• Review of KIISC
• /
• v.26 no.1
• /
• pp.48-53
• /
• 2016

최근 들어 보안사고의 대응 방식이 네트워크 보안이나 운영체제 보안과 같은 전통적인 방법에서 벋어나 개발생명주기보안이나 SW 공급망 보안으로 확대되고 있다. 이러한 흐름에서 주목받는 것이 BSIMM과 같은 소프트웨어 보안성숙도 모델이다. 보안성숙도 모델은 소프트웨어 시스템의 보안성 향상을 위해 관리자와 개발자가 중점을 두어야 할 부분을 스스로 평가할 수 있도록 하는 프레임워크이다. 본 고에서는 BSIMM을 통해 보안성숙도 모형이 갖는 특징을 소개하며, 이의 활용에 대해 살펴본다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.05a
• /
• pp.258-259
• /
• 2020

한국인터넷진흥원에서는 2020년 사이버 공격에 대한 7대 전망을 일상 속 보안 취약점, 공공기관·기업 대상 랜섬웨어, 가상동화 거래소를 통한 해킹 사고, 문자 메시지·이메일을 통한 악성코드 감염, 지능형 표적 공격, 소프트웨어 공급망 공격, 융합 서비스 보안 위협으로 제시하였다. 이에 본 논문에서는 신규 사이버위협에 대한 동향 분석을 통하여 기관의 정보보안을 위해 대응할 수 있는 방안에 대해 살펴보고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.793-805
• /
• 2015

Due to the rise of automotive security problems following automotive safety and the progress of the internet technology leading to a hyper-connected society, guaranteeing the safety of automotive requires security plans in the supply chain assurance and automotive software, and risk management plans for identifying, evaluating, and controlling the risks that may occur from the supply chain since the modern automotive is a Safety Critical system. In this paper, we propose a study on Automotive Supply Chain Risk Management (A-SCRM) procedures by person interested within the automotive Life-Cycle.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.770-773
• /
• 2011

스마트그리드는 기존의 전력망 환경에 정보통신 기술을 접목하여 발전소와 사용자가 실시간으로 정보를 교환하며, 사용 과금 및 전력공급의 효율성을 증대시키는 기술이다. 스마트그리드는 전력관리소인 MDMS(Meter Data Management System)와 각 가정에 연결되어있는 스마트미터와의 통신을 통해 전력데이터를 수집하게 되는데, 각 가정의 디바이스들은 전력사용량을 사용한 만큼 스마트미터에게 정보를 전송하여 스마트미터에서는 그 정보를 MDMS에게 전송하는 방식을 사용하고 있다. 이는 네트워크를 활용하여 전송하고 있기 때문에 기존의 보안위협 및 스마트그리드환경에서의 추가적인 보안위협이 예상된다. 따라서 본 논문에서는 각 가정에서 측정한 전력데이터 값을 안전하게 전송하기 위해 디바이스를 OTP를 기반으로 안전하게 인증하는 기술에 대하여 제안하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.989-1000
• /
• 2023

In order to respond to supply chain threats, active research and development efforts are underway for software tamper prevention technologies such as Secure Boot and management systems like Software Bill of Materials(SBOM). Particularly, the Trusted Computing Group (TCG) is introducing standards for Trusted Platform Module(TPM) to provide a secure and trustworthy computing boot environment. This paper emphasizes the need for introducing secure booting technology for cryptographic modules to ensure that they remain safe and provide reliable functionality even in the face of supply chain threats. Furthermore, it analyzes vulnerabilities in cryptographic modules verified by the ISO/IEC 19790 standard and proposes security requirements for secure booting of cryptographic modules to address these vulnerabilities.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.2
• /
• pp.229-244
• /
• 2024

Recently, supply chain attacks against nuclear facilities such as "Evil PLC" are increasing due to the application of digital technology in nuclear power plants such as the APR1400 reactor. Nuclear supply chain security requires a asset management system that can systematically manage a large number of providers due to the nature of the industry. However, due to the nature of the control system, there is a problem of inconsistent management of attribute information due to the long lifecycle of software assets. In addition, due to the availability of the operational technology, the introduction of automated configuration management is insufficient, and limitations such as input errors exist. This study proposes a systematic asset management system using SBOM(Software Bill Of Materials) and an improvement for input errors using natural language processing techniques.

• KIPS Transactions on Software and Data Engineering
• /
• v.9 no.12
• /
• pp.387-402
• /
• 2020

Conventional automotive development has mainly focused on ensuring correctness and safety and security has been relatively neglected. However, as the number of automotive hacking cases has increased due to the increased Internet connectivity of automobiles, international organizations such as the United Nations Economic Commission for Europe(UNECE) are preparing cybersecurity regulations to ensure security for automotive development. As with other IT products, automotive cybersecurity regulation also emphasize the concept of "Security by Design", which considers security from the beginning of development. In particular, since automotive development has a long lifecycle and complex supply chain, it is very difficult to change the architecture after development, and thus Security by Design is much more important than existing IT products. The problem, however, is that no specific methodology for Security by Design has been proposed on automotive development process. This paper, therefore, proposes a specific methodology for Security by Design on Automotive development. Through this methodology, automotive manufacturers can simultaneously consider aspects of functional safety, and security in automotive development process, and will also be able to respond to the upcoming certification of UNECE automotive cybersecurity regulations.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.4
• /
• pp.817-839
• /
• 2021

To manage software safely, the military acquires and manages products in accordance with the RMF A&A. RMF A&A is standard for acquiring IT products used in the military. And it covers the requirements, acquisition through evaluation and maintenance of products. According to the RMF A&A, product development activities should reflect the risks of the military. In other words, developers have mitigated the risks through security by design and supply chain security. And they submit evidence proving that they have properly comply with RMF A&A's security requirements, and the military will evaluate the evidence to determine whether to acquire IT product. Previously, case study of RMF A&A have been already conducted. But it is difficult to apply in real-world, because it only address part of RMF A&A and detailed information is confidential. In this paper, we propose the evidence fulfilling method that can satisfy the requirements of the RMF A&A. Furthermore, we apply the proposed method to real-world drone system for verifying our method meets the RMF A&A.