• Journal of the Korea Society for Simulation
• /
• v.18 no.2
• /
• pp.1-8
• /
• 2009

Enterprise security management system proposed to properly manage heterogeneous security products is the security management infrastructure designed to avoid needless duplications of management tasks and inter-operate those security products effectively. In this paper, we defined the security policies using Z-Notation and the detection algorithm of policy conflict for managing heterogeneous firewall systems. It is designed to help security management build invulnerable security policies that can unify various existing management infrastructures of security policies. Its goal is not only to improve security strength and increase the management efficiency and convenience but also to make it possible to include different security management infrastructures while building security policies. With the process of the detection and resolution for policy conflict, it is possible to integrate heterogeneous security policies and guarantee the integrity of them by avoiding conflicts or duplications among security policies. And further, it provides convenience to manage many security products existing in large networks.

• Information Systems Review
• /
• v.18 no.4
• /
• pp.17-42
• /
• 2016

Information security incidents caused by authorized insiders are increasing in financial firms, and this increase is particularly increased by outsourced contractors. With the increase in outsourcing in financial firms, outsourced contractors having authorized right has become a threat and could violate an organization's information security policy. This study aims to analyze the differences between own employees and outsourced contractors and to determine the factors affecting the violation of information security policy to mitigate information security incidents. This study examines the factors driving employees to violate information security policy in financial firms based on the theory of planned behavior, general deterrence theory, and information security awareness, and the moderating effects of employee type between own employees and outsourced contractors. We used 363 samples that were collected through both online and offline surveys and conducted partial least square-structural equation modeling and multiple group analysis to determine the differences between own employees (246 samples, 68%) and outsourced contractors (117 samples, 32%). We found that the perceived sanction and information security awareness support the information security policy violation attitude and subjective norm, and the perceived sanction does not support the information security policy behavior control. The moderating effects of employee type in the research model were also supported. According to the t-test result between own employees and outsourced contractors, outsourced contractors' behavior control supported information security violation intention but not subject norms. The academic implications of this study is expected to be the basis for future research on outsourced contractors' violation of information security policy and a guide to develop information security awareness programs for outsourced contractors to control these incidents. Financial firms need to develop an information security awareness program for outsourced contractors to increase the knowledge and understanding of information security policy. Moreover, this program is effective for outsourced contractors.

• Convergence Security Journal
• /
• v.18 no.2
• /
• pp.159-166
• /
• 2018

The purpose of this study is to investigate the effect of selection motivation on the NCS curriculum and career decision of the students in security related department. The contents of the questionnaire consisted of "First, Motivation to select major, Second, NCS curriculum, Third, Career decision". In this study, Chronbach's Alpha coefficients were presented to analyze the reliability of variables and exploratory factors, and the Berimax method was performed. The AVE and CR values of the items were calculated to be 0.5 and 0.7, respectively. Therefore, it was analyzed that the Intensive feasibility of items were well-focused. As a result of the hypothesis test, the standardized coefficients were calculated as follows: 'Selective motivation ⇨ NCS curriculum' is 0.563, 'NCS curriculum ⇨ career decision' is 1.339. The relationship between the two hypotheses was found to be positive (+). In order to improve the career decision of students in security related departments, it seems necessary to raise the motivation of selection and to improve the satisfaction of NCS curriculum.

• Journal of the Society of Disaster Information
• /
• v.11 no.2
• /
• pp.263-267
• /
• 2015

This study shows the result of the security assessment of the nationwide key energy facilities and suggests the ways of improving the security level. According to the study, most of the energy facilities are adequately equipped with physical security factors such as security personnel, security systems, fences, and guard posts, but lack of awareness is pervasive among those concerned, so the security operation is inefficient. In other words, inefficient deployment of security personnel, lack of the fundamental knowledge of the security systems, excessive dependence on surveillance cameras' functions such as Pan/Tilt/Zoom, misplaced cameras, low efficiency of monitoring, and irrelevant security plans. To solve these problems, above all, the authority concerned need to develop professional training programs to secure certified security mangers, and need to standardize security process to ensure consistency and to harness the standardization as a source of self assessment to improve security level.

• The Journal of Korean Association of Computer Education
• /
• v.10 no.3
• /
• pp.57-66
• /
• 2007

E-mail system is considered as a most important communication media, which can be used to transmit personal information by internet. But e-mail attack also has been increased by spoofing e-mail sender address. Therefore, this work proposes sender verification faculty for spam mail protection at sender's MTA by using security card for protection forged sender and also for authenticating legal sender. Sender's mail MT A requests security card's code number to sender. Then sender input code number and generate session key after sender verification. Session key is used to encrypt sender's signature and secure message transmission. This work can provide efficient and secure e-mail sender authentication with sender verification and message encryption.

• Convergence Security Journal
• /
• v.24 no.3
• /
• pp.105-115
• /
• 2024

Since 2015, programming has been included in school curricula to enhance computer literacy and problem-solving skills. C language, widely used for its simplicity, efficiency, and long history, poses significant security risks, particularly in memory vulnerabilities like buffer overflow, pointer errors, format strings, and integer overflow. These vulnerabilities can cause severe system issues and widespread damage. This paper proposes an "Error Detection and Automatic Correction of Memory Vulnerabilities (EDAC)" algorithm to detect and correct these errors, aiming to reduce the impact of C language memory vulnerabilities.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2023.05a
• /
• pp.167-168
• /
• 2023

가상현실 기술은 다양한 유형으로 발전하고 있다. 해양경찰은 함정 조함 교육을 위해 두 가지 가상현실 환경에서 실습이 진행 중이다. 이 연구는 두 가지 가상 현실 환경에서 조함 교육효과가 어떻게 나타나는지 알기 위해 항해 위험성을 평가하고 분석하였다. 실물형은 데스크톱형보다 최근접거리가 더 길고, 대각도 타 사용 시간과 비상인지 시간이 더 길게 나타났다. 향후 해양경찰 함정 교육을 위한 최적의 가상현실 환경을 구축하고 확장하는데 기초자료로 활용할 예정이다.

• The Journal of Society for e-Business Studies
• /
• v.16 no.4
• /
• pp.87-96
• /
• 2011

The importance of the security management system for the aviation infrastructure cannot be overemphasized. What is especially important on the security management system for it is the assessment that is detaild and systematic. This article presents a framework based on a Hanulcha-type security management system model for a Information security of the Aviation infrastructure. This system checks, estimates and analyzes the goal of security with effect, especially in case of the security-accident on the aviation infrastructure because this system model gives the integrated security assessment method.

• Journal of Navigation and Port Research
• /
• v.36 no.3
• /
• pp.261-271
• /
• 2012

The purpose of the present study is to empirically examine factors that affect the information security awareness and perceived information security risk of employees of port companies. In particular, in order to identify factors that affect the perceived information security risks, we investigated the relation of assets, threats, and vulnerabilities to it, using the risk analysis methodology. With A total of 252 valid questionnaires, we also performed the structural equation modeling analysis using AMOS. It was found that first, there was no meaningful relationship between the information assets and the perceived information security risk in the case of employees of port companies. Second, threats and vulnerabilities turned out to have positive influences on the perceived information security risk. Finally, there was a positive relationship not only between the information security awareness and the information security education, but also between the information security awareness and the intention of information security. However, there was no meaningful relationship between the information security concern and the information security awareness.

• Convergence Security Journal
• /
• v.20 no.1
• /
• pp.25-32
• /
• 2020

In the midst of the rising need for Industrial Security experts, the development of National Competency Standards(NCS) with regards to industrial security is a very important and urgent task. The NCS standardizes university-level academic curriculum and qualification systems and connects them with the industry's needs. This study has extracted, classified and analyzed security-related jobs and tasks requiring security expertise that is required within NCS. Through this study, many tasks have been confirmed to require security competencies that are different from those in IT-security, physical security that already exist as a NCS tasks. It is expected that the industry's needs of industrial security expertise will be reflected in future NCS development, which will be used as basic data for systematizing industrial security jobs and competency.