• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.8
• /
• pp.189-196
• /
• 2016

Many companies have struggled to manage Web vulnerabilities and security incidents have also frequently happened. The current inspection methods are mainly based on the OWASP vulnerabilities. In practice, however, it is very difficult to cope with frequent changes of Web applications. In this paper, we first investigate the existing quantification of Web application vulnerabilities and verification process. Then we propose an improved inspection framework which is focused on removing essential and realistic vulnerabilities and active verification process.

• KIISE Transactions on Computing Practices
• /
• v.21 no.11
• /
• pp.721-726
• /
• 2015

This paper shows secure coding rules for PHP programs. Programmers should comply with these rules during development of their programs. The rules are crafted to restrain 28 weaknesses that are composed of 22 corresponding to reported CVEs of PHP, the children of CWE-661 for PHP, and the top 5 weaknesses according to OWASP. The rule set consists of 28 detailed rules under 14 categories. This paper also demonstrates through examples that programs complying with these rules can curb weaknesses. The rules can also serve as a guideline in developing analysis tools for security purposes.

• Journal of KIISE:Software and Applications
• /
• v.37 no.10
• /
• pp.773-778
• /
• 2010

OWASP announced most of vulnerabilities result from the data injection by user in 2010 after 2007. Because the contaminated input data is determined at runtime, those data should be checked dynamically. To analyze data and its flow at runtime, dynamic analysis method usually inserts instrument into source code. Intermediate code insertion makes it difficult to manage and extend the code so that the instrument code would be spreaded out according to increase of analysis coverage and volume of code under analysis. In addition, the coupling gets strong between instrument modules and target modules. Therefore developers will struggle against modify or extend the analysis code as instrument. To solve these problem, this paper defines vulnerabilities as a concern using AOP, and suggest the flexible and extensible analysis method to insertion and deletion without increase of coupling.

• Convergence Security Journal
• /
• v.19 no.1
• /
• pp.103-110
• /
• 2019

Recently security related attacks occur in very diverse ways, aiming at people who operate the system rather than the system itself by exploiting vulnerabilities of the system. However, to the our best knowledge, there has been very few works to analyze and strategically to deal with the risks of social engineering attacks targeting people. In this paper, in order to access risks of social engineering attacks we analyze those attacks in terms of attack routes, attack means, attack steps, attack tools, attack goals. Then, with the purpose of accessing the organizational risks we consider the characteristics and environments of the organizations because the impacts of attacks on the organizations obviously depend on the characteristics and environments of the organizations. In addition, we analyze general attack risk assessment methods such as CVSS, CWSS, and OWASP Risk Rating Methodolog. Finally, we propose the risk access scheme of social engineering attacks for the organizations. The proposed scheme allows each organization to take its own proper actions to address social engineering attacks according to the changes of its environments.

• Proceedings of the KAIS Fall Conference
• /
• 2010.11a
• /
• pp.239-242
• /
• 2010

웹 애플리케이션 해킹 방법인 CSRF(Cross Site Request Forgery) 공격은 2008년 2월에 온라인 경매사이트인 옥션에서의 1800만명의 개인정보를 유출 사고 피해를 입힌 공격이다. OWASP(Open Web Application Security Project)에서는 이 공격의 해결방안으로 동기화되고 고유한 토큰 값을 생성하여 페이지 요청 시에 이를 검증하는 시스템을 권고하고 있다. 따라서 본 논문에서는 이 공격을 방어하기 위한 방법으로 타임스탬프와 사용자 고유의 값인 전자서명을 토큰형태로 생성하여 Hidden Field에 삽입함으로써 검증하는 기법에 대해 연구하고자 한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06b
• /
• pp.226-228
• /
• 2012

최근 HTML5, AJAX(Asynchronous JavaScript XML) 등으로 구현된 웹 애플리케이션이 널리 이용됨에 따라 웹 애플리케이션에 존재하는 취약점을 악용하는 공격 사례가 증가하고 있다. 웹 애플리케이션의 안전한 개발과 유지보수를 위해, 설계/구현 단계에서의 취약점 완화를 통한 예방, 그리고 운영 단계에서의 공격 탐지 및 대응이 필요하다. 더불어, 위험한 취약점들 및 공격 패턴들을 분석하고 우선순위를 부여하여, 웹 애플리케이션 개발 단계 및 운영 단계에서 심각한 취약점과 공격들을 우선 고려해야 한다. 본 논문에서는 OWASP Top 10과 CWE(Common Weakness Enumeration)를 연동시켜 CAPEC(Common Attack Pattern Enumeration and Classification)에서 웹 관련 주요 공격 패턴을 선별하고 순위화하였다. CWE는 취약점 예방에 도움을 주며, 순위화된 공격 패턴은 웹 애플리케이션에서 주요 공격들을 효율적으로 방어할 수 있게 하여 준다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.11a
• /
• pp.220-223
• /
• 2017

세계적인 웹 어플리케이션 취약점을 다루는 OWASP(The Open Wed Application Security Project) TOP 10 [1]에 따르면 빈도가 높고 영향이 큰 취약점들은 모두 철저한 웹 보안 코드를 작성하면 어느 정도 예방할 수 있다는 결론이 나왔다. 이에 따라 최근 국내에서 일어난 웹 사이트의 취약점 사례를 알아보고 그 대응법에 대하여 분석한 후, 직접 개발한 웹 사이트에 웹 보안 코드를 적용할 수 있도록 하였다. 또한, 소프트웨어 공학자를 위한 java 시큐어코딩 가이드를 숙지하여 웹 개발 시 보안 유지를 강화하였다.

• Journal of Information Processing Systems
• /
• v.7 no.1
• /
• pp.187-198
• /
• 2011

User authentication refers to user identification based on something a user knows, something a user has, something a user is or something the user does; it can also take place based on a combination of two or more of such factors. With the increasingly diverse risks in online environments, user authentication methods are also becoming more diversified. This research analyzes user authentication methods being used in various online environments, such as web portals, electronic transactions, financial services and e-government, to identify the characteristics and issues of such authentication methods in order to present a user authentication level system model suitable for different online services. The results of our method are confirmed through a risk assessment and we verify its safety using the testing method presented in OWASP and NIST SP800-63.

• Journal of Information Processing Systems
• /
• v.13 no.4
• /
• pp.689-702
• /
• 2017

The Structured Query Language (SQL) Injection continues to be one of greatest security risks in the world according to the Open Web Application Security Project's (OWASP) [1] Top 10 Security vulnerabilities 2013. The ease of exploitability and severe impact puts this attack at the top. As the countermeasures become more sophisticated, SOL Injection Attacks also continue to evolve, thus thwarting the attempt to eliminate this attack completely. The vulnerable data is a source of worry for government and financial institutions. In this paper, a detailed survey of different types of SQL Injection and proposed methods and theories are presented, along with various tools and their efficiency in intercepting and preventing SQL attacks.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.241-242
• /
• 2024

컨테이너 오케스트레이션 도구로 쿠버네티스가 가장 많이 사용되고 있으며, 관련 취약점 연구는 DevSecOps 관점에서 4C layer로 분류된 클라우드 보안 계층 중, 클러스터 및 코드 계층에 초점이 맞춰져 왔다. 반면에 클러스터 계층에도 네트워크 정책, 인증 제어, 권한 설정 및 매개변수 설정에 관한 취약점이 존재한다. 이에 본 논문은 취약점을 분석하여 OWASP 10과 접목하여 분류한 뒤 예방법을 제시함으로써 앞으로의 안전한 클러스터 계층 구축에 기여하고자 한다.