Finder in existing CAAC security model. By this security model, Context information and context decision information is able to be collected easily for more correct policy decision. This paper controlled access of possible every resources that is able to access by user's event and constraint from primitive access resources. In this paper proposed security model can be offer dynamically various security level and access authority method alone with specified policy and constraint adjustment at user's role.

• Journal of Digital Convergence
• /
• v.12 no.6
• /
• pp.289-295
• /
• 2014

Intrusion detection system is a means of security that detects abnormal use and illegal intension in advance in real time and reenforce the security of enterprises. Performance of intrusion detection system is judged by information collection, intrusion analysis, intrusion response, review and protection of intrusion detection result, reaction, loss protection that belong to the area of intrusion detection. In this paper, we developed a evaluation model based on the requirements of intrusion detection system and ISO international standard about software product evaluation.

• Journal of Digital Convergence
• /
• v.13 no.5
• /
• pp.169-176
• /
• 2015

Virtual Private Network is a method which can use as a private network using private line. The quality of security of virtual private network is influenced by security auditability, cryptographic support, user data protection, access control, etc., and efficiency is influenced by throughput, latency, the number of cession, etc. In this paper, we constructed a evaluation model based on CC(ISO/IEC 15408) and the quality evaluation standard ISO/IEC 25000 series to evaluate the quality level about efficiency with security performance of virtual private network. We think that this study will contribute to construct the system which can evaluate the quality of virtual private network based on CC and ISO quality evaluation standard.

• Journal of Navigation and Port Research
• /
• v.36 no.1
• /
• pp.9-14
• /
• 2012

Maritime security incidents by pirates and by terrorists increase, but maritime incidents investigation models are limited to figure out the maritime security incidents. This paper provides the analysis model for maritime security incidents. To develop this analysis model, this categorizes five threat factors, the ship, the cargo type, port system, human factor, information flow system, makes the risk assessment matrix to quantify the risk related to threat factors and classifies four priority categories of risk assessment matrix. Also, this model makes from the frameworks which include a variety of security initiatives implementing in stakeholder levels like international organizations, individual governments, shipping companies, and the ship. Therefore, this paper develops the Analysis for Maritime Security Management model based on various security initiatives responding to the stakeholder levels of maritime security management and top-bottom/bottom-up decision trees, and shows the validity through verifying the real maritime security incident of M/V Petro Ranger.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.04a
• /
• pp.1329-1330
• /
• 2011

u-Health 서비스의 시작으로 병원에서 단발성 치료에 국한되었던 기존 서비스가 이제는 가정 등 실생활 전 영역에서 평생에 걸쳐 제공되어 시 공간적으로 확대되었다. 본 연구에서는 ISO/IEC 9126과 ISO/IEC 12119를 기반으로 하여 보안성 평가모델을 제시하고 평가 과정에서 활용할 수 있는 품질검사표를 개발하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.685-686
• /
• 2009

본 연구에서는 침입방지시스템의 기반기술을 조사하고 침입방지시스템의 품질시험 평가를 위한 품질특성을 분석하며 본 연구에서는 기존의 소프트웨어 품질 평가 기술 및 표준화에 관한 관련 연구를 추진하고, 침입방지시스템 보안성 품질 평가 모델을 개발하였다. 또한, 현재 품질 평가 국제 표준화 동향에 있어서도 기존에 소프트웨어 품질 평가를 위해서 지침서로 사용하였던 소프트웨어의 품질 평가 국제 표준화 문서 ISO/IEC9126과 ISO/IEC 14598을 통해서 품질 평가 모델을 개발하였다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.11 no.4
• /
• pp.737-744
• /
• 2007

It need estimation model who is efficient and estimate correctly organization's information security level to achieve effectively organization's information security target. Also, estimate class information security level for this and need reformable estimation indicator or standard and estimation methodology of information security systems that application is possible should be studied in our country. Therefore many research centers including ISO are preparing the measuring and evaluating method for network duality. This study will represent an evaluating model for network security based on checklist. In addition, we propose ah measuring and evaluating method for network performance. The purpose of two studies is to present the evaluating procedure and method for measuring security of network on set workwill be identified and a measuring method and procedure will be proposed.