• Journal of Computing Science and Engineering
• /
• v.5 no.4
• /
• pp.331-337
• /
• 2011

Recently, Virtual Desktop Infrastructure (VDI) has been widely adopted to ensure secure protection of enterprise data and provide users with a centrally managed execution environment. However, user experiences may be restricted due to the limited functionalities of thin clients in VDI. If thick client devices like laptops are used, then data leakage may be possible due to malicious software installed in thick client mobile devices. In this paper, we present Data Firewall, a security framework to manage and protect security-sensitive data in thick client mobile devices. Data Firewall consists of three components: Virtual Machine (VM) image management, client VM integrity attestation, and key management for Protected Storage. There are two types of execution VMs managed by Data Firewall: Normal VM and Secure VM. In Normal VM, a user can execute any applications installed in the laptop in the same manner as before. A user can access security-sensitive data only in the Secure VM, for which the integrity should be checked prior to access being granted. All the security-sensitive data are stored in the space called Protected Storage for which the access keys are managed by Data Firewall. Key management and exchange between client and server are handled via Trusted Platform Module (TPM) in the framework. We have analyzed the security characteristics and built a prototype to show the performance overhead of the proposed framework.

• Journal of Digital Convergence
• /
• v.17 no.1
• /
• pp.141-148
• /
• 2019

The advancement of digital technology accelerates intelligence, convergence, and demands better change beyond traditional methods in all aspects of business models and technologies, infrastructure, processes, and platforms. Risk management is becoming more important because of various security risks, depending on the changing business environment and aligned to business goals is emerging from the existing information asset based risk management. For business aligned risk management, it is essential to understand the risk appetite for achieving business goals, which provides a basis for decision-making in subsequent risk management processes. In this paper, we propose a framework for analyzing the risk management framework, pre - existing risk analysis, and protection motivation theory that influences decisions on security risk management. To examine the practical feasibility of the developed risk appetite framework, we reviewed the applicability and significance of the proposed risk appetite framework through an advisory committee composed of security risk management specialists.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2019.11a
• /
• pp.134-136
• /
• 2019

The International Maritime Organization (IMO) issued 2017 Guidelines on maritime cyber risk management. In accordance with IMO's maritime cyber risk management guidelines, each flag State is required to comply with the Safety Management System (SMS) of the International Safety Management Code (ISM) that the cyber risks should be integrated and managed before the first annual audit following January 1, 2021. In this paper, to identify cyber security management targets and risk factors in the maritime sector and to conduct vulnerability analysis, we catagorized the cyber security sector in management, technical and physical sector in maritime sector based on the industry guidelines and international standards proposed by IMO. In addition, the Risk Matrix was used to conduct a qualitative risk assessment according to risk factors by cyber security sector.

• Smart Media Journal
• /
• v.6 no.4
• /
• pp.41-49
• /
• 2017

According to the occurrence of many security incidents, the SOC(Security Operation Center) and SIEM(Security Information & Event Management) are concentrated recently. The various studies and commercial products of the information security industry are being released. As reflected in this situation, NIST in the US is publishing and revising the document about the Cybersecurity Framework. In this study, we investigated the NIST's Cyberseurity Framework, trends in SOC and SIEM security technologies and solutions, and also introduce the open source Apache Metron of a real-time Bigdata security tool.

• Proceedings of the Korean Information Science Society Conference
• /
• 2007.10d
• /
• pp.62-65
• /
• 2007

3GPP(3rd Generation Partnership Project) 주도의 유럽형 3세대 이동통신인 UMTS 시스템에서 제공하는 멀티미디어 방송 서비스(Multimedia Broadcast/Multicast Service)는 무선 네트워크상에서 동일한 정보를 하나의 링크를 통해 다수의 사용자에게 제공하는 point-to-multipoint 서비스이다. 콘텐츠가 무료로 제공되면 임의의 사용자들이 콘텐츠가 제공되는 채널에 액세스할 수 있다. 그러나 채널 액세스가 가입(subscription)기반이면, 가입하지 않은 사용자들은 콘텐츠를 이용할 수 없어야 한다. 이를 위해 사용자를 인증하고 안전한 방법으로 콘텐츠를 전송할 수 있는 보안 서비스가 필요하다. 본 논문은 MBMS의 전반적인 개요를 설명하여 앞으로 논의될 내용인 MBMS 보안구조에 대한 배경지식을 제공한다. 또한 브로드캐스트와 멀티캐스트 모드 각각에 대한 MBMS 구조를 설명하고, 멀티캐스트 모드에서의 보안 기능과 키관리 기법, 콘텐츠 보호 기술에 대해 상세히 분석한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.10a
• /
• pp.387-389
• /
• 2014

It is preferred to the popularization of smart device business processes through mobile. The ratio of Internet access via mobile devices is reached 30% of PC in September 2012. It is reproduced in a mobile environment that security threats arising from the Internet. that is the characteristics of cyber security threats appearing on the mobile era. Web Application Service security research firm OWASP (The Open Web Application Security Project) issued Session Management threat. That threat will be reproduced in the mobile environment. But Mobile is significantly different from Desktop Computer about Session Management environment. This proceeding proposes a improved Session Management method in Mobile environment.

• Journal of Navigation and Port Research
• /
• v.47 no.2
• /
• pp.57-65
• /
• 2023

In 2017, the International Maritime Organization (IMO) adopted MSC.428 (98), which recommends establishing a cyber-risk management system in Ship Safety Management Systems (SMSs) from January 2021. The 27th International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) also discussed prioritizing cyber-security (cyber-risk management) in developing systems to support Maritime Autonomous Surface Ship (MASS) operations (IALA guideline on developments in maritime autonomous surface ships). In response to these international discussions, Korea initiated the Korea Autonomous Surface Ship technology development project (KASS project) in 2020. Korea has been carrying out detailed tasks for cybersecurity technology development since 2021. This paper outlines the basic concept of ship network security equipment for supporting MASS ship operation in detailed task of cybersecurity technology development and defines ship network security equipment interface for MASS ship applications.

• Spatial Information Research
• /
• v.21 no.6
• /
• pp.33-42
• /
• 2013

In a long-term perspective of development of spatial information industry, security regulation, such as limiting public picture resolution of aerial photographs, needs a rational improvement. However, unplanned deregulation of spatial information could lead problematic results such as national security issues because its present security management system is not established in reasonable manner. The main purpose of this research is to suggest the improvement plan of spatial information security management system to meet the reducing security regulation in accordance with changes of political and economic condition including current national spatial information security polices and spatial information industry. From an analytical standpoint, we examined the overall aspects of legal, operation management, and technical system while we maintained especially integrated perspective of spatial information security management. Followed by investigation of spatial information security issues, as well as its regulation and policies in overseas, rational improvement plan of security management is proposed in the aspects of legal, operation management, and technical system. It is also suggested the three-step improvement plan of reducing regulation of security management system.

• KIPS Transactions on Computer and Communication Systems
• /
• v.3 no.9
• /
• pp.301-310
• /
• 2014

The absence of proactive information security management to ensure availability, accessibility and safety of information can bring serious risks to customers as well as to the organization's performance and competitiveness because improper security management undermines business continuity. This study analyzed the maturity of information security which affects the organizational performance. Through the literature reviews, a research model using the organizational performance as the dependent variable, the risk management process maturity and risk assessment process as independent variables and the information security policy indexes as moderate variables was proposed, and an empirical analysis was made on the basis of survey. The results showed that there was a high causal relationship between information security maturity and organizational performance. However, even if the proportions of information security staff ratio and the information security budget ratio increased, information security maturity did not affect organizational performance. It suggests that information security maturity affects organizational performance, but information security regulations have their limitation as being a catalyst to improve organizational performance.

• Journal of the Korean Society of Safety
• /
• v.27 no.3
• /
• pp.77-82
• /
• 2012

The leakage of toxic chemicals impact seriously on human being and environment, therefore during their treatment process, a proper management system is necessary to control their toxic effect. This study was designed to suggest the management regulation that supports business managers and facilities management. There are no extra regulation to control emergency accidents and terrors in chemical facilities. Developed countries like USA operate the management standards to control the toxic chemical and facilities according to their toxicity and processes. In order to solve this problem, we have analysed the advanced nations standard methods of security in chemical plants to study the new security management regulation which helps to prevent the chemical accidents. Especially, in USA, CCPS (Center for Chemical Process Safety), SVA (Security Vulnerability Assessment) and RBPSs (Risk-Based Performance Standards) of DHS (Department of Homeland Security) were invest I gated. On the basis of the results, we have suggested the application methods of the security and safety regulation in Korea.