• Journal of Internet Computing and Services
• /
• v.12 no.5
• /
• pp.39-46
• /
• 2011

The user authentication on the security applications is one of the most important process. Because character based password is commonly used for user authentication, it is most important to protect the keyboard. Due to the reason, several software solutions for keyboard security have been applied to critical sites. This paper introduces vulnerabilities to the commonly used USB keyboard, implements a sample code using the vulnerabilities and evaluates the possibility for the keyboard data to be stolen in the guarded environment. Through the comparison of the result, a countermeasure to the vulnerabilities is proposed.

• The Journal of the Korea Contents Association
• /
• v.22 no.2
• /
• pp.125-134
• /
• 2022

Due to the development of smartphone technology, as of 2020, 91.9% of people use the Internet[1] to frequently acquire information through websites and mobile apps. As the number of homepages in charge of providing information is increasing every year, the number of applications for web vulnerability diagnosis, which diagnoses the safety of homepages, is also increasing. In the existing web vulnerability check, the number of diagnostic personnel should increase in proportion to the number of homepages that need diagnosis because the diagnosticians manually test the homepages for vulnerabilities. In reality, however, there is a limit to securing a web vulnerability diagnosis manpower, and if the number of diagnosis manpower is increased, a lot of costs are incurred. To solve these problems, an automatic diagnosis tool is used to replace a part of the manual diagnosis. This paper explores a new method to expand the current automatic diagnosis range. In other words, automatic diagnosis possible items were derived by analyzing the impact of web vulnerability diagnosis items. Furthermore, automatic diagnosis identified possible items through comparative analysis of diagnosis results by performing manual and automatic diagnosis on the website in operation. In addition, it is possible to replace manual diagnosis for possible items, but not all vulnerability items, through the improvement of automatic diagnosis tools. This paper will explore some suggestions that can help improve plans to support and implement automatic diagnosis. Through this, it will be possible to contribute to the creation of a safe website operating environment by focusing on the parts that require precise diagnosis.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.7
• /
• pp.1-8
• /
• 2017

As the IT environment becomes more sophisticated, various threats and their associated serious risks are increasing. Threats such as DDoS attacks, malware, worms, and APT attacks can be a very serious risk to enterprises and must be efficiently managed in a timely manner. Therefore, the government has designated the important system as the main information communication infrastructure in consideration of the impact on the national security and the economic society according to the 'Information and Communication Infrastructure Protection Act', which, in particular, protects the main information communication infrastructure from cyber infringement. In addition, it conducts management supervision such as analysis and evaluation of vulnerability, establishment of protection measures, implementation of protection measures, and distribution of technology guides. Even now, security consulting is proceeding on the basis of 'Guidance for Evaluation of Technical Vulnerability Analysis of Major IT Infrastructure Facilities'. There are neglected inspection items in the applied items, and the vulnerability of APT attack, malicious code, and risk are present issues that are neglected. In order to eliminate the actual security risk, the security manager has arranged the inspection and ordered the special company. In other words, it is difficult to check against current hacking or vulnerability through current system vulnerability checking method. In this paper, we propose an efficient method for extracting diagnostic data regarding the necessity of upgrading system vulnerability check, a check item that does not reflect recent trends, a technical check case for latest intrusion technique, a related study on security threats and requirements. Based on this, we investigate the security vulnerability management system and vulnerability list of domestic and foreign countries, propose effective security vulnerability management system, and propose further study to improve overseas vulnerability diagnosis items so that they can be related to domestic vulnerability items.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.05a
• /
• pp.456-460
• /
• 2012

Privacy Protection Act of 30 March 2012 was performed. In general, personal information management to enhance security in the DB server has a security system but, PC for the protection of the privacy and security vulnerability analysis is needed to research on self-diagnosis. In this paper, from a PC to search information relating to privacy and enhance security by encrypting and for delete file delete recovery impossible. In pc found vulnerability analysis is Check user accounts, Checking shared folders ,Services firewall check, Screen savers, Automatic patch update Is checked. After the analysis and quantification of the vulnerability checks through the expression, enhanced security by creating a checklist for the show, PC security management, server management by semi-hwahayeo activates. In this paper the PC privacy and PC security enhancements a economic damage and of the and Will contribute to reduce complaints.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.629-632
• /
• 2002

공공기관은 자신의 정보시스템에 대한 보안 대책을 수립하기 위하여 자체 보안·분석평가를 수행함으로써 적절한 보안 목표와 방향을 설정해야 한다. 하지만, 현재 연구되어 있는 위험분석 및 보안평가방법론등은 복잡하고 전문적인 사항이 많으므로 자체 보안분석을 수행하기에는 인력 및 비용이 많이 소요된다. 이를 위하여 본 논문에서는 정보시스템의 위험분석방법론에서 제시하는 자산, 취약점, 위협, 대응책에 보안평가방법론을 포함하여 정보시스템에 대한 모델링, 가정, 증상, 원인, 해결책등을 통한 자가진단 보안 분석·평가 방법을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.1115-1118
• /
• 2002

최근 해킹 기술이 다양화되고, 사용하기 손쉬운 해킹 툴들이 개발되고 확산되면서, 라우팅 프로토콜의 취약점을 이용한 해킹 사례 또한 급증하고 있다. 이는 RIP, OSPF, BGP 등의 초기 인터넷 라우팅 프로토콜이 보안에 대한 고려 없이 설계되어서, 이에 대한 간단한 패스워드 및 MD5 인증 등의 보완책으로 등장한 RIPv2, OSPFv2 BGPv4 등도 그 취약성을 계승하고 있기 때문이다. 따라서 현재의 전반적인 라우팅 프로토콜에 문제점을 파악하고, 이를 해결하기 위한 연구가 필요하다. 본 논문에서는 이러한 취약사항들을 이용한 위협 모델들을 분석하고, 이들 위협으로부터 미리 방비할 수 있도록 진단할 수 있는 시스템을 설계 및 구현에 대한 방법을 제시한다.

• Journal of Digital Contents Society
• /
• v.15 no.1
• /
• pp.121-128
• /
• 2014

SSE-CMM for security engineering, engineering, assurance, risk is divided into three elements of the process maturity assessment model and the level of information security presented. Maturity measurement of privacy, vulnerability diagnosis and risk analysis methodologies is used in practical field for present a comprehensive conclusion. The common cyber services are internet banking, mobile banking, telephone banking and the like. Transaction structure, a kind of cyber-banking system, information security maturity of the existing measurement methodologies for research purposes, vulnerability diagnosis and risk analysis methodologies to be used in practical field present a comprehensive conclusion. To ensure safety and convenience for the user, convenient to deal with cyber environment is the key to the activation of cyber trading. Particularly by measuring the maturity of cyber banking system to ensure the safety of the practice field much effects are expected as a result.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.2
• /
• pp.101-111
• /
• 2004

Risk analysis process, which identifies vulnerabilities and threat causes of network assets and evaluates expected loss when some of network assets are damaged, is essential for diagnosing ISP network security levels and response planning. However, most existing risk analysis systems provide only methodological analysis procedures, and they can not reflect continually changing vulnerabilities and threats information of individual network system on real time. For this reason, this paper suggests new system design methodology which shows a scheme to collects and analyzes data from network intrusion detection system and vulnerability analysis system and estimate quantitative risk levels. Additionally, experimental performance of proposed system is shown.

• Proceedings of the Korea Contents Association Conference
• /
• 2016.05a
• /
• pp.317-318
• /
• 2016

급속한 현대사회의 정보화로 인하여 개인 정보에 대한 정보 유출 및 위협의 빈도가 높아지고 있는 상황에서 기존의 디지털 포렌식 수사 모델에서 사용하고 있는 해시 검색 프로세스는 개인정보 노출에 취약한 파일이 존재하고 있다. 이에 본 논문에서는 개인정보 노출 취약점 진단을 추가한 해시 검색 프로세스를 제안한다. 이를 통하여 정밀 조사와 일반 조사 대상을 정확하게 파악할 수 있을 것으로 기대된다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.643-644
• /
• 2009

금융권 정보보안 강화를 위해 관리적 기술적 측면의 정보보안 요구사항을 분석하였다. 금융분야는 IT법규 준수가 중요하기 때문에 기반시설의 취약점 진단을 위해서 사용되는 정보보호수준평가의 통제분야에 IT법규 중 법률 및 정보보호활동 내역을 포함되어야 하며, 자산보호 및 서비스 연속성 보호를 위해 웹 애플리케이션의 취약점을 보호해야 한다.