• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.10a
• /
• pp.892-895
• /
• 2009

Medical records must be well protected because they are needed to care for the health of patients. For that reason, user authentication and medical data encryption are essential for the security of both wired and wireless Healthcare Information Systems (HIS). The main focus of this paper is on the analysis of the numerous possible attacks and the countermeasures to overcome these attacks in Mobile Healthcare Environment (MHE) with an appropriate security protocols. To draw a conclusion, this will propose why a healthcare architecture should establish a multi-layered defense against the risks.

• Korea Information Processing Society Review
• /
• v.17 no.2
• /
• pp.18-29
• /
• 2010

In this paper, we surveyed SSO based security management including the knowledge domain of the area of cloud and its relevant components. Cloud computing refers to the delivery of software and other technology services over the Internet by a service provider. SSO refers to the ability to log on to a single security system once, rather than logging on separately to multiple security systems. Existing SSO solutions in cloud computing environment suggest several methods. SSO-based security Issues illustrate these key items in cloud computing environment such as risks and security vulnerabilities of SSO. SSO supports for multiple and different domains in cloud computing environment.

• Journal of the Korean Institute of Illuminating and Electrical Installation Engineers
• /
• v.25 no.6
• /
• pp.90-99
• /
• 2011

As power industry evolves into Smart Grid scheme, previously closed power systems are being integrated into public communication networks. It increases the controllability and efficiency of the system, but also accompanies many cyber threats having existed in the Internet to the SCADA system. Therefore it is required to apply security countermeasures to the Smart Grid, which brings about investment costs. There have been few approaches to assess risks from cyber attack especially in electric power industry. So this paper proposes a methodology to assess quantitative impacts of various types of cyber attacks to a power system, and also shows the feasibility of the method through a case study.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.19 no.12
• /
• pp.863-871
• /
• 2018

Existing vulnerability analysis tools are prone to missed detections, incorrect detections, and over-detection, which reduces accuracy. In this paper, cross-checking based on a vulnerability detection method using static and dynamic analysis is proposed, which develops and manages safe applications and can resolve and analyze these problems. Risks due to vulnerabilities are computed, and an intelligent vulnerability detection technique is used to improve accuracy and evaluate risks under the final version of the application. This helps the development and execution of safe applications. Through incorporation of tools that use static analysis and dynamic analysis techniques, our proposed technique overcomes weak points at each stage, and improves the accuracy of vulnerability detection. Existing vulnerability risk-evaluation systems only evaluate self-risks, whereas our proposed vulnerability risk-evaluation system reflects the vulnerability of self-risk and the detection accuracy in a complex fashion to evaluate relative. Our proposed technique compares and analyzes existing analysis tools, such as lists for detections and detection accuracy based on the top 10 items of SANS at CWE. Quantitative evaluation systems for existing vulnerability risks and the proposed application's vulnerability risks are compared and analyzed. We developed a prototype analysis tool using our technique to test the application's vulnerability detection ability, and to show that our proposed technique is superior to existing ones.

• Journal of the Korean Institute of Illuminating and Electrical Installation Engineers
• /
• v.24 no.4
• /
• pp.50-56
• /
• 2010

Supervisory Control and Data Acquisition Systems (SCADAs) is real-time monitor and control systems. SCADA systems are used to monitor or control chemical and transportation processes, in municipal water supply systems, electric power generation, transmission and distribution, gas and oil pipelines, and other distributed processes. SCADA refers to a large-scale distributed system. The supervisory control system is placed on top of a real time control system to control external processes. Emerging security technologies and security devices are decreasing the vulnerability of the power system against cyber threats. Dealing with these threats and analyzing vulnerabilities is an important task for equipment such as RTU, IED and FEP. To reduce such risks, we develop such a SCADA testbed. This paper presents the development of a testbed designed to assess the vulnerabilities SCADA networks(including serial communication).

• Journal of the Korean Institute of Gas
• /
• v.26 no.4
• /
• pp.18-26
• /
• 2022

The Korean government is conducting heat-using equipment(industrial boiler) inspection in accordance with the Energy Use Rationalization Act because of the heat-using equipment(industrial boiler)'s risks such as explosion and fire, and safe use and management. This paper aimed to setup the safe and performance vulnerabilities from database based on the inspection results for heat-using equipment(industrial boiler). This study surveyed the inspection results of 1,249 heat-using equipment(industrial boiler) which were failed inspection of heat-using equipment(industrial boiler) from january 2016 to december 2020. And the analysis method is to inform safety and performance vulnerability categories of heat-using equipment(industrial boiler) by statistically analyzing the failure reasons of boiler type and inspection type which are high variance in failure rate. The safety and performance vulnerability categories was abbreviated into 18 cases. And each catagory's main reason for failure was suggested by additional analyzing the opinions of inspectors. This paper would be the basic source and the comprehensive information dealing with the safety and performance vulnerability of heat-using equipment(industrial boiler).

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.05a
• /
• pp.230-233
• /
• 2014

Latest Inforamtion security threats and risks change very rapidly, and there to strengthen the security level of the major companies and organizations are diversified attack to respond to a penetration test conducted. Penetration test(PenTest) is safer for the purpose of looking for vulnerabilities in computer systems by taking advantage of vulnerabilities discovered in the same way as a hacker attack. How to make a security vulnerability could be exploited by attempting to attack show. On the other hand, many security companies are testing in a variety of ways to be penetrated. However, penetration testing to evaluate the strength and reliability has not performed yet. Therefore, in this study, Penetration testing to validate and present a reliable method of evaluation. In this study, penetration testing, assessment information to provide the evaluation results are more reliable. And, as a result, efficient penetration test is expected to be possible.

• Journal of the Korea Institute of Building Construction
• /
• v.19 no.6
• /
• pp.529-538
• /
• 2019

Typhoons can cause significant financial damage worldwide. For this reason, states, local governments and insurance companies attempt to quantify and mitigate the financial risks related to these natural disasters by developing a typhoon risk assessment model. As such, the importance of typhoon risk assessment models is increasing, and it is also important to reflect local vulnerabilities to enable sophisticated assessments. Although a practical study of economic losses associated with natural disasters has identified essential risk indicators, comprehensive studies covering the correlation between vulnerability and economic loss are still needed. The purpose of this study is to identify typhoon damage indicators and to develop evaluation indicators for typhoon damage prediction functions, utilizing the loses from Typhoon Maemi as data. This study analyzes actual loss records of Typhoon Maemi provided by local insurance companies to prepare for a scenario of maximum losses. To create a vulnerability function, the authors used the wind speed and distance from the coast and the total value of property, construction type, floors, and underground floor indicators. The results and metrics of this study provide practical guidelines for government agencies and insurance companies in developing vulnerability functions that reflect the actual financial losses and regional vulnerabilities of buildings.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.1
• /
• pp.53-60
• /
• 2024

Security assessment is an indispensable process for a secure network, and appropriate performance indicators must be present to manage risks. The most widely used quantitative indicator is CVSS. CVSS has a problem that it cannot consider context in terms of subjectivity, complexity of interpretation, and security risks. To compensate for these problems, we propose indicators that itemize and quantify four things: attackers, threats, responses, and assets, taking into account the security context of ISO/IEC 15408 documents. Vulnerabilities discovered through network scanning can be mapped to MITREATT&CK's technology by the connection between weaknesses and attack patterns (CAPEC). We use MITREATT&CK's Groups, Tactic, and Mitigations to produce consistent and intuitive scores. Accordingly, it is expected that security evaluation managers will have a positive impact on strengthening security such as corporate networks by expanding the range of choices among security indicators from various perspectives.

• KIPS Transactions on Computer and Communication Systems
• /
• v.3 no.10
• /
• pp.323-328
• /
• 2014

ZigBee based on the most vulnerable part of u-Healthcare system that uses the ZigBee communication is the wireless section. ZigBee communication sectors to identify vulnerabilities in this paper, we propose to compensate. ZigBee has been raised from the existing vulnerabilities organize and ZigBee also uses the 64bit address that uniquely identifies a vulnerability that was defined as exposure. And to prevent the exposure of a unique identifying address was used to address a temporary identification. ZigBee security services, the proposed system during the Network Key for encryption only use one mechanism of Residential Mode is used. Residential Mode on all nodes of the entire network because they use a common key, the key is stolen, your network's security system at a time are at risk of collapse. Therefore, in order to guard against these risks to the security policy Network Key updated periodically depending on the method used to. The proposed evaluation and comparative analysis of the system were exposed in the existing system can hide the address that uniquely identifies a public key Network Key also updated periodically, so that leaks can occur due to reduced risk.