• Asia pacific journal of information systems
• /
• 제21권4호
• /
• pp.27-43
• /
• 2011

This article explores economic models that show the optimal level of information security investment in the presence of interdependent security risks, Using particular functional forms, the analysis shows that the relationship between the levels of security vulnerability and the levels of optimal security investments is affected by externalities caused by agents' correlated security risks. This article further illustrates that, compared to security investments in the situation of independent security risks, in order to maximize the expected benefits from security investments, an agent should invest a larger fraction of the expected loss from a security breach in the case of negative externalities, while an agent should spend a smaller fraction of the expected loss in the case of negative externalities.

• Asia pacific journal of information systems
• /
• 제22권1호
• /
• pp.79-101
• /
• 2012

This study expands the current body of research by exploring multiple scenarios of insufficient and excessive IT security investments caused by interdependent risks and the interplay between IT security investments and cyber insurance. A key finding is that organizations experiencing interdependent risks with different types of cyber attacks (i.e., targeted and untargeted attacks) use different strategies in making IT security investment decisions and in purchasing cyber insurance policies for their information security risk management than firms that are facing independent risks. The study further provides an economic rationale for employing insurance mechanisms as a risk management solution for information security.

• 산업공학
• /
• 제16권4호
• /
• pp.421-431
• /
• 2003

Due to the increasing complexity of the information systems environment, modern information systems are facing more difficult and various security risks than ever, there by calling for a higher level of security safeguard. In this paper, an information technology security risk management model, which modified by adopting the concept of business processes, is applied to client/server distributed systems. The results demonstrate a high level of risk-detecting performance of the model, by detecting various kinds of security risks. In addition, a practical and efficient security control safeguard to cope with the identified security risks are suggested. Namely, using the proposed model, the risks on the assets in both of the I/O stage(on client side) and the request/processing stage(on server side), which can cause serious problems on business processes, are identified and the levels of the risks are analyzed. The analysis results show that maintenance of management and access control to application systems are critical in the I/O stage, while managerial security activities including training are critical in the request/processing stage.

• 지식경영연구
• /
• 제16권4호
• /
• pp.35-45
• /
• 2015

Fintech, which means the convergence of finance and information technology, becomes a hot topic in the financial sector. Through innovative activities on financial services, ICT(Information and Communication Technology) is integrated into the overall financial industry, and a new form of financial services could be expected to improve the existing financial system. On the other hand, fintech services are relatively vulnerable to security issues. Due to the process simplication and the channel fusion, the leakage of personal and financial informations, authentication bypass, phishing, and pharming are getting more concerned. In this study we investigated the security risk of fintech services in the viewpoints of service provider, technology adoption, and security policy. The possible countermeasures to reduce those risks are suggested because security is an important criterion for selecting financial services. This study basically offers quantification of the potential security risks and step-by-step control measures about business processes in the fintech services. The suggested security model includes user authentication, terminal security, payment information protection, API(Application Programming Interface) security, and abnormal transaction monitoring. This study might contribute to an understanding of the security risks and some possible measures for mitigating those risks on the practical perspective.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권2호
• /
• pp.865-882
• /
• 2017

To improve passenger convenience and safety, today's vehicle is evolving into a "connected vehicle," which mounts various sensors, electronic control devices, and wired/wireless communication devices. However, as the number of connections to external networks via the various electronic devices of connected vehicles increases and the internal structures of vehicles become more complex, there is an increasing chance of encountering issues such as malfunctions due to various functional defects and hacking. Recalls and indemnifications due to such hacking or defects, which may occur as vehicles evolve into connected vehicles, are becoming a new risk for automakers, causing devastating financial losses. Therefore, automakers need to make voluntary efforts to comply with security ethics and strengthen their responsibilities. In this study, we investigated potential security issues that may occur under a connected vehicle environment (vehicle-to-vehicle, vehicle-to-infrastructure, and internal communication). Furthermore, we analyzed several case studies related to automaker's legal risks and responsibilities and identified the security requirements and necessary roles to be played by each player in the automobile development process (design, manufacturing, sales, and post-sales management) to enhance their responsibility, along with measures to manage their legal risks.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제10권7호
• /
• pp.2892-2913
• /
• 2016

Network virtualization promises to play a dominant role in shaping the future Internet by overcoming the Internet ossification problem. However, due to the injecting of additional virtualization layers into the network architecture, several new security risks are introduced by the network virtualization. Although traditional protection mechanisms can help in virtualized environment, they are not guaranteed to be successful and may incur high security overheads. By performing the virtual network (VN) embedding in a security-aware way, the risks exposed to both the virtual and substrate networks can be minimized, and the additional techniques adopted to enhance the security of the networks can be reduced. Unfortunately, existing embedding algorithms largely ignore the widespread security risks, making their applicability in a realistic environment rather doubtful. In this paper, we attempt to address the security risks by integrating the security factors into the VN embedding. We first abstract the security requirements and the protection mechanisms as numerical concept of security demands and security levels, and the corresponding security constraints are introduced into the VN embedding. Based on the abstraction, we develop three security-risky modes to model various levels of risky conditions in the virtualized environment, aiming at enabling a more flexible VN embedding. Then, we present a mixed integer linear programming formulation for the VN embedding problem in different security-risky modes. Moreover, we design three heuristic embedding algorithms to solve this problem, which are all based on the same proposed node-ranking approach to quantify the embedding potential of each substrate node and adopt the k-shortest path algorithm to map virtual links. Simulation results demonstrate the effectiveness and efficiency of our algorithms.

• Journal of Information Processing Systems
• /
• 제10권1호
• /
• pp.132-144
• /
• 2014

Information always comes with security and risk problems. There is the saying that, "The tall tree catches much wind," and the risks from cloud services will absolutely be more varied and more severe. Nowadays, handling these risks is no longer just a technology problem. So far, a good deal of literature that focuses on risk or security management and frameworks in information systems has already been submitted. This paper analyzes the causal risk factors in cloud environments through critical success factors, from a business perspective. We then integrated these critical success factors into a business model for information security by mapping out 10 principles related to cloud risks. Thus, we were able to figure out which aspects should be given more consideration in the actual transactions of cloud services, and were able to make a business-level and general-risk control model for cloud computing.

• 한국산학기술학회논문지
• /
• 제11권2호
• /
• pp.703-708
• /
• 2010

정보원천의 다양화와 정보시스템 취약성의 증가는 비즈니스 위험을 증가시킨다. 성공적인 비즈니스는 적정한 비즈니스 위험관리를 통해서 가능하다. 그러나 비즈니스 위험관리는 재무적 관점에서 시행되고 있고, 정보보호관리제도는 정보보호의 관점에서만 이루어져 통합적인 비즈니스 위험관리를 수행하기에 부적절하다. 본 연구는 통합적인 비즈니스 위험관리기법을 개발하기 위하여 정보보호관리제도인 ISMS, EA, ISO27001, COBIT, SPICE, 정보시스템감리, SSE-CMM 등을 비즈니스 위험관리관점에서 분석하였다. 본 연구에서 분석된 정보보호관리제도는 비즈니스 위험관리를 위한 원천으로 활용가능하다.

• 한국산학기술학회논문지
• /
• 제12권3호
• /
• pp.1408-1416
• /
• 2011

클라우드 컴퓨팅은 컴퓨팅 리소스의 경비 절감과 효율은 물론 서비스의 확장 및 향상을 제공한다. 그러나 클라우드 서비스 사용자(기업 등)들은 클라우드 컴퓨팅 특성에 의한 여러 가지 위험들에 대해서 많은 염려를 갖고 있다. 본 논문에서는 클라우드 컴퓨팅 환경으로 인한, 시큐리티를 포함한 여러 가지 주요 이슈들을 검토하여 보고자 한다. 또한 시큐리티에 관한 문제들을 보다 구체적으로 분석하고 클라우드 컴퓨팅에 관한 위협들을 식별하여 시큐리티 위험을 줄일 수 있는 대략적인 대응책들을 제안하였다.

• 한국컴퓨터정보학회논문지
• /
• 제23권9호
• /
• pp.141-156
• /
• 2018

The purpose of this study is how personal information violation risks affect the intention to use domestic cryptocurrency services. VAM(Value based Adoption Model) model is validated as a theoretical background, selecting perceived ease of use, perceived usefulness and perceived security as a benefit factors, and considers perceived cost, technical complexity, and risk of personal information violation risks as sacrifice factors. The method of this study used questionnaire survey to collect 150 data on user's perception on cryptocurrency services, and also performed a structural equation modeling method using by AMOS 23. The result of this paper shows that all hypotheses are accepted statistically significant except 2 hypothesis. This research is concluded that perceived value is affected on statistically positive impact on perceived ease of use, perceived usefulness and perceived security, and negative impact on risk of personal information violation risk, not statistically perceived fee and technical complexity.