• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.04a
• /
• pp.428-430
• /
• 2015

보안은 오직 기술을 관리하는 것이 아닌 사람관리, 조직관리, 경영관리이다. 그 중에서도 인적자원은 모든 산업에서 가장 중요한 자원임과 동시에 보안의 측면에서 볼 때 가장 통제해야 하는 존재이다. 이는 산업보안에서 가장 큰 이슈인 산업기술 기밀 유출이 주로 전 현직 임직원 및 협력업체 직원 등 인적자원을 통했기 때문이다. 미래 산업의 중심이 될 IoT환경에서는 산업기술이 핵심자산이므로 이에 더 주목해야 할 필요가 있다. 이처럼 인적자원에 대한 통제와 관리가 산업보안에서 중요한 의미를 갖는 것에 비해 기존의 보안관리체계의 통제항목은 대부분 IT적인 부분에 치중되어있다. 또한, 체계적인 운영이 부족하고, 산업스파이, 정보절취 등 다양한 위험요소가 존재한다. 특히, 인적자원은 완벽한 예측이 불가능하므로 위험을 최소화하는 방법을 고안해 대는 것에 유념하여 IoT환경에서의 인간중심적인 보안관리체계 구축해야한다. 이를 위해 기존의 정보보호 관리체계 분석을 통하여, 기존의 인적보안 지침들의 적합성을 따져 우선순위를 적용하여 효율적인 인적자원관리 방법론을 설계하였다. 본 연구결과는 보유자원을 가장 효율적으로 활용하여, 그 조직에 적합한 보안체계를 구축하는데 도움이 될 것으로 기대된다.

• Journal of Convergence Society for SMB
• /
• v.6 no.3
• /
• pp.13-19
• /
• 2016

In various ICBM (IoT, Bigdata, Cloud, Mobile) IT convergence environments, IT technologies have been evolved, new information security threats have been occurred. As information security incidents in major public agencies, financial institutions and companies occurred, it was emphasized that the importance of human security was disclosed. Thus, implementing of information security management system could protect hacks and security breaches and respond quickly to accidents so it minimized the sized of loss. In this paper, comparison of human security controls shown in ISO27001, COBIT, NIST 800-53, K-ISMS, Cyber Security Framework such as the main information security management systems was analyzed, and proposed of the security implications about effective controls of human resources security issues.

• Convergence Security Journal
• /
• v.24 no.3
• /
• pp.239-247
• /
• 2024

This study analyzed the impact of strategic human resource management on organizational effectiveness and corporate performance targeting security personnel working in a physical security company. To this end, a survey was conducted from April 15 to May 17, 2024 targeting 130 security managers working in physical security-related companies. In the survey, the variables were divided into "strategic human resource management, organizational effectiveness, and corporate performance." As a result of the analysis, among the research hypotheses, "Strategic human resource management ⇨ organizational effectiveness, organizational effectiveness ⇨ corporate performance, strategic human resource management ⇨ corporate performance" were all adopted. In order to increase the performance of security companies, organizational effectiveness must be improved, and to this end, efforts must be maintained to improve strategic human resource management within the company. In order to improve strategic human resource management in the future, it is necessary to present all the job skills that new employees must have and provide sufficient training opportunities on the job before being put into the field.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.6
• /
• pp.143-152
• /
• 2016

Currently many central administrative agencies, municipalities and public and private institutions operate Managed security services to cope with cyber security incidents. These entities exert efforts in operating efficiencies rather than introduction of services as they used to. Accordingly, quite a few policies, directions and guidelines have been established for stable operation of Managed security services. Still, Managed security is operated by individuals, whose competencies influence the quality of Managed security services to a great extent. In this respect, the present article examines Managed security technology and methods and describes evaluation methods and examples relevant to human competencies, so as to seek for some potential courses for further development as well as more efficient approaches to human resource management in terms of institutional Managed security services.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.6
• /
• pp.153-160
• /
• 2009

This study is to develop a human resource (HR) security framework, and related HR security indicators in the context of information security. The HR security framework consists of three constructs, personnel assurance, personnel competence, and personnel security control. Based on the framework, HR security management indicators are derived as 26 indicators in 9 items out of 3 categories. An empirical research has been performed to verify the relevance and consistency between the indicators by conducting a questionnaire-based survey. Also, interrelationships between the proposed indicators and HR related security level were analyzed by the multiple regression analysis. As a result, the proposed hypothesis were mostly accepted, showing the significant relationships between the indicators and security level.

• Korean Security Journal
• /
• no.53
• /
• pp.37-59
• /
• 2017

This study aims to contribute to the early detection of occupational fraud in the Korean financial industry by analyzing fraud symptoms. Firstly, the definition, cause of occupational fraud, and fraud symptoms were discussed through literature review. Secondly, survey data were collected from the employees of the financial industry such as bank, insurance, and securities companies to conduct statistical analysis. The result of analysis showed that the symptoms of 'excessive stock investment' and 'unsettled life style' were statistically significant predictors of fraud detection experience. Plus, 'tips and complaints' were the most frequent method for detecting occupational fraud in the Korean financial industry. The financial institutions can minimize the loss of occupational fraud by early detection through educating their employees and vendors on these important symptoms of occupational fraud.

• Journal of the Korea Society of Computer and Information
• /
• v.20 no.5
• /
• pp.113-121
• /
• 2015

This research suggests construction processes and security solutions for security control center as management measures for security management improvement in domestic electronic security companies. Security control center (SCC) is the central nerve of electronic security service, and no matter how well the on-site response system has been built, if SCC ceases to work due to an incident or disaster or security control personnel are harmed, the electronic security system cannot perform its proper functions. It is divided to a spatial structure, the infrastructure, control equipment, control solutions and operating structure in a construction process in the security control center. And a solution can be presented for physical security, information security, and personnel security in the way to security solutions.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2022.11a
• /
• pp.84-86
• /
• 2022

자율운항선박의 자율화 3단계에서는 육상에서 원격으로 선박의 운항을 제어하며 원격제어자에 의한 인적요소는 발생하게 된다. 인적요소를 식별하고 평가하기 위한 기초 연구로써 선박 운항 시 자세 특성에 따른 항해 위험 요소들을 분석하였다.

• Convergence Security Journal
• /
• v.16 no.6_2
• /
• pp.89-97
• /
• 2016

Disclosure of personal information to be carried out in one of the Administrative Publicity, Administrative agency as specific information about the person who has violated the obligation imposed by the law is an unspecified number people know is through the direct or Internet media it is to be disclosed in an unspecified number of people. This is, indirect sanctions so as to fulfill its obligations by the addition of psychological pressure that exposes the personal information of the fact that in breach of his obligations to the breach of duty and it has been an unspecified number of people know it is a means. However, publication of these personal information, infringement of the moral rights of the Constitution guarantees an individual, of course, not only a matter of law that the right to self-determination of the personal information, has continued also doubts for the effectiveness of the system. As a result, in this paper, to discuss legal issues with the disclosure of management personal information and its improvement measures, and expected to be able to take advantage of the efficient development of the future of personal information disclosure system.

• Review of KIISC
• /
• v.25 no.1
• /
• pp.47-52
• /
• 2015

보안에서 인적보안(Personal Security)의 예방통제 중 하나로 개발/운영을 분리하는 직무분리(Separation of Duty)를 해오고 있다. 고의적인 시스템의 오용을 줄이기 위한 방법이며, 많은 국제 표준과 국내 표준(COBIT, ISMS, 등)에서 직무분리를 명시하고 있다. 하지만 무중단 시스템이면서, 운영자가 특정 전문가 집단으로 한정되고, 수 많은 변경이 발생하는 무중단 환경에서 개발/운영이 분리 됨으로 인한 여러 가지 문제점이 발생 하고 있다. 체계를 운영하면서 전문지식을 기반으로 한 요구사항을 명확하게 이해하지 못하면, 추가적인 요구사항이 발생한다. 이는 체계의 품질저하와 위험(Risk)증가로 이어지게 된다. 따라서 본 연구에서는 개발운영조직 통합관리(DevOps) 방법론을 SCADA와 같이 운영자가 해당 분야의 전문성을 가지고, 무중단으로 운영되며, 수많은 변경이 반영되는 시스템에서 개발 및 운영을 통합하였을 때, 발생할 수 있는 문제점과 개선방안을 제시하고자 한다.