• Journal of the Korea Society of Computer and Information
• /
• v.12 no.4
• /
• pp.239-248
• /
• 2007

There's been a difficulty for general corporate to adopt recent incident response study because those studies focus on nation wide CERT Coordination Center or large organization aspect. This study is focus on study and design on security ticket based CERT system through analysis Security management's threat element, attack element, response element and it also help general corporate establish incident response process that is adjusted on IT operation. Confirmed CERT model's effectiveness and effect of quantitative Security incident management way that propose executing Security incident response experiment on the basis of this way. This study which provides general corporate oriented CERT model can be used to improve corporate's capability of responding incident by quantified management technique and select incident response SLA indicator. Already, formation which operate CERT can heighten corporation's information protection level by measure Security incident response result as metrical and analyze and improve problem continuously.

• KSCI Review
• /
• v.15 no.1
• /
• pp.141-150
• /
• 2007

There's been a difficulty for general corporate to adopt recent incident response study because those studies focus on nation wide CERT Coordination Center or large organization aspect. This study is focus on study and design on security ticket based CERT system through analysis Security management's threat element, attack element. response element and it also help general corporate establish incident response process that is adjusted on IT operation. Confirmed CERT model's effectiveness and effect of quantitative Security incident management wav that propose executing Security incident response experiment on the basis of this way. This study which Provides general corporate oriented CERT model can be used to improve corporate's capability of responding incident by quantified management technique and select incident response SLA indicator. Already, formation which operate CERT can heighten corporation's information protection level by measure Security incident response result as metrical and analyze and improve problem continuously.

• 정보보호뉴스
• /
• s.134
• /
• pp.19-21
• /
• 2008

기업마다 국가마다 정보보호에 대한 문화 차이는 존재하기 마련이다. 하지만 그 차이가 크다고는 볼 수 없다. 다양한 공격기법에 대한 대응방안 마련. 기업 정보보호의 방향 수립, 정보보호 교육방식 등 기업 보안 조직이나, 국가 CERT의 관심과 고민이 비슷하기 때문이다. 이런 생각은 호주 침해사고대응팀(이하:AusCERT)에 몸담고 있는 Robert Lowe와의 인터뷰에서 더욱 잘 알 수 있었다. AusCERT는 우리와 같은 고민을 어떻게 풀어가고 있는지 소개해 본다. Robert Lowe는 AusCERT의 침해사고 분석 전문가로 활동했으며, 현재는 AusCERT의 교육 및 컨퍼런스 책임자로 활동하고 있다.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.11-17
• /
• 2022

Cyber attacks on national infrastructure, including large-scale power outages in Ukraine, have continued in recent years. As a result, ICS-CERT vulnerabilities have doubled compared to last year, and vulnerabilities to industrial control systems are increasing day by day. Most control system operators develop vulnerability countermeasures based on the vulnerability information sources provided by ICS-CERT in the United States. However, it is not applicable to the security of domestic control systems because it does not provide weaknesses in Korean manufacturers' products. Therefore, this study presents a vulnerability analysis framework that integrates CVE, CWE, CAPE, and CPE information related to the vulnerability based on ICS-CERT information (1843 cases). It also identifies assets of nuclear facilities by using CPE information and analyzes vulnerabilities using CVE and ICS-CERT. In the past, only 8% of ICS-CERT's vulnerability information was searched for information on any domestic nuclear facility during vulnerability analysis, but more than 70% of the vulnerability information could be searched using the proposed methodology.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.243-253
• /
• 2022

Recently, cyber attacks on national infrastructure facilities have continued to occur. As a result, the vulnerabilities of ICS-CERTs have more than doubled from last year, and the vulnerabilities to industrial control systems such as nuclear facilities are increasing day by day. Most control system operators formulate vulnerability countermeasures based on the vulnerability information sources of industrial control systems provided by ICS-CERT in the United States. However, it is difficult to apply this to the security of domestic control systems because ICS-CERT does not contain all relevant vulnerability information and does not provide vulnerabilities to domestic manufacturer's products. In this research, we will utilize publicly available vulnerability-related information such as CVE, CWE, ICS-CERT, and CPE to discover vulnerabilities that may exist in control system assets and may occur in the future. I proposed a plan that can predict possible vulnerabilities and applied it to information on major domestic control systems.

• Proceedings of the CALSEC Conference
• /
• 2001.08a
• /
• pp.155-163
• /
• 2001

There are cases that revoke the certification because of disclosure of private key, deprivation of qualification and the expiration of a term of validity based on PKI. So, a user have to confirm the public key whether valid or invalid in the certification. There are many method such as CRL, Delta-CRL, OCSP for the cert-validation of certification. But these method many problems which are overload traffic on network and the CRL server because of processing for cert-validation of certification. In this paper we proposed the realtime cert-validation of certification method which solved problems that are data integrity by different time between transmission and receiving for CRL, and overload traffic on network and the CRL server based on DARC.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.5
• /
• pp.109-127
• /
• 2011

Mobile Office is a new type of working method in the workplace that can be used at any time or anywhere by connecting to the network with mobile devices. This allows people to do their jobs without their physical presence in their offices to use computers. The elements in mobile office environment are advancing. They include the widespread distribution of the smart phones, the network enhancing strategy in a ubiquitous environment and expansion of the wireless internet; however, there are not enough security guidelines or policies against these threats on the new environment, the mobile office, although there is the revitalization policy of smart work supported by the government. CERT and ISAC, the known security system as of now, could be used for the secure mobile office, In this paper, suggestions are to be provided for strengthening the security of smart mobile office by analysing the functions of CERT and ISAC.

• The KIPS Transactions:PartC
• /
• v.8C no.5
• /
• pp.517-524
• /
• 2001

There are cases that revoke the certification because of disclosure of private key, deprivation of qualification and the expiration of a term of validity based on PKI. So, a user have to confirm the public key whether valid or invalid in the certification. There are many method such as CRL, Delta-CRL, OCSP for the cert-validation of certification. But these method many problems which are overload traffic on network and the CRL server because of processing for cert-validation of certification. In this paper we proposed the realtime cert-validation of certification method which solved problems that are data integrity by different time between transmission and receiving for CRL, and overload traffic on network and the CRL server based on DARC.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.3
• /
• pp.3-13
• /
• 2002

There are cases that revoke the certification because of disclosure of private key, deprivation of qualification and the expiration of a term of validity on PKI. So, a user has to confirm the public key whether valid or invalid in the certification. There are many methods such as CRL, Delta-CRL, OCSP for the cert-validation of certification. But these methods have many problems, which cause overload traffic on network and the CRL server because of realtime processing for cert-validation of certification. In this paper we proposed cert-validation of certification improvement method based on FM Subcarrier Broadcasting, which solved problems that are data integrity by different time between transmission and receiving for CRL, and overload traffic on network and the CRL server the realtime management.

• 정보보호뉴스
• /
• s.125
• /
• pp.19-21
• /
• 2008

기업이나 기관의 네트워크, 시스템에 침해사고 발생 시 신속한 대응과 예방활동을 펼치는 조직을 CERT(Computer Emergency Response Team)라고 한다. 국내 기업들 가운데 정보보호의 중요성을 깨닫고, IT 자산 보호의 일환으로 적지 않은 기업이 정보보호팀을 운영하고 있지만, 정작 CERT라는 이름을 내걸고 보안활동을 펼치는 기업은 그리 많지 않다. 그런 의미에서 지난해 개최된 정보보호대상에서 우수상을 차지한 현대정보기술은 국내에서 CERT라는 이름을 가진 몇 안 되는 기업 중 하나다.