• 한국병원경영학회지
• /
• 제13권3호
• /
• pp.1-16
• /
• 2008

According to Myers (1984) and Myers and Majluf(1984), there exists a financial hierarchy from internal to external financing, from long-tenn debt to equity, due to information costs. The purpose of this study is to assess the profit-making corporation of healthcare institutions. Data was collected from 130 hospital presidents and financial managers. We analysed the frequency and one way ANOVA by SPSS Windows 14.0K. The major findings of the study were as follows: We found that the priorities which a healthcare institutions financing were internal financial, other allowance, a credit loan, a security loan, and a lease through this study. The priorities which a healthcare institutions raised the capital differed as to the number of beds and revenues. The priorities were no difference from ownership, location and an annual business.

• 산업경영시스템학회지
• /
• 제39권4호
• /
• pp.97-105
• /
• 2016

As information system is getting higher and amount of information assets is increasing, skills of threatening subjects are more advanced, so that it threatens precious information assets of ours. The purpose of this study is to present a strategic direction for the types of companies seeking access to information security. The framework classifies companies into eight types so company can receive help in making decisions for the development of information security strategy depending on the type of company it belongs to. Paired comparison method survey conducted by a group of information security experts to determine the priority and the relative importance of information security management elements. The factors used in the security response strategy are the combination of the information security international certification standard ISO 27001, domestic information protection management system certification K-ISMS, and personal information security management system certification PIMS. Paired comparison method was then used to determine strategy alternative priorities for each type. Paired comparisons were conducted to select the most applicable factors among the 12 strategic factors. Paired comparison method questionnaire was conducted through e-mail and direct questionnaire survey of 18 experts who were engaged in security related tasks such as security control, architect, security consulting. This study is based on the idea that it is important not to use a consistent approach for effective implementation of information security but to change security strategy alternatives according to the type of company. The results of this study are expected to help the decision makers to produce results that will serve as the basis for companies seeking access to information security first or companies seeking to establish new information security strategies.

• 대한안전경영과학회지
• /
• 제14권3호
• /
• pp.119-126
• /
• 2012

Recently, the breakdown of online banking servers and the leakage of customer information give rise to much concern about the security of information systems in financial and banking companies in Korea. The enforcement of security for information system becomes much more important issue than earlier. However, the security reinforcement of information system is restricted by a budget. In addition, the activities' cost to secure information system from threatening are under uncertain circumstances and should be established by a human decision maker who is basically uncertain and vague. Thus, making the budget for information system is exposed to any extent of the risk for these reasons. First, we introduce brief fuzzy set theory and fuzzy AHP (Analytic Hierarchy Process) methodology. Then, the cost elements that comprise yearly budget are presented and the priorities among the cost elements are calculated by fuzzy AHP. The cost elements that are exposed to risk are evaluated from the both perspectives of the risk impact and risk occurrence possibility which are expressed as linguistic terms. To get information on the risk profiles-pessimistic, most likely, and optimistic-for each cost element, the evaluation is accomplished and the result is presented. At last, the budget ranges-minimum, mode, maximum-for each cost element are estimated with the consideration of the risk profiles.

• 산업경영시스템학회지
• /
• 제38권4호
• /
• pp.193-201
• /
• 2015

Corporation's valuable intelligent asset is being threatened from the skills of threatening subject that has been evolved along with the growth of the information system and the amount of the information asset. Domestically, attempts of various private information attacks, important information extortion, and information damage have been detected, and some of them have abused the vulnerability of security of information system, and have become a severe social problem that generates security incident. When accessing to the security, most of companies used to establish a strategy with a consistent manner and a solution plan. However, this is not a proper way. The order of priorities vary depending on the types of business. Also, the scale of damage varies significantly depending on the types of security incidents. And method of reaction and critical control point vary depending on the types of business and security incidents. In this study, I will define the security incidents by their types and preponderantly examine how one should react to those security incidents. In this study, analyzed many types of security accidents that can occur within a corporation and an organization considering various factors. Through this analysis, thought about factors that has to be considered by corporations and organizations when they intend to access to the information security. This study focuses on the response methodology based on the analysis of the case analysis of the leakage of industrial secret and private secret other than the conceptual response methodology that examines the way to prevent the leakage of the industry security systems and the industry information activities. And based on these factors, want to be of help for corporations to apply a reasonable approach when they establish a strategy to information security.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제7권4호
• /
• pp.860-877
• /
• 2013

Cloud computing has become one of the most important technologies for reducing cost and increasing productivity by efficiently using IT resources in various companies. The cloud computing system has mainly been built for private enterprise, but public institutions, such as governments and national institutes, also plans to introduce the system in Korea. Various researches have pointed to security problems as a critical factor to impede the vitalization of cloud computing services, but they only focus on the security threats and their correspondents for addressing the problems. There are no studies that analyze major security issues with regard to introducing the cloud computing system. Accordingly, it is necessary to research the security factors in the cloud computing given to public institutions when adopting cloud computing. This research focuses on the priority of security solutions for the stepwise adoption of cloud computing services in enterprise environments. The cloud computing security area is classified into managerial, physical and technical area in the research, and then derives the detailed factors in each security area. The research derives the influence of security priorities in each area on the importance of security issues according to the identification of workers in private enterprise and public institutions. Ordered probit models are used to analyze the influences and marginal effects of awareness for security importance in each area on the scale of security priority. The results show workers in public institutions regard the technical security as the highest importance, while physical and managerial security are considered as the critical security factors in private enterprise. In addition, the results show workers in public institutions and private enterprise have remarkable differences of awareness for cloud computing security. This research compared the difference in recognition for the security priority in three areas between workers in private enterprise, which use cloud computing services, and workers in public institutions that have never used the services. It contributes to the establishment of strategies, with respect to security, by providing guidelines to enterprise or institutions that want to introduce cloud computing systems.

• 융합보안논문지
• /
• 제20권5호
• /
• pp.41-52
• /
• 2020

본 논문은 보안 이벤트 위험성에 따른 능동적 대응을 위해서 우선순위 알고리즘을 구현하는 것이며, 이를 기반으로 효율적인 이벤트 처리를 수행하는 이벤트 스케줄러를 구현하고자 한다. CVE나 CVSS 같이 세계적으로 표준을 가지고 있는 기준에 따라, 보안 이벤트를 실행시켰을 때 점수를 매길 수 있는 기준을 마련하고, 정형화 하여 보다 객관적으로 우선순위를 정할 수 있도록 한다. 그래서 이를 바탕으로 보안 이벤트 데이터베이스를 구축하고, 이를 이용하여 스케줄링을 할 수 있도록 한다. 또한 보안 이벤트 스케줄링 우선순위 알고리즘을 우리나라 보안 이벤트 실정에 맞게 개발하고 적용함으로써 국내 기관 및 기업의 정보보호에 대한 신뢰성 확보와 산업 발전에 기여하게 될 것이다.

• Journal of Electrical Engineering and information Science
• /
• 제2권5호
• /
• pp.89-99
• /
• 1997

The application for real-time database systems must satisfy timing constraints. Typically the timing constraints are expressed in the form of deadlines which are represented by priorities to e used by schedulers. In any real-time applications, since the system maintains sensitive information to be shared by multiple users with different levels of security clearance, security is another important requirement. As more advanced database systems are being used in applications that need to support timeliness while managing sensitive information, protocols that satisfy both requirements need to be developed. In this appear, we proposed a new priority-driven secure multiversion locking (PSMVL) protocol for real-time secure database systems. The schedules produced by PSMVL are proven to e one-copy serializable. We have also shown tat the protocol eliminates covert channels and priority inversions. The details of the protocol, including the compatibility matrix and the version selection algorithms are presented. the results of the performance comparisons of our protocol with other protocols are described.

• 정보보호학회논문지
• /
• 제28권1호
• /
• pp.229-239
• /
• 2018

본 논문은 기존의 CCTV가 가진 문제점을 분석하고, 클라우드 컴퓨팅 환경에서의 IP-CCTV를 사용할 때, 보안문제점에 대하여 논한다. 클라우드 서비스 제공과 관련된 보안 위험을 단순히 위험 현상만 제거하는 실수를 줄이기 위해서는 위험 분석과 조치에 대한 효과적인 수행 방법이 필요하다. 이에 따라, Threat Risk Modeling의 STRIDE 모델을 통하여 위협 분석을 하고, 위협 분석된 내용을 토대로 Analytic Hierarchy Process(AHP) 방법론을 사용하여 위험 우선순위를 측정하였으며, 우선순위에 대한 적절한 해결방법이 무엇인지를 분석하였다.

• 시큐리티연구
• /
• 제42호
• /
• pp.155-178
• /
• 2015

본 연구는 산업보안의 주체인 기업을 대상으로, 기업의 기밀 보호를 위한 정부 정책의 우선 순위가 무엇인지, 산업보안을 위한 정부 지원 규모의 확대가 필요한지를 조사하였다. 우선 순위를 결정하는데 있어 기밀 보호와 관련된 기업, 개인, 사회, 정부 등의 의견과 입장을 모두 고려해야 할 것이나, 산업보안 특히 기밀 보호의 주체, 기밀 보호 정책의 수혜자, 수요자로 가장 중요하고 직접적인 당사자인 기업이 요구하는 것들이 지원 정책 결정의 기초가 될 수 있을 것으로 보았다. 이에 따라, 우리나라 기업의 보안 부서 근무자 또는 보안 담당자에게 설문지 발송을 통해 회수된 설문지중 유효한 것으로 판단된 50개를 분석하였으며, '교육 및 인력육성(On/Off-Line) 지원 강화,' '보안관련 관리 및 대책수립,' '자격/검정제도를 통한 보안전문가 위상 강화'가 기업의 기밀(고객 개인정보 포함) 보호를 위해 정부차원에서 가장 우선적으로 지원해야 할 정책 방향 1, 2, 3 순위로 조사되었다. 산업보안을 위한 정부 지원의 확대가 필요한지에 대해서는 조사 대상자 모두 필요하다고 응답하였다.

• 한국정보통신학회:학술대회논문집
• /
• 한국해양정보통신학회 2011년도 추계학술대회
• /
• pp.237-240
• /
• 2011

행정기관 인터넷전화를 구축하여 사용하는 국가정보통신서비스 'C'그룹 사업자에는 KT, SK브로드밴드, LG유플러스, 삼성SDS 4개 사업자가 있다. 행정기관 인터넷전화에 대한 공격을 대비하여 보안 대응 모델에 대한 연구가 필요하다. 본 논문에서는 행정기관 인터넷전화 사업자 별로 보안 대응 대책을 내용으로 조사 분석한다. 행정기관 인터넷전화 보안 침해 모델 개발 연구를 위해 국정원의 5가지 보안 위협에 대해 기밀성을 중심으로 우선순위를 설정하여 (1)불법 도청 (2)호 가로채기 (3)서비스 오용 (4)서비스거부 공격 (5)인터넷전화 스팸 공격에 대한 공격 시나리오 작성하여 분석한다. 행정기관 인터넷전화 보안 대응 모델 개발 연구는 보안 위협별 보호 기술 분석과 보안 침해 단계별 대응 체계 연구를 통해 단계별 대응 모델 개발 연구를 한다.