• Proceedings of the Korea Information Processing Society Conference
• /
• 2021.11a
• /
• pp.449-452
• /
• 2021

산업제어시스템은 IT 기술의 발전에 따라 다양한 기기 환경과 네트워크를 적용해 진화하고 있다. 이러한 상황에서 사이버 보안의 위협은 가중되고 있으며, 이를 예방하는 방법의 하나로 산업제어시스템에 탑재되는 소프트웨어의 소스코드 개발 과정에서 보안 취약점을 예방하기 위해 소스코드 보안 룰을 적용하여 위반사항을 제거한다. 본 연구에서는 소스코드 보안 룰에서 적용 우선순위를 선정하기 위한 가이드를 개발한다.

• Journal of the Korean Society of Marine Environment & Safety
• /
• v.20 no.1
• /
• pp.26-32
• /
• 2014

The increased threat to commercial shipping by Somalia-based pirates has triggered an increased use of PMSC(Private Maritime Security Contractors). The use of PMSC to protect merchant ships against Somali-based piracy threat seems to have been most effective counter-piracy measures. However, there are various legal and practical questions around using PMSC and PCASP(Privately Contracted Armed Security Personnel) on board at sea. This paper aims to study the regulation and its problems of PMSC and PCASP on board to protect merchant ships against Somali-based piracy in the Indian Ocean and Gulf of Aden. In particular, this paper focuses on the legal issues including jurisdictional issues of PCASP on board merchant vessels, use of force by PCASP in self-defense, and authority for using PMSC. Currently, the legal framework relating to use of PMSC and PCASP on board protecting ships from Somali-based piracy is complex, sometimes ambiguous or inconsistent, and currently in a state of flux. Thus, this paper concludes that at this juncture an effort to coordinate this legal framework is necessary, as regards both the interpretation of existing rules related to PCASP on board merchant ships under UNCLOS(United Nations Convention on the Law of the Sea) and the creation of new rules. Also, this paper suggested that there is an urgent need to establish the PMSC-specific laws in Korea.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2022.07a
• /
• pp.241-244
• /
• 2022

금융회사는 신규서비스 구축과 서비스의 시행 전에 보안성 심의를 받아 기준을 충족한 경우 실 운영이 가능 했으나, 기업 자체적으로 검토를 진행하고 보안수준을 스스로 유지 하도록 변경 되었다. 금융회사를 포함한 서비스 제공자는 실제 서비스를 오픈하기 전 보안성 검토를 자체적으로 이행하고 있으나 클라우드 등 회사 자산의 다양한 환경변화와 조직 내 각 부서의 세부적인 요구사항을 충족하기에는 현실적인 한계가 따른다. 기존 연구는 전문가 및 실무자를 통해 보안성 검토 체크리스트의 항목을 개선하고 효과를 검증하는데 노력 하였다. 하지만 실질적인 결과를 바탕으로 한 연구는 부족한 실정이다. 따라서 본 논문은 실 운영 중인 시스템 및 서비스의 기획에서 운영까지의 전체 프로세스를 대상으로 보안성 검토를 수행한 결과를 분석하여 보안 실무자 입장에서의 적절한 검토 방안을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.687-704
• /
• 2017

As Korea's industrial competitiveness and technological prowess increase, collaboration and technical exchanges with contracting companies are increasing. In an environment where cooperation with the contracting company is unavoidable ordering companies are also striving to prevent leakage of technologies through various security systems, policy-making and security checks. However, although the contracting companies were assessed to have a high level of security management the leakage of technical datas are steadily increasing. Issues are being raised about the effectiveness of the security management assessment and the actual security management levels. Therefore, this study suggested a security management system model to improve security management efficiency in the general contract structure. To prove this, analyze the efficiency of 36 contractor companies for the technical datas security management system using the DEA model. The results of the analysis are reflected in the assessment results. Lastly, suggestions for improving the effectiveness of the technical datas security system are proposed.

• 정보보호뉴스
• /
• s.131
• /
• pp.27-29
• /
• 2008

회사의 정보보호 활동 기준을 제시하기 위해 '정보보호 정책규정집' 제작이라는 쉽지 않은 일을 해낸 김 대리. 그는 프로젝트를 마친 후에도 알림 게시판 공지, 포스터 제작, 자체 정보보호 교육 등을 통해 사내 구성원들이 회사의 보안 정책지침을 잘 이해하고 따를 수 있도록 별도의 정보보호 정책홍보를 시행했다. 두 달 뒤, 김 대리는 사내 구성원들이 '환상기업'의 보안정책을 얼마나 잘 준수하고 있는지 궁금해 하지 않을 수 없었다.

• Proceedings of the KAIS Fall Conference
• /
• 2001.11a
• /
• pp.230-235
• /
• 2001

SET(Secure Electronic Transaction)은 인터네트와 같은 open network에서 안전하게 상거래를 할 수 있도록 보장해주는 지불 프로토롤이다. SET은 보안상의 허점을 보완하고자 신용카드 회사인 비자, 마스터카드와 IBM, 넷스케이프, 마이크로소프트 그리고 VeriSign의 기술적인 도움으로 개발되었다. SET은 RSA 데이터 보안회사의 암호화 기술에 기초를 두고 있으며, 기술사양 자체가 공개이므로 누구나 자유롭게 SET 프로토롤을 사용하는 소프트웨어를 개발 할 수 있다. SET은 우리가 일상생활에서 이용하는 신용카드 거래체계를 인터네트를 통한 전자상거래에서도 유사하게 이용할 수 있도록 하였다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.17 no.4
• /
• pp.193-201
• /
• 2017

Financial firms strengthen to protect personal information from the leakage, introducing various security solutions such as print output security, internet network Isolation system, isolationg strorage of customer information, encrypting personal information, personal information detecting system, data loss prevention, personal information monitoring system, and so on. Financial companies are also entering the era of cutthroat competition due to accept of the new channels and the paradigm shift of financial instruments. Accordingly, The needs for security for customer information held by financial firms are keep growing. The large security accidents from the three card companies on January 2014 were happened, the case in which one of the outsourcing personnel seized customer personal information from the system of the thress card companies and sold them illegally to a loan publisher and lender. Three years after the large security accidents had been passed, nevertheless the security threat of the IT outsourcing workforce still exists. The governments including the regulatory agency realted to the financail firms are conducting a review efforts to prevent the leakage of personal information as well as strengthening the extent of the sanction. Through the analysis on the application of security policy for outsourcing personnel in case of large-scale Financial IT projects and the case study of appropriate security policies for security compliance, the theis is proposing a solution for both successfully completing large-scale financial IT Project and so far as possible minizing the risk from the security accidents by the outsouring personnel.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2006.11a
• /
• pp.349-352
• /
• 2006

현재, 대기업이나 중소기업에서는 회사 내 정보보호 및 누출을 막기 위해 데이터 접근 기술을 적용 및 개발하고 있다. 하지만 기존 XML기반 RBAC 접근제어 기술은 회사환경에 적용하기에 무리가 있고 한계를 지나고 있기 때문에 사용자로부터 회사의 기밀정보를 보호하고, 시스템 디바이스에 대한 사용을 제어하기 위해서는 회사는 시스템의 보안 관리자에 의해 관리될 수 있는 보안매커니즘의 확립이 필요하다. 따라서 본 연구에서는 회사 특성에 맞는 데이터 접근방법을 제시하고자 한다. 제안방법은 기존 XML 기반 RBAC 확장하여 사내 데이터 접근환경에서 사용자를 식별할 수 있는 인증 매커니즘과 사용자의 사용권한을 식별하는 인가 메커니즘을 설계 및 구현한다. 또한 각 부서에 성격에 맞는 메시지 프로토콜을 정의하고 제시함으로써 해당 부서에 요청하는 시스템에 따라 다른 정책을 제공할 수 있다.

• Korean Security Journal
• /
• no.61
• /
• pp.137-161
• /
• 2019

The purpose of this research is to explore ways to improve private security officers' compliance with security policies by analyzing the effects of transformational leadership and organizational trust. Data were collected from private security officers employed in the cities of Seoul and Busan by using survey questionnaire. Statistical analyses were conducted with SPSS 22.0 and AMOS 23.0. The results showed that transformational leadership increased organizational trust which was found to have a positive effect on willingness to comply with security policies. In addition, transformational leadership did not affect willingness to comply with security policies directly but had an indirect effect on it through organizational trust. The findings of current research suggest the leaders of security businesses consider various ways to increase officers' organizational trust such as improved job security and benefits in order to maximize their willingness to comply with security policies.

• Information Systems Review
• /
• v.18 no.4
• /
• pp.17-42
• /
• 2016

Information security incidents caused by authorized insiders are increasing in financial firms, and this increase is particularly increased by outsourced contractors. With the increase in outsourcing in financial firms, outsourced contractors having authorized right has become a threat and could violate an organization's information security policy. This study aims to analyze the differences between own employees and outsourced contractors and to determine the factors affecting the violation of information security policy to mitigate information security incidents. This study examines the factors driving employees to violate information security policy in financial firms based on the theory of planned behavior, general deterrence theory, and information security awareness, and the moderating effects of employee type between own employees and outsourced contractors. We used 363 samples that were collected through both online and offline surveys and conducted partial least square-structural equation modeling and multiple group analysis to determine the differences between own employees (246 samples, 68%) and outsourced contractors (117 samples, 32%). We found that the perceived sanction and information security awareness support the information security policy violation attitude and subjective norm, and the perceived sanction does not support the information security policy behavior control. The moderating effects of employee type in the research model were also supported. According to the t-test result between own employees and outsourced contractors, outsourced contractors' behavior control supported information security violation intention but not subject norms. The academic implications of this study is expected to be the basis for future research on outsourced contractors' violation of information security policy and a guide to develop information security awareness programs for outsourced contractors to control these incidents. Financial firms need to develop an information security awareness program for outsourced contractors to increase the knowledge and understanding of information security policy. Moreover, this program is effective for outsourced contractors.