• Convergence Security Journal
• /
• v.2 no.2
• /
• pp.179-187
• /
• 2002

Grid is a infrastructure to connect heterogeneous resources that are scattered over areas with high-speed network and to cooperate with each other. To carry out Grid application, first, network resources should be managed, since the network has to be safe and reliable. GMA suggests an effective architecture for monitoring of resources that are scattered over a wide area. In this paper, basing on GMA, Grid network management system based on web for practical and general network management is designed. Grid network management system has to operate and connect various distributed management system. Using LDAP authentication, as one access system, Grid network management system maintain stability.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.253-256
• /
• 2003

현재 IETF RFC 3414에서 제안한 SNMP 메시지 인증 및 기밀성 서비스용 키 분배방식은 관리자의 패스워드를 기반으로 국지 키를 생성하는 알고리즘을 사용한다. 이는 관리자의 패스워드 노출 방지를 위해 관리자가 지리적으로 분산된 SNMP 관리객체 (Managed Agent)를 순회하면서 설치해야 한다는 문제점과 또한 관리객체에 SNMP 메시지를 전송되는 시점에서 국지 키가 계산되어 SNMP 메시지의 전송지연 문제점을 내포하고 있다. 본 논문에서는 누구나 관리객체 설치가 가능하고 SNMP 메시지 전송지연을 제거할 수 있도록 SNMPv3 USM에 Diffie-Hellman 키 분배 방식을 적용하는 방안을 제안하였다. 제안된 방식은 RFC 3414와 동일한 수준에서 SNMP 메시지 인증 및 기밀성 서비스를 제공한다.

• Journal of Korea Multimedia Society
• /
• v.15 no.11
• /
• pp.1349-1357
• /
• 2012

In recent years, security accidents which are becoming the socially hot issue not only cause financial damages but also raise outflow of private information. Most of the accidents have been immediately caused by the software weakness. Moreover, it is difficult for software today to assure reliability because they exchange data across the internet. In order to solve the software weakness, developing the secure software is the most effective way than to strengthen the security system for external environments. Therefore, suggests that the coding guide has emerged as a major security issue to eliminate vulnerabilities in the coding stage for the prevention of security accidents. Developers or administrators effectively in order to use secure coding coding secure full set of security weaknesses organized structurally and must be managed. And the constant need to update new information, but the existing Secure Coding and Security weakness is organized structurally do not. In this paper, we will define and introduce the structured weakness for mobile applications by the surveys of existing secure coding and coding rules for code analysis tools in Java.

• Journal of the Korea Society of Computer and Information
• /
• v.12 no.5
• /
• pp.57-64
• /
• 2007

Mobile Agent has been known that it is an efficient communication paradigm for distributed applications and that a mobile agent provides higher flexibility and performance than existing communication paradigms. Despite these benefits, mobile agent is not used widely in the market because it is very vulnerable to a variety of attacks. To be applied to develop distributed applications, a mobile agent paradigm must consider both security and performance. In this paper, we propose and evaluate an improving method of a migration performance for a mobile agent model using ISM(Integrated Security Manager), which provides high-level security services and travel plan guide. In the proposed method. ISM offers the travel plan guide service which replies the accumulated results when a mobile agent has executed all migration plans related the trusted domain to be managed by ISM. Our method improved about $33{\sim}82%$ of total execution time than the existing method.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.2
• /
• pp.65-72
• /
• 2015

According to recent statistics published by the National Industrial Security Center, former and current employees are responsible for 80.4% of companies' technology leakages, and employees of cooperative firms are responsible for another 9.6%. This means that 90% of technology leakages are intentionally or mistakenly caused by insiders. In a recent incident, a credit card company leaked private information, and the person responsible was an employee of a cooperative firm. These types of incidents have an adverse effect not only on a company's assets but also on its reputation. Therefore, most institutions implement various security solutions to prevent information from being leaked. However, security solutions are difficult to analyze and distinguish from one another because their logs are independently operated and managed. A large number of logs are created from various security solutions. This thesis investigates how to prevent internal data leakage by setting up individual scenarios for each security solution, analyzing each scenario's logs, and applying a monitoring system to each scenario.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2022.11a
• /
• pp.137-139
• /
• 2022

As cyber threats in the maritime industry increase due to the digital transformation, the needs for cyber security training for ship's crew and port engineers has increased. The training of seafarers is related to the IMO's STCW convention, so cyber security training also managed and certified, and it is necessary to develop a cybersecurity training system that reflects the characteristics of the OT systemof ships and ports. In this paper, with the goal of developing a training model based on the IMO cyber risk management guideline, developing a cyber security training model based on the characteristics of maritime industry threats, and improving the effectiveness of cyber security training using AR/VR and metaverse, A method for developing a system for nurturing cyber security experts is presented.

• Journal of Information Technology Services
• /
• v.23 no.1
• /
• pp.1-10
• /
• 2024

The IT environment is changing due to the acceleration of digital transformation in enterprises and organizations. This expansion of the digital space makes centralized cybersecurity controls more difficult. For this reason, cyberattacks are increasing in frequency and severity and are becoming more sophisticated, such as ransomware and digital supply chain attacks. Even in large organizations with numerous security personnel and systems, security incidents continue to occur due to unmanaged and unknown threats and vulnerabilities to IT assets. It's time to move beyond the current focus on detecting and responding to security threats to managing the full range of cyber risks. This requires the implementation of asset Inventory for comprehensive management by collecting and integrating all IT assets of the enterprise and organization in a wide range. IT Asset Management(ITAM) systems exist to identify and manage various assets from a financial and administrative perspective. However, the asset information managed in this way is not complete, and there are problems with duplication of data. Also, it is insufficient to update of data-set, including Network Infrastructure, Active Directory, Virtualization Management, and Cloud Platforms. In this study, we, the researcher group propose a new framework for automated 'Comprehensive IT Asset Management(CITAM)' required for security operations by designing a process to automatically collect asset data-set. Such as the Hostname, IP, MAC address, Serial, OS, installed software information, last seen time, those are already distributed and stored in operating IT security systems. CITAM framwork could classify them into unique device units through analysis processes in term of aggregation, normalization, deduplication, validation, and integration.

• Journal of Digital Contents Society
• /
• v.18 no.1
• /
• pp.225-229
• /
• 2017

In this paper, various units of industrial disaster safety threats as well as local and national facilities unit real-time detection and prevention refer to the corresponding system goes into disaster management preparedness, prevention, response recovery of phase I systematic ICT skills that can be managed more efficiently. In addition, the immediate disaster prevention and preparedness for early forecasting preemptive damage scale and high-tech information exchange technology to overcome the limitations of a human disaster in the field against the analysis and strategy of preemptive disaster safety management with smart risk management and prevention in response and recovery and the scene quickly and efficient mutual cooperation and effective collaboration and cooperation of the Community Center social security presented a smart disaster safety management system.

• The KIPS Transactions:PartC
• /
• v.9C no.3
• /
• pp.331-336
• /
• 2002

In this paper, we propose a new distribution and renewal scheme for a group key suitable for secure mobile communications based on identification protocol, in which all members of the group can reshare the new group common key except revoked members by using a key distribution center (a trusted center). The security of this scheme is based on the difficulty of the discrete logarithm problem. The proposed scheme can be appropriately managed in case that terminal's capability of storage and computing power is relatively small and more than one caller are revoked. It also renews a group key easily when the center changes this key intervally for security.

• Convergence Security Journal
• /
• v.20 no.2
• /
• pp.53-58
• /
• 2020

In this study, it suggests the High Availability (HA) implementation plan of building a continuous service infrastructure as a strategy ensuring availability, as the importance of availability securing corporate business continuity emerges in the knowledge and information society. However, if the reliability of the criticality assessment of information asset is not ensured, it requires assessment measures for availability that can be managed by mapping with service maintenance assessment items, which are availability criteria based on the asset criticality evaluated through the asset value matrix because it is difficult to maintain security in conjunction with the value of real assets. Therefore, this study suggests the assessment measures for availability of information assets.