• Journal of the Korea Computer Industry Society
• /
• v.3 no.9
• /
• pp.1315-1328
• /
• 2002

Recently there has been increasing demand on developing methodologies and tools for measuring the information security level of organizations for the efficient security management, as the growth of security incidents. However, most methodologies from foreign countries are not realistic in constructing the checklists, moreover their tools provide neither the ease of use nor the inexpensiveness, and most domestic works are not properly considering the characteristics of the organizations. In this study, based on the recently developed standard for information security management, an information security levelling tool is designed and implemented which can be used before building an information security management system while considering the characteristics of organizations more efficiently. The efficiency comes from applying multiple variable weights for security levelling according to the characteristics of organizations.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.41 no.6
• /
• pp.13-22
• /
• 2004

This study proposes a risk analysis methodology for information system security management in which the complexity on the procedure that the existing risk analysis methodology is reduced to the least. The proposed risk analysis methodology is composed of 3 phases as follows: beforehand processing phase, counter measure setting phase, post processing phase. The basic risk analysis phase is a basic security management phase in which fixed items are checked when the information security system is not yet established or a means for the minimum security control is necessary for a short period of time. In the detailed risk analysis phase, elements of asset a vulnerability, and threat are analysed, and using a risk degree production table produced from these elements, the risk degree is classified into 13 cases. In regard to the risk, the 13 types of risk degree will execute physical, administrative, and technical measures through ways such as accepting, rejecting, reducing, and transferring. Also, an evaluation on a remaining risk of information system is performed through a penetration test, and security policy set up and post management phase is to be carried out.

• Journal of the Korea Society of Computer and Information
• /
• v.16 no.2
• /
• pp.217-224
• /
• 2011

Existing wire based physical security system solutions show limitations in time and space. In order to solve these deficiencies, a remote physical security system has been implemented using smart phone based on mobile cloud computing technique. The security functions of mobile cloud computing technique include mobile device user authentication, confidentiality of communication, integrity of information, availability of system, and target system access control, authority management and secure hand off etc. Proposed system has been constructed as remote building management system using smart phone, and also has been efficient to reduce energy cost (5~30%), result of system average access and response time 7.082 second. This systems are evaluated to have high efficiency compared to performance.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.6
• /
• pp.67-81
• /
• 2010

As wide propagation of smartphones, e-commerce with smartphones increases rapidly. Such as transfer or stock trade systems. It has prospect that most of financial companies going to offer e-commerce systems via smartphones. And e-commerce via smartphones will be increased, hence the nature of smartphone that can be used whenever, wherever. However, legislation of e-commerce in Korea does not reflect these characteristics of smartphones, because it has set standards in regular PC. So that this study is security threat and feature of smartphones considering that the current legal system will use Certificate constraints, ensuring the safety of e-commerce and install security programs for protection of users, e-commerce responsible for the accident analysis has focused on the issues presented for this improvement.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.1
• /
• pp.111-122
• /
• 2021

With the spread of technology in the 4th Industrial Revolution, the defense industry in South Korea is getting developed into an industrial structure in which high-tech technologies are concentrated. As the importance of defense technology has gradually increased, the government has enacted the Defense Technology Security Act and required to build a protection system for institutions that possess or manage defense technology. In order for the target institution to introduce a protection system, it is necessary to identify the defense technologies that are protected and to ensure systematic data management. In order to cope with this, we derived master data items for data management and analyzed the implementation types of defense technology master data system suitable for the defense industry environments. The derived method identified the defense technology master data, such as primary and secondary master data, and through AHP analysis, Co-existence type was suitable as the target model for the master data management system. We expect that stronger defense technology security policy will be implemented through the defense technology MDM system.

• Journal of KIISE:Databases
• /
• v.31 no.1
• /
• pp.1-12
• /
• 2004

As network systems are developed rapidly and network architectures are more complex than before, it needs to use PBNM(Policy-Based Network Management) in network system. Generally, architecture of the PBNM consists of two hierarchical layers: management layer and enforcement layer. A security policy server in the management layer should be able to generate new policy, delete, update the existing policy and decide the policy when security policy is requested. And the security policy server should be able to analyze and manage the alert messages received from Policy enforcement system in the enforcement layer for the available information. In this paper, we propose an alert analyzer using data mining. First, in the framework of the policy-based network security management, we design and implement an alert analyzes that analyzes alert data stored in DBMS. The alert analyzer is a helpful system to manage the fault users or hosts. Second, we implement a data mining system for analyzing alert data. The implemented mining system can support alert analyzer and the high level analyzer efficiently for the security policy management. Finally, the proposed system is evaluated with performance parameter, and is able to find out new alert sequences and similar alert patterns.

• Convergence Security Journal
• /
• v.5 no.3
• /
• pp.43-57
• /
• 2005

This paper is about a study on human resource management for information security in the age of information warfare. this study reviewed the current status of human security resource forces for information warfare and derived problems of current practices of various organizations. Based on the analysis of the current practices the author suggested several ideas for solving the problems various. The suggestions include 1) establishment of security manpower concept, 2) set-up of manpower requirement, ideas, 3) establishment of systematic educational system, 4) standardization, etc.

• Journal of the Society of Disaster Information
• /
• v.10 no.2
• /
• pp.282-286
• /
• 2014

This study is to present an improvement of physical security system operation by survey on the install and operation of physical security system of 90 facilities. The level of CCTV operation is higher than Access Control system and Intrusion Detection System. But the level of maintenance and management of physical security system is low. The rate of install of X-ray Inspection device show the concern on material detection, although the rate is low. The level of install and operation for the Integration of physical security system is low, so integration of security personnel and security system is necessary for the effective operation. For reinforcement of access control management, security gate and preparing of some obstacles are required with RFID.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.2
• /
• pp.251-265
• /
• 2013

Cloud computing provided as a service type by sharing IT resources cannot be activated unless the issue of information security is solved. The enterprise attempts to maximize the efficiency of information and communication resources by introducing cloud computing services. In comparison to the United States and Japan, however, cloud computing service in korea has not been activated because of a lack of confidence in the security. This paper suggests core evaluation criteria and added evaluation criteria which is removed the redundancy of the security controls from existing ISMS for Korean cloud computing through a comparative analysis between domestic and foreign security controls of cloud certification scheme and guidelines and information security management system. A cloud service provider certified ISMS can minimize redundant and unnecessary certification assessment work by considering added evaluation criteria.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.10a
• /
• pp.578-579
• /
• 2021

According to a survey on the infringement of SMEs, the level of technology protection capability is improving every year, but technology leaks and damage continue to occur. This shows that there is a need for a security management and supervision system that can strengthen the security awareness of SME executives and employees and maintain the security level continuously. The Personal Information & Information Security Management System(ISMS-P) authentication systems is the latest related standard, which has the problem of applying the same certification criteria without considering the types of certification target organizations such as ISPs, IDC, hospitals and schools, and SMEs.. In this paper, 73 evaluation items that can be specialized and applied to SMEs were derived by referring to ISMS-P certification and Personal Information Protection Management System (PIMS) certification. The results of the study show that the number of evaluation items decreased by 28.4% compared to the existing ISMS-P certification.