• Journal of Information Technology Services
• /
• v.19 no.5
• /
• pp.33-47
• /
• 2020

In recent years, due to the demand for operating efficiency and cost reduction of industrial facilities, remote access via the Internet is expanding. the control network accelerates from network separation to network connection due to the development of IIoT (Industrial Internet of Things) technology. Transition of control network is a new opportunity, but concerns about cybersecurity are also growing. Therefore, manufacturers must reflect security compliance and standards in consideration of the Internet connection environment, and enterprises must newly recognize the connection area of the control network as a security management target. In this study, the core target of the control system security threat is defined as the network boundary, and issues regarding the security architecture configuration for the boundary and the role & responsibility of the working organization are covered. Enterprises do not integrate the design organization with the operation organization after go-live, and are not consistently reflecting security considerations from design to operation. At this point, the expansion of the control network is a big transition that calls for the establishment of a responsible organization and reinforcement of the role of the network boundary area where there is a concern about lack of management. Thus, through the organization of the facility network and the analysis of the roles between each organization, an static perspective and difference in perception were derived. In addition, standards and guidelines required for reinforcing network boundary security were studied to address essential operational standards that required the Internet connection of the control network. This study will help establish a network boundary management system that should be considered at the enterprise level in the future.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.1
• /
• pp.11-18
• /
• 2013

In order to prevent tampering and reverse engineering of executive code, this paper propose a new tamper resistant software mechanism. This paper presents a cryptographic MAC function and a relationship which has its security level derived by the importance of code block instead of by merely getting the encryption and decryption key from the previous block. In this paper, we propose a cryptographic MAC function which generates a dynamic MAC function key instead of the hash function as written in many other papers. In addition, we also propose a relationships having high, medium and low security levels. If any block is determined to have a high security level then that block will be encrypted by the key generated by the related medium security level block. The low security block will be untouched due to efficiency considerations. The MAC function having this dynamic key and block relationship will make analyzing executive code more difficult.

• Convergence Security Journal
• /
• v.21 no.1
• /
• pp.79-92
• /
• 2021

In a society where ICT technology is converged, the use of various network-connected devices such as IoT is spreading. Network-connected devices are inevitably exposed to the threat of hacking such as information leakage, and countermeasures need to be prepared to respond. Security certification system for IoT devices has been introduced to promote security of IoT products, and for this purpose, legalization and standardization of certification standards and methods are in progress. In line with this, in Korea, as the Information and Communication Network Act was revised in 2020, ICT convergence devices connected to the network were newly defined as "information and communication network connected devices," and the basis for the security certification system is being established. We summarized related domestic and foreign trends and suggest specific considerations for implementing the security certification system for IoT devices in South Korea.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.5
• /
• pp.955-963
• /
• 2022

The Internet of Things (IoT), combined with various technologies, is rapidly becoming an integral part of our daily life. While it is rapidly taking root in society, security considerations are relatively insufficient, making it a major target for cyber attacks. Since all devices in the IoT environment are connected to the Internet and are closely used in daily life, the damage caused by cyber attacks is also serious. Therefore, encryption communication using a network security protocol must be considered for a service in a more secure IoT environment. A representative network security protocol includes TLS (Transport Layer Protocol) defined by the IETF. This paper analyzes the performance measurement results for TLS version 1.2 and version 1.3 in an IoT device open platform environment to predict the load of TLS, a representative network security protocol, in IoT devices with limited resource characteristics. In addition, by analyzing the performance of each major cryptographic algorithm in version 1.3, we intend to present a standard for setting appropriate network security protocol properties according to IoT device specifications.

• Convergence Security Journal
• /
• v.10 no.2
• /
• pp.1-9
• /
• 2010

Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and approximately 300,000 registered users. Snort identifies network indicators by inspecting network packets in transmission. A process on a host's machine usually generates these network indicators. This means whatever the snort signature matches the packet, that same signature must be in memory for some period (possibly micro seconds) of time. Finally, investigate some security issues that you should consider when running a Snort system. Paper coverage includes: How an IDS Works, Where Snort fits, Snort system requirements, Exploring Snort's features, Using Snort on your network, Snort and your network architecture, security considerations with snort under digital forensic windows environment.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.42 no.4
• /
• pp.838-847
• /
• 2017

CNG which was released as a substitute of the previous CAPI (Cryptography API) library from Microsoft is constructed with individual modules based on the plug-in architecture, this means CNG is exceedingly helpful in the cost of development as well as the facility of extension. On the opposite side of these advantages, considerations on security issues are quite insufficient. Therefore, a research on security assurance is strongly required in the environment of distributing and utilizing the CNG library, hence, we analyze possible security vulnerabilities on the CNG library. Based on analyzed vulnerabilities, proof-of-concept tools are implemented and vulnerabilities are verified using them. Verified results are that contents of mail, account information of mail server, and authentication information of web-sites such as Amazon, E-bay, Google, and Facebook are exposed in Outlook program and Internet Explorer program using CNG library. We consider that the analyzed result in this paper can improve the security for various applications using CNG library.

• Journal of the Microelectronics and Packaging Society
• /
• v.8 no.2
• /
• pp.49-52
• /
• 2001

This paper presents product level considerations for multichip packaging as a cost effective alternative to single chip packaging in the design and manufacture of mobile telephony products. Important aspects include component functionality and complexity, acquisition and logistics costs, product modularity and integration. Multichip packaging offers unique solutions and significant system level cost savings in many applications including RF modules, digital matrix functions and product options such as security, data storage, voice recognition, etc.

• Proceedings of the International Microelectronics And Packaging Society Conference
• /
• 2001.04a
• /
• pp.1-7
• /
• 2001

This paper presents product level considerations for multichip packaging as a cost effective alternative to single chip packaging in the design and manufacture of mobile telephony products. Important aspects include component functionality and complexity, acquisition and logistics costs, product modularity and integration. Multichip packaging offers unique solutions and significant system level cost savings in many applications including RF modules, digital matrix functions and product options such as security, data storage, voice recognition, etc.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2008.11a
• /
• pp.1441-1443
• /
• 2008

최근 들어 미디어 스트리밍 서비스 제공 시 서버의 부하 및 비용을 줄이기 위해 P2P 기반의 오버레이 네트워크를 이용하여 미디어 스트리밍 콘텐츠를 분배하는 방안이 등장하고 있다. 하지만 이 방안은 그 효율성만큼이나 보안 취약성도 많이 존재하는 방안이다. 본 논문에서는 P2P 기반의 미디어 스트리밍 서비스에 대한 보안 위협과 이에 대응하기 위한 보안 고려사항을 분석하였다.

• Korean Security Journal
• /
• no.25
• /
• pp.185-208
• /
• 2010

This study is to suggest the current security education programs and improvement of industrial security curriculums in Korea. We live in a world of insecurity; the world is changing at an ever accelerating pace. Life, society, economics, international relations, and security risk are becoming more and more complex. The nature of work, travel, recreation, and communication is radically changing. We live in a world where, seemingly with each passing year, the past is less and less's guide to the future. Security is involved in on one way or another in virtually every decision we make and every activity we undertake. The global environment has never been more volatile, and societal expectations for industrial security and increasing if anything. The complexities of globalization, public expectation, regulatory requirements, transnational issues, jurisdictional risks, crime, terrorism, advances in information technology, cyber attacks, and pandemics have created a security risk environment that has never been more challenging. We had to educate industrial security professional to cope with new security risk. But, how relevant is a college education to the security professional? A college degree will not guarantee a job or advancement opportunities. But, with a college and professional training, a person has improved chances for obtaining a favored position. Commonly, Security education and experience are top considerations to find a job so far, also training is important. Today, Security is good source to gain competitive advantage in global business. The future of security education is prospect when one considers the growth evident in the field. Modern people are very security-conscious today, so now we had to set up close relevant industrial security programs to cope with new security risk being offered in colleges or several security professional educational courses.