• Journal of Internet Computing and Services
• /
• v.25 no.1
• /
• pp.123-136
• /
• 2024

The U.S. Department of Defense, leading global cybersecurity policies, has two main cybersecurity frameworks: the Cybersecurity Maturity Model Certification (CMMC) for external defense industry certification, and the Risk Management Framework (RMF) for internal organizational security assessments. For Republic of Korea military, starting from 2026, the Korean version of RMF (K-RMF) will be fully implemented. Domestic defense industry companies participating in projects commissioned by the U.S. Department of Defense must obtain CMMC certification by October 2025. In this paper, a new standard compliance meta-model (R3C) development methodology that can simultaneously support CMMC and RMF security audit readiness tasks is introduced, along with the implementation results of a compliance solution based on the R3C meta-model. This research is based on practical experience with the U.S. Department of Defense's cybersecurity regulations gained during the joint project by the South Korean and U.S. defense ministries' joint chiefs of staff since 2022. The developed compliance solution functions are being utilized in joint South Korean-U.S. military exercises. The compliance solution developed through this research is expected to be available for sale in the private sector and is anticipated to be highly valuable for domestic defense industry companies that need immediate CMMC certification.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.19 no.1
• /
• pp.241-248
• /
• 2024

Socially, organizations are required to effectively manage their information resources, both in terms of acquiring information from external sources and safeguarding against potential breaches by insiders. While information security policies and technologies implemented by organizations contribute to achieving internal security, an overly complex or disorganized security structure can create uncertainty among employees. In this study, we identify factors of structural information security (IS)-related uncertainty within organizations and propose that they contribute to non-compliance. We develop a research model and hypotheses based on previous studies on the information security environment and test these hypotheses using structural equation modeling. Our findings indicate that uncertainties related to IS policy, technology, and communication decrease employees' IS role identity and their intention to comply with IS measures. By addressing these uncertainties, organizations can improve their IS environment and work towards achieving there is goals.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.6
• /
• pp.1425-1435
• /
• 2019

The expanded application of digital controls has raised the issue of cyber security for nuclear facilities. To cope with this, the cyber security technical standard RS-015 for Korean nuclear facilities requires nuclear system developers to apply security functions, analyze known vulnerabilities, and test and evaluate security functions. This requires the development of procedures and methods for testing the suitability of security functions in accordance with the nuclear cyber security technical standards. This study derived the security requirements required at the device level by classifying the details of the technical, operational and administrative security controls of RS-015 and developed procedures and methods to test whether the security functions implemented in the device meet the security requirements. This paper describes the process for developing security function compliance test procedures and methods and presents the developed test cases.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.3
• /
• pp.735-744
• /
• 2016

Recently, personal information leakage incidents with increased usage of mobile services are increasing. Personal information leakage incidents can have a significant impact on an individual's mobile banking services. Accordingly, we examine relationships among individual's psychological characteristics, intention and behavior regarding compliance in an individual's perception on personal information leakage incidents in mobile banking contexts. In this study, for explaining our research model and understanding with personal psychology and behavior in mobile banking contexts, we adopted two theories, theory of interpersonal behavior and stimulus-response theory. We collected the 55 data using online surveyor and then analyzed structural equation model in order to find causal relationships among research variables. The results of this study should be useful to the mobile banking services companies in promoting service users to follow the information privacy policies.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.18 no.6
• /
• pp.1177-1188
• /
• 2023

Socially, organizations are required to maintain strict management of their information resources and invest in the adoption of information security (IS) technologies and policies. However, the ongoing threat of information exposure by employees persists within the organization. This study aims to identify the role stress that employees may experience due to strict IS policies and propose methods for reducing its negative impact. Specifically, our study suggests a mechanism for mitigating role stress by incorporating factors related to IS policy goal setting and work regulatory focus. We conducted a survey among workers in the financial industry, where IS policies are rigorously enforced, and tested our research hypotheses using a sample of 309 participants. The results indicate that increasing the difficulty and specificity of IS policy goals reduces role stress (conflict and ambiguity) and positively influences employees' intention to comply with IS policies. Furthermore, individual work promotion focus moderated the relationship between role stress and IS compliance intention. These findings have important implications for organizations seeking to strengthen their IS compliance among employees and inform the development of effective IS strategies.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.6
• /
• pp.1141-1149
• /
• 2020

Most of the industrial control network is an independent closed network, which is operated for a long time after installation, and thus the OS is not updated, so security threats increase and security vulnerabilities exist. The zero-day attack defense must be applied with the latest patch, but in a large-scale industrial network, it requires a higher level of real-time and non-disruptive operation due to the direct handling of physical devices, so a step-by-step approach is required to apply it to a live system. In order to solve this problem, utility-specific patch impact assessment is required for reliable patch application. In this paper, we propose a method to test and safely install the patch using the regression analysis technique and show the proven results. As a patch impact evaluation methodology, the maximum allowance for determining the safety of a patch was derived by classifying test types based on system-specific functions, performance, and behavior before and after applying the patch. Finally, we report the results of case studies applied directly to industrial control networks, the OS patch has been updated while ensuring 99.99% availability.

• Journal of Platform Technology
• /
• v.11 no.5
• /
• pp.126-135
• /
• 2023

Demand for NFT is expanding along with Blockchain. And cyber security threats are also increasing. Therefore, this study derives security level inspection items by analyzing status related to NFT security such as NFT features, security threats, and compliance for the purpose of strengthening NFT security. Based on this, the relative importance was confirmed by applying it to the AHP model. As a result of the empirical analysis, the priority order of importance was found in the order of Security management system establishment and operation, encryption, and risk management, etc. The significance of this study is to reduce NFT security incidents and improve the NFT security management level of related companies by deriving NFT-related security level check items and demonstrating the research model. And If you perform considering relative importance of the NFT check items, the security level can be identified early.

• Information Systems Review
• /
• v.22 no.2
• /
• pp.101-120
• /
• 2020

This study investigates the effects of privacy psychological characteristics of B2C logistics services users on their willingness to comply with their logistics companies' information protection policy. Using cognitive valence theory as a theoretical framework, this study proposes a research model to examine the relationships between users' logistics security knowledge, privacy trust, privacy risk, privacy concern, and their willingness of information protection policy compliance. To test the proposed model, we conducted a survey from actual users of logistics services and collected valid 151 samples. We analyzed the data using a structural equation modeling software. The empirical results show that logistics security knowledge positively affects privacy trust; privacy concern positively influences privacy risk; privacy trust, privacy risk, and privacy concern positively influence behavioral willingness of compliance. However, logistics security knowledge does not affect behavioral willingness of compliance. The results of the study provide several contributions to the literature of B2C logistics services domain and managerial implications to logistics services companies.

• THE INTERNATIONAL COMMERCE & LAW REVIEW
• /
• v.35
• /
• pp.179-219
• /
• 2007

Cross-border supply chains undergone complexity in the global trade process, unpredictability and continually evolving regulations and information requirements. Under these circumstances, longer lead time inhibiting quick response to market demands, unanticipated supply chain costs eroding product cost savings, compliance and documentation errors causing delays and fines are challenging global trade companies when they execute global business. These problems are mainly caused by unautomated, unintegrated process which lead to longer and more unpredictable lead times, slower cash flow, cost overruns, and ultimately lower profits and less satisfied customers. Complex and unpredictable global trade environment requires global trade companies of global trade management functions to automate and control this complex environment for driving out cost, time and risk from their business. Global trade management allows cost savings, supply chain efficiencies and improved compliance through improving global supply chain visibility, facilitating cash flow by supply chain financing, enhancing supply chain security and risk management.

• Journal of Digital Convergence
• /
• v.11 no.2
• /
• pp.19-32
• /
• 2013

The purpose of this paper is to find an answer why employees in organization violate the organizational information security policy. To do this, this study is rooted in the moral disengagment theory. This study found that moral belief and perceived sanction have an effect on security policy violation. However, if moral disengagement is involved in the research model, perceived sanction is not significant. Finally, SETA, moral belief, and perceived sanction have a negative effect on moral disengagement, which in turn moral disengagement influences positively the security policy violation. The conclusions and implications are discussed.