• Journal of Korea Society of Digital Industry and Information Management
• /
• v.6 no.4
• /
• pp.307-317
• /
• 2010

The majority of financial and general business organizations have had individual damage from hacking, worms, viruses, cyber attacks, internet fraud, technology and information leaks due to criminal damage. Therefore privacy has become an important issue in the community. This paper examines various elements of the information security management system and discuss about Information Security Management System Models by using the analysis of the financial statue and its level of information security assessment. These analyses were based on the Information Security Management System (ISMS) of Korea Information Security Agency, British's ISO27001, GMITS, ISO/IEC 17799/2005, and COBIT's information security architecture. This model will allow users to manage and secure information safely. Therefore, it is recommended for companies to use the security management plan to improve the companies' financial and information security and to prevent from any risk of exposing the companies' information.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.187-196
• /
• 2020

In order to manage information security risk, various information security level evaluation and information security management system certification have been conducted on a larger scale than ever. However, there are continuous cases of infringement of information protection for companies with excellent information security evaluation and companies with excellent information security management system certification. The existing information security risk management methodology identifies and analyzes risks by identifying information assets inside the information system. Existing information security risk management methodology lacks a review of where cyber threats come from and whether security devices are properly operated for each route. In order to improve the current risk management plan, it is necessary to look at where cyber threats come from and improve the containment level for each inflow section to absolutely reduce unnecessary cyber threats. In addition, it is essential to measure and improve the appropriate configuration and operational level of security equipment that is currently overlooked in the risk management methodology. It is necessary to block and enter cyber threats as much as possible, and to detect and respond to cyber threats that inevitably pass through open niches and use security devices. Therefore, this paper proposes additional evaluation items for evaluating the containment level against cyber threats in the ISMS-P authentication items and vulnerability analysis and evaluation items for major information and communication infrastructures, and evaluates the level of security equipment configuration for each inflow.

• Journal of Convergence for Information Technology
• /
• v.7 no.2
• /
• pp.119-124
• /
• 2017

Information is a valuable asset regardless of the size of the enterprise and information security is an essential element for the survival and prosperity of the enterprise. However, in the case of large corporations, Security is ensured through rapid introduction of information security management system. but In the case of SMEs, security systems are not built or construction is delayed due to complex factors such as budget constraints, insufficient security guidelines, lack of security awareness. In this paper, we analyze the actual situation of information security management of SMEs through questionnaires, and We would like to suggest a comprehensive security plan for SMEs in free or inexpensive ways. We believe that by applying the method presented in this paper, SMEs will be able to implement the lowest cost basic information security and will benefit SMEs who plan to establish an information security plan.

• Journal of KIISE:Computer Systems and Theory
• /
• v.34 no.7
• /
• pp.282-287
• /
• 2007

Information society is dramatically developing in the various areas of finance, trade, medical service, energy, and education using information system. Evaluation for risk analysis should be done before security management for information system and security risk analysis is the best method to safely prevent it from occurrence, solving weaknesses of information security service. In this paper, Modeling it did the evaluation-base CBD function it will be able to establish the evaluation plan of optimum. Evaluation-based CBD(case-based reasoning) functions manages a security risk analysis evaluation at project unit. it evaluate the evaluation instance for beginning of history degree of existing. It seeks the evaluation instance which is similar and Result security risk analysis evaluation of optimum about under using planning.

• Convergence Security Journal
• /
• v.17 no.1
• /
• pp.39-44
• /
• 2017

The existing enterprise information security activities were centered on the information security organization, and the top management considers information security and enterprise management to be separate. However, various kinds of security incidents are constantly occurring. In order to cope with such incidents, it is necessary to protect information in terms of business management, not just information security organization. In this study, we examine the existing corporate governance and IT governance, and present an information security governance model that can reflect the business goals of the enterprise and the goals of the management. The information security governance model proposed in this paper induces the participation of top management from the planning stage and establishes information security goals. We can strengthen information security activities by establishing an information security plan, establishing and operating an information security system, and reporting the results to top management through compliance audit, vulnerability analysis and risk management.

• Journal of the Korean Data and Information Science Society
• /
• v.22 no.2
• /
• pp.207-215
• /
• 2011

This Risk analysis on information related assets is conducted primarily according to the standards the Korea Information and Telecommunications Technology Association (TTA) or the International Organization for Standardization (ISO). The process is made of asset analysis, threat analysis, vulnerability analysis, and response plan analysis. The risk for information related assets belongs to the operational risks suggested by BIS (Bank for International Settlements) and the information related losses can be estimated in terms of BIS' suggestion. In this paper it is proposed that how to apply the method proposed by BIS to estimate the loss of information assets.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.5
• /
• pp.1323-1333
• /
• 2016

According to spreading of smart devices and development of communication technology, the security issues come to the fore in the modern factory. Especially, the smart facpry should be considered the risk management plan how to identify and evaluate, control the risks. In this paper, we suggest the minimum security requirements applying SFRPN(Smart Factory Risk Priority Number) model to domestic smart factory on the basis of the results inspecting factories.

• Korean Security Journal
• /
• no.10
• /
• pp.189-213
• /
• 2005

Risk management should be controlled systematically by effectively evaluating and suggesting countermeasures against the various risks which are followed by the change of the society and environment. These days, enterprise risk management became a new trend in the field. The first step in risk analysis is to recognize the risk factors, that is to verify the vulnerabilities of loss in the security facilities. The second step is to consider the probability of loss in assessing the risk factors. And the third step is to evaluate the criticality of loss. The security manager will determine the assessment grades and then the risk levels of each risk factor, on the basis of the result of risk analysis which includes the assessment of vulnerability, the provability of loss and the criticality. It is of great importance to put the result of risk analysis in mathematical statement for a scientific approach to risk management. Using the risk levels gained from the risk analysis, the security manager can develop a comprehensive and supplementary security plan. In planning the risk management measures to prepare against and minimize the loss, insurance is one of the best loss-prevention programs. However, insurance in and of itself is no longer able to meet the security challenges faced by major corporations. The security manager have to consider the cost-effectiveness, to suggest the productive risk management alternatives by using the security files which contains every information about the security matters. Also he/she have to reinforce the company regulations on security and safety, and to execute education repeatedly on security and risk management. Risk management makes the most efficient before-the-loss arrangement for and after-the-loss continuation of a business. So it is very much important to suggest a best cost-effective and realistic alternatives for optimizing risk management above all, and this function should by maintained and developed continuously and repeatedly.

• Management & Information Systems Review
• /
• v.7
• /
• pp.381-400
• /
• 2001

Our country has been encountered with severe economic depression since IMF loan(1997). Korean economic system should be reformed according to the globalization and the world industrial trends based on adavanced technologies and skills. Todays the venture business should be considered to be the alternative of recovering Korean economy and increasing highly estimated values. Generally speaking, the venture business is defined as a new business with high risk-high return with new technical entrepreneurship. This treatise suggests the activating alternatives of the venture business in Korea. These alternatives are suggested as follows. First, several measures to incruit excellent technicians are suggested. These measures includes incruitment of parttime technicians, application of cooperative program of education training unemployees, the stock option system, a stock-sharing plan for the employees, etc. Second, in the financial aspect, activation of the foundation investment company, activation of the COSDAQ market, strengthening of technology security are suggested. Third, in the technical development aspect, amplification of inauguration assistant center, construction of technology accumulative network, etc. These measures will contribute to the development of Korean economy and the welfare of Korean people.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.309-327
• /
• 2022

As ICT convergence is progressing in all industrial fields and creating the global ecosystem of the supply chain is accelerating, supply chain risk related with cyber area are also increasing. In particular. the supply chain of ICT products is very complex in terms of technical and environmental factors to be managed, so it is vert difficult to transparently manage the entire life cycle. Accordingly, the US, UK, and EU, etc. are conducting and establishing cyber supply chainsecurity-related research and policies for ICT product supply chains. Korea also has the plan to establish management system to secure the supply chain of major ICT equipment as a task in the basic plan of the national cybersecurity strategy announced in 2019, but there is no concrete policy yet. So, In this paper, we review the cyber supply chain security management system in the United States and present a supplementary way to the National Information Security Manual in Korea from the perspective of cyber supply chain security. It is expected that this will serve as a reference material for cyber supply chain measures that can be introduced in domestic information security field.