• 컴퓨터교육학회논문지
• /
• 제23권1호
• /
• pp.63-75
• /
• 2020

보안사고 예방을 위한 많은 노력에도 불구하고 조직구성원의 보안행동과 연관된 정보유출, 랜섬웨어 등 치명적 보안사고 피해는 해마다 늘어나고 있다. 이 연구에서는 보안사고의 주요한 원인인 조직원의 보안정책 준수의 관점에서, 보안정책 준수에 영향을 주는 요인으로 편향적 사고를 제시하고 다음을 검증하였다. 첫째, 보안정책에 대한 편향적사고가 보안정책준수 태도에 주는 영향을 검증한다. 둘째, 경영진의 참여, 지각된 위험성, 교육 및 처벌이 편향적 사고를 증가 또는 감소시키는 조절 효과를 검증한다. 마지막으로, 보안정책준수 태도가 준수행동에 유의미한 영향을 주는 지 검증하였다. 이를 위해 157명을 대상으로 설문조사를 실시하고 연구모형 및 구조방정식 통계적 분석, 적합성 분석을 실시하였다. 연구결과 편향적 사고는 정보보안 정책준수 태도에 부정적 영향을 주는 것으로 나타났다. 또한 정보보안 정책준수 태도는 정책준수 행동을 증가시키는 것으로 분석되었다. 한편, 조직원 개인이 정보보안에 대한 위험성을 높게 지각할수록 편향적 사고를 감소시키는 조절효과가 있었으나, 경영진의 참여, 교육 및 처벌은 조절효과가 없는 것으로 나타났다. 향후, 연구결과는 내부조직원에 의한 보안사고 대처방안에 시사점을 줄 것으로 기대된다.

• 한국정보시스템학회지:정보시스템연구
• /
• 제17권3호
• /
• pp.153-174
• /
• 2008

Mobile commerce is defined as any direct or indirect transaction conducted and facilitated through a wireless telecommunication network such as payment, ticketing, auction and mobile banking. Despite the importance of mobile commerce, there have not been so many academic studies on the unique characteristics of mobile commerce environments. In this study, our research model is developed based on TAM(Technology Acceptance Model) to investigate the user's technology acceptance process in mobile commerce environment. The factors, such as ubiquity, compatibility, perceived usefulness, perceived ease of use, cost, security, attitude and behavior intention for mobile commerce were selected from pier study in information systems area. The data for empirical analysis of the research model is collected online-questionnaire of 167 mobile commerce users in South Korea. The hypotheses were analyzed using SPSS 15.0 and AMOS 7.0. The results of our study show that: (1) compatibility, perceived usefulness and security had influences on the attitude whereas perceived ease of use and cost did not have any significant impact on the attitude, (2) compatibility influenced perceived usefulness whereas perceived ease of use did not, and finally (3) ubiquity, perceived usefulness and attitude had considerable influences on intention for mobile commerce. Therefore, practitioners should focus on enhancing security, quality of contents and services as well as offering what mobile commerce users want. The results of this study may useful for academicians and practitioners alike.

• Asia pacific journal of information systems
• /
• 제18권4호
• /
• pp.1-26
• /
• 2008

Rapid progress of information technology and widespread use of the personal computers have brought various conveniences in our life. But this also provoked a series of problems such as hacking, malicious programs, illegal exposure of personal information etc. Information security threats are becoming more and more serious due to enhanced connectivity of information systems. Nevertheless, users are not much aware of the severity of the problems. Using appropriate password is supposed to bring out security effects such as preventing misuses and banning illegal users. The purpose of this research is to empirically analyze a research model which includes a series of factors influencing the effectiveness of passwords. The research model incorporates the concept of risk based on information systems risk analysis framework as the core element affecting the selection of passwords by users. The perceived risk is a main factor that influences user's attitude on password security, security awareness, and intention of security behavior. To validate the research model this study relied on questionnaire survey targeted on evening class MBA students. The data was analyzed by AMOS 7.0 which is one of popular tools based on covariance-based structural equation modeling. According to the results of this study, while threat is not related to the risk, information assets and vulnerability are related to the user's awareness of risk. The relationships between the risk, users security awareness, password selection and security effectiveness are all significant. Password exposure may lead to intrusion by hackers, data exposure and destruction. The insignificant relationship between security threat and perceived risk can be explained by user's indetermination of risk exposed due to weak passwords. In other words, information systems users do not consider password exposure as a severe security threat as well as indirect loss caused by inappropriate password. Another plausible explanation is that severity of threat perceived by users may be influenced by individual difference of risk propensity. This study confirms that security vulnerability is positively related to security risk which in turn increases risk of information loss. As the security risk increases so does user's security awareness. Security policies also have positive impact on security awareness. Higher security awareness leads to selection of safer passwords. If users are aware of responsibility of security problems and how to respond to password exposure and to solve security problems of computers, users choose better passwords. All these antecedents influence the effectiveness of passwords. Several implications can be derived from this study. First, this study empirically investigated the effect of user's security awareness on security effectiveness from a point of view based on good password selection practice. Second, information security risk analysis framework is used as a core element of the research model in this study. Risk analysis framework has been used very widely in practice, but very few studies incorporated the framework in the research model and empirically investigated. Third, the research model proposed in this study also focuses on impact of security awareness of information systems users on effectiveness of password from cognitive aspect of information systems users.

• 융합보안논문지
• /
• 제13권4호
• /
• pp.109-115
• /
• 2013

인터넷망을 이용한 정보 전달의 대표적인 수단인 이메일 서비스 등을 통한 보안위협이 급증하고 있다. 이러한 보안위협의 공격 경로는 첨부된 문서파일에 악성코드를 삽입하고, 해당 응용프로그램의 취약점을 이용하여 사용자의 시스템을 감염시키게 된다. 따라서 본 연구에서는 파일 전송과정에서 위장악성코드의 감염을 차단하기 위해, 논리적 망 분리인 FTS(File Transfer System)를 이용한 무결성 검증 및 행위기반 탐지 시스템을 제안하고, 기존의 보안기법과의 비교 및 검증하고자 한다.

• Journal of Information Processing Systems
• /
• 제17권2호
• /
• pp.334-336
• /
• 2021

• 한국정보시스템학회지:정보시스템연구
• /
• 제32권4호
• /
• pp.1-28
• /
• 2023

Purpose Recently, organizations have been allocating significant financial resources toward the implementation of new technologies and stringent information security (IS) policies in order to enhance IS. However, the potential for IS threats from internal sources within organizations remains high. This study proposes a mechanism whereby the organization's IS environment (organizational justice) enhances employees' perception of IS value congruence and encourages their voice behavior. Furthermore, this study validates that an individual's susceptibility to interpersonal influence can reinforce the relationship between the aforementioned factors and voice behavior. Design/methodology/approach We utilized AMOS 22.0 and Process 3.1 to validate the research model and hypotheses. The data was gathered from 435 employees employed in South Korean firms that implemented IS policies in their work. Structural equation modeling was employed to examine the relationship between organizational justice, value congruence, and voice behavior, and the interaction effect was confirmed by incorporating model 1 of Process 3.1 for the hypothesis pertaining to susceptibility to interpersonal influence. Findings The findings of this study indicate that organizational justice has a positive impact on voice behavior, which is further enhanced by value congruence. Furthermore, the influence of organizational justice and value congruence on voice behavior is moderated by susceptibility to information influence, while susceptibility to normative influence only moderates the effect of organizational justice. These results provide valuable insights for organizations in developing customized information systems strategies that effectively promote employees' voice behaviors.

• Journal of Information Processing Systems
• /
• 제8권2호
• /
• pp.347-358
• /
• 2012

Recently, security researches have been processed on the method to cover a broader range of hacking attacks at the low level in the perspective of hardware. This system security applies not only to individuals' computer systems but also to cloud environments. "Cloud" concerns operations on the web. Therefore it is exposed to a lot of risks and the security of its spaces where data is stored is vulnerable. Accordingly, in order to reduce threat factors to security, the TCG proposed a highly reliable platform based on a semiconductor-chip, the TPM. However, there have been no technologies up to date that enables a real-time visual monitoring of the security status of a PC that is operated based on the TPM. And the TPB has provided the function in a visual method to monitor system status and resources only for the system behavior of a single host. Therefore, this paper will propose a m-TMS (Mobile Trusted Monitoring System) that monitors the trusted state of a computing environment in which a TPM chip-based TPB is mounted and the current status of its system resources in a mobile device environment resulting from the development of network service technology. The m-TMS is provided to users so that system resources of CPU, RAM, and process, which are the monitoring objects in a computer system, may be monitored. Moreover, converting and detouring single entities like a PC or target addresses, which are attack pattern methods that pose a threat to the computer system security, are combined. The branch instruction trace function is monitored using a BiT Profiling tool through which processes attacked or those suspected of being attacked may be traced, thereby enabling users to actively respond.

• 정보보호학회논문지
• /
• 제13권4호
• /
• pp.161-168
• /
• 2003

We discuss the security of two famous password authenticated key exchange protocols, EKE2 and PAK. We introduce ′insider assisted attack′ Based on this assumption we point out weakness of the security of EKE2 and PAK protocols. More precisely, when the legitimate user wants to find other user′s password, called "insider-assisted attacker", the attacker can find out many ephemeral secrets of the server and then after monitoring on line other legitimate user and snatching some messages, he can guess a valid password of the user using the previous information. Of course for this kind of attack there are some constraints. Here we present a full description of the attack and point out that on the formal model, one should be very careful in describing the adversary′s behavior.

• 시큐리티연구
• /
• 제40호
• /
• pp.35-56
• /
• 2014

본 연구는 보안엑스포 참관객의 추구편익과 참관 후 행동의 관계를 규명하여 차후 보안 엑스포 참가기업의 보다 효과적이며 소비자들에게 차별화된 마케팅전략을 제공하고, 참관객들의 니즈에 적극적인 대응을 통하여 보안 경호산업분야의 발전적인 방향을 제시하는데 연구의 목적이 있다. 연구대상은 2014년 3월 12일-14일 3일간 일산 킨텍스에서 개최한 세계보안엑스포2014에 참가한 참관객을 대상으로 편의표집(convenience sampling)으로 300명이 표집되었으며, 수집된 설문지 중 응답내용이 부실하거나 신뢰성이 없다고 판단되어지는 17부의 자료를 제외하고 본 연구에서는 총 283부의 설문지를 연구대상을 분석에 이용하였다. 조사도구는 설문지로서 국내 외 선행연구를 기초로 하여 재구성하여 사용하였으며, 자료 처리는 SPSS version 18.0 통계패키지를 이용하여 빈도분석, 신뢰도분석, 요인분석, 상관관계분석, 회귀분석을 실시하였다. 이상의 연구방법과 절차에 따른 자료 분석을 통하여 다음과 같은 결론을 얻었다. 첫째, 추구편익과 참관 후 행동 요인 간의 관계가 모두 정(+)의 상관관계를 보이고 있어, 추구편익과 구매행동 간에는 정(+)의 상관관계가 있다. 둘째, 추구편익과 참관 후 행동 요인 간의 관계를 분석한 결과 정보탐색, 여가선용, 제품 구매는 구전활동에 영향을 미친다. 셋째, 추구편익과 참관 후 행동 요인 간의 관계를 분석한 결과 여가선용, 정보탐색, 제품구매는 재 참관에 영향을 미친다.

• 디지털콘텐츠학회 논문지
• /
• 제19권8호
• /
• pp.1515-1525
• /
• 2018

4차 산업혁명 시대의 보안은 안전의 문제로 확대되고 있으나, 기업의 정보보호 제반환경은 여전히 열악한 수준이다. 본 연구는 정보보호 투자의도 요인을 실증 분석하여 정책적 시사점을 제안 하고자 한다. 이에 정보보호 실태, 보호 행동이론을 고찰하고 UTAUT를 확장하여 연구 모델을 설계하고 가설을 검증하였다. 분석 결과는 정보 자산이 촉진조건에 영향을 미치고, 인지된 우려와 신규 우려가 사회적 영향에 영향을 미치는 것으로 나타났다. 사회적 영향은 경험과 습관에 영향을 미치지만, 정보보호 투자 의도에 미치는 영향은 기각되었다. 촉진조건, 경험 및 습관이 정보보호와 신규서비스 정보보호 투자의도에 가장 높은 영향을 미치는 것으로 나타났다. 하지만, 인지된 우려와 신규 우려가 정보보호 투자의도에 미치는 영향은 낮거나 기각되었다. 업종, 규모, 정보보호 조직 구성, 침해사고 경험, 정보보호 인력 비율, 개인정보 건수에 따라 집단 간 조절 효과가 있었다. 본 연구가 기업의 정보보호 수준 제고를 위한 정책 수립에 도움을 줄 수 있기를 기대한다.