• International Journal of Computer Science & Network Security
• /
• v.23 no.5
• /
• pp.65-72
• /
• 2023

Cloud Computing is one of the current research areas in computer science. Recently, Cloud is the buzz word used everywhere in IT industries; It introduced the notion of 'pay as you use' and revolutionized developments in IT. The rapid growth of modernized cloud computing leads to 24×7 accessing of e-resources from anywhere at any time. It offers storage as a service where users' data can be stored on a cloud which is managed by a third party who is called Cloud Service Provider (CSP). Since users' data are managed by a third party, it must be encrypted ensuring confidentiality and privacy of the data. There are different types of cryptographic algorithms used for cloud security; in this article, the algorithms and their security measures are discussed.

• The Journal of the Korea Contents Association
• /
• v.17 no.4
• /
• pp.596-605
• /
• 2017

Recently, it has been pointed out that the lack of professional ethics of computer and security experts is serious as college students majoring in information security and insiders who are in charge of security work are involved in crimes after being tempted to cyber crimes. In this paper, we investigate and analyze the security ethics awareness and education situation of college students majoring in information security, and examine the security ethics education method for human resource development with personality and qualities. As the information society becomes more widespread, the ethics and occupational consciousness of the university students who are majoring in information security are recognized as lack of awareness and education about security ethics, As a solution to solve these problems, it is expected that it will be possible to nurture security experts who are aware of their vocation through the educational plan to enhance the security ethics of the information security major college students. According to the security ethics education system proposed in the paper, the security ethical consciousness of the group that received education was remarkably improved.

• THE INTERNATIONAL COMMERCE & LAW REVIEW
• /
• v.75
• /
• pp.29-48
• /
• 2017

This study describes the retention of title under UCC. UCC ${\S}$ 2-401 prescribes that any retention or reservation by the seller of the title (property) in goods shipped or delivered to the buyer is limited in effect to a reservation of a security interest. It means that the retention of title generates a security interest in the same way like a charge. To be effective, a security interest must be attached or perfected. Once attachment occurs, a security interest is enforceable against the buyer. Once a security interest is perfected, a security interest is enforceable against third parties. Under UCC, a simple retention of title clause is valid as long as it is incorporated into the contract of sale. If the seller acquires a perfected security interest, he as a secured party can enjoy a priority against other creditors. But if a security interest is not perfected but PMSI is afforded, the seller has a special priority. Secondly, under UCC ${\S}$ 9-335 and 9-336, if a security interest under an enlarged retention of title clause is perfected, the seller as the secured party has a valid security interest in the product or mass into which his goods have been mixed or commingled. But in terms of assession of goods, as the seller has a security interest only in his goods, if the seller wants to enlarge his security interest in the whole, a security agreement should cover its intention. Thirdly, under UCC ${\S}$ 9-315, a security interest in proceeds of subsale of goods supplied by the seller is a perfected security interest if the security interest in the original collateral was perfected. But if the proceeds are cash proceeds, it should be identifiable from other funds of the buyer.

• Convergence Security Journal
• /
• v.17 no.1
• /
• pp.39-44
• /
• 2017

The existing enterprise information security activities were centered on the information security organization, and the top management considers information security and enterprise management to be separate. However, various kinds of security incidents are constantly occurring. In order to cope with such incidents, it is necessary to protect information in terms of business management, not just information security organization. In this study, we examine the existing corporate governance and IT governance, and present an information security governance model that can reflect the business goals of the enterprise and the goals of the management. The information security governance model proposed in this paper induces the participation of top management from the planning stage and establishes information security goals. We can strengthen information security activities by establishing an information security plan, establishing and operating an information security system, and reporting the results to top management through compliance audit, vulnerability analysis and risk management.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.17 no.4
• /
• pp.193-201
• /
• 2017

Financial firms strengthen to protect personal information from the leakage, introducing various security solutions such as print output security, internet network Isolation system, isolationg strorage of customer information, encrypting personal information, personal information detecting system, data loss prevention, personal information monitoring system, and so on. Financial companies are also entering the era of cutthroat competition due to accept of the new channels and the paradigm shift of financial instruments. Accordingly, The needs for security for customer information held by financial firms are keep growing. The large security accidents from the three card companies on January 2014 were happened, the case in which one of the outsourcing personnel seized customer personal information from the system of the thress card companies and sold them illegally to a loan publisher and lender. Three years after the large security accidents had been passed, nevertheless the security threat of the IT outsourcing workforce still exists. The governments including the regulatory agency realted to the financail firms are conducting a review efforts to prevent the leakage of personal information as well as strengthening the extent of the sanction. Through the analysis on the application of security policy for outsourcing personnel in case of large-scale Financial IT projects and the case study of appropriate security policies for security compliance, the theis is proposing a solution for both successfully completing large-scale financial IT Project and so far as possible minizing the risk from the security accidents by the outsouring personnel.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.6
• /
• pp.219-224
• /
• 2020

The purpose of this study is mainly to provide theoretical basis of private security industry by analyzing the perception and flow of private security from the press-released materials according to periodic classification and duties through 'Big Kinds', a website of analyzing news big data. The research method has been changed to structured data to allow an analysis of various scattered unstructured data, and the keywords trend and related words by duties of private security were analyzed in growth period of private security. The perception of private security based on the results of the study was exposed a lot by the media through various crimes, accidents and incidents, and the issues related permanent position. Also, it tended to be perceived as a simple security guard, not recognized as the area of private security, and judging from the high correlation between private security and police, it was recognized not only as a role to assist the police force, but also as a common agent in charge of the public peace. Therefore, it should objectively judge the perception of private security, and through this, it is believed that it should be a foundation for recognizing private security as a main agent responsible for the safety of the nation and maintaining social orders.

• Journal of Information Technology Services
• /
• v.15 no.4
• /
• pp.63-72
• /
• 2016

Critical infrastructure has been operating in a closed environment with a completely separate information system and in the private area. However, with the current ICT environment changes due to convergence and open platforms it has increased the threats and risks to critical infrastructure. The importance of cyber security is increasing in the infrastructure control system, such as the outbreak of Ukraine blackout in 2015 by a malicious code called 'black energy'. This thesis aims to recognize the importance and necessity of protecting the critical infrastructure service, designing a security framework reflecting environmental and characteristic changes, and analyzing the management system suitable for a security framework. We also propose a theoretical basis for constructing a new security framework by comparing and analyzing seven international security management system standards, such as NIST 800-82 and IEC 62443-2-1, which are used in the control system. As a result, the environment surrounding critical infrastructure changes with the characteristics of connectivity, openness, and finality was studied, and as a response to this, many scholars and institutions present critical infrastructure security frameworks as cycle enhancement type structures, risk management structures, and management domain expansion structures. In response, the security framework encompassing these structures, CISF (Critical Infrastructure Security Framework), was designed. Additionally, through the security related international standard and criterion analysis, as a newly designed security standard suitable for CISF, IEC 62443-2-1 is reviewed and suggestions are made.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.5
• /
• pp.1335-1348
• /
• 2016

Smart factory of Manufacturing sector is rapidly spreading, globally. In case of domestic, it is on going based on KOSF. It is neither lack of invest nor security of information due to it has been spread from manufacturing sector. Hence, that's very difficult to efficiency prevent from new type of intimidation and security accident happened sometimes from this situation. According to research information security condition with recognized new menace, there is a most efficient way is provide education of information security without any extra budget to safely spread smart factory. Thus, this study of research has developed security awareness training curriculum from international standard, requirement of the industry, and curriculum of educational institution based on NCS (National Competency Standard). It is be very helpful to spread smart factory safely due to expert group has been test of validity.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.6
• /
• pp.1563-1583
• /
• 2018

With the deregulation of electronic finance, FinTech has been revitalized. The discussion on artificial intelligence is active in the financial industry. However, there is a problem of increasing security threats behind new technologies. Security vulnerabilities have increased because we are more connected than before, and the channels and entities of the financial industry have diversified. Although there are technical and policy discussions on security, the essence of all discussions is human. Fundamentals of finance are trust and security, and attention to human factors is important. This study presents the role of human and artificial intelligence for financial security, respectively. Furthermore, this derives a collaborative model in which human and artificial intelligence complement each other's limitations. To support this, it first discusses the development of finance and IT, AI, human factors, and financial security threats. This study suggests that the security threats will intensify in the era of new technology, but it can overcome them by using machinery and technology.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.133-138
• /
• 2007

As a formal document that expresses a set of security requirements for IT products that meets specific consumer needs in the ISO/IEC 15408(CC, Common Criteria) evaluation, protection profiles are developing by many national agencies and companies recently. Since a protection profile is a criteria for security evaluation when the IT systems and products are introduced, the importance of the protection profile is increasing. However, developing protection profiles are still difficult due to lack of detailed methodology and guidance to analyze security environments or to derive security requirements. In this paper, we analyze foreign instances of developing protection profiles and propose a methodology for deriving security requirements through analyzing the TOE security environment.