• 한국컴퓨터정보학회논문지
• /
• 제23권11호
• /
• pp.75-84
• /
• 2018

Social engineering attack means to get information of Social engineering attack means to get information of opponent without technical attack or to induce opponent to provide information directly. In particular, social engineering does not approach opponents through technical attacks, so it is difficult to prevent all attacks with high-tech security equipment. Each company plans employee education and social training as a countermeasure to prevent social engineering. However, it is difficult for a security officer to obtain a practical education(training) effect, and it is also difficult to measure it visually. Therefore, to measure the social engineering threat, we use the results of social engineering training result to calculate the risk by system asset and propose a attack graph based probability. The security officer uses the results of social engineering training to analyze the security threats by asset and suggests a framework for quick security response. Through the framework presented in this paper, we measure the qualitative social engineering threats, collect system asset information, and calculate the asset risk to generate probability based attack graphs. As a result, the security officer can graphically monitor the degree of vulnerability of the asset's authority system, asset information and preferences along with social engineering training results. It aims to make it practical for companies to utilize as a key indicator for establishing a systematic security strategy in the enterprise.

• 융합보안논문지
• /
• 제22권4호
• /
• pp.135-140
• /
• 2022

본 연구의 목적은 공학적인 보안지식을 필요로 하는 보안과목을 개발하는 것이다. 특히 스마트공장보안 등의 보안업무를 수행하기 위해서는 공학 지식이 필요하다. 하지만 기계경비지도사, 산업보안관리사, 산업보안전문가(CPP) 등 유사한 자격증이 있지만 공학 지식을 바탕으로 하지 않는다. 이에 전문가 인터뷰를 통한 델파이 분석을 사용하여 보안공학직무분석을 도출하고 이에 필요한 지식을 정리하게 되었다. 연구결과 1선 보안인 경계보안을 위해 셉테드를 포함한 건축구조, 건축역학, 2선 보안인 출입구보안을 위해 스마트공장 보안을 포함한 제어계측, 3선 보안인 실내보안을 위해 인간공학과 기계경비로 구분하게 되었다. 설문조사 결과 연령별로는 30대에서 75.8%, 업무별로는 산업보안담당자가 76.4%로 가장 많은 호응을 보였으며, 이는 산업보안 현장의 실무자들이 환경보안공학 자격증을 희망하는 것으로 볼 수 있었다.

• Journal of Information Technology Applications and Management
• /
• 제16권2호
• /
• pp.23-43
• /
• 2009

For reliability and confidentiality of information security systems, the security engineering methodologies are accepted in many organizations. To improve the effectiveness of security engineering, this paper suggests a security methodology ISEM, which considers both product assurance and production processes, takes advantages in terms of quality and cost. To verify the effectiveness of ISEM, this paper introduces the concepts of quality loss, and compares the development costs and quality losses between ISEM and CC through the development of VPN system.

• Journal of information and communication convergence engineering
• /
• 제8권5호
• /
• pp.544-548
• /
• 2010

The Enterprise Security Management system is a centralized control system based on predefined security policies by organizations. In Korea, there is a Common Criteria security certification according to the strict standards for various features. As the needs of information security product are increasing, the ESM system should be evaluated with quality characteristics. In this paper, we propose evaluation items for functionality and performance of Enterprise Security Management system, and the best practices for evaluation.

• Nuclear Engineering and Technology
• /
• 제54권4호
• /
• pp.1245-1252
• /
• 2022

As regulatory bodies require full implementation of security controls in nuclear power plants (NPPs), security functions for critical digital assets are currently being developed. For the ultimate introduction of security controls, not alternative measures, it is important to understand the relationship between possible cyber threats to NPPs and security controls to prevent them. To address the effectiveness of the security control implementation, this study investigated the types of cyber threats that can be prevented when the security controls are implemented through the mapping of the reorganized security controls in RS-015 to cyber threats on NPPs. Through this work, the cyber threat that each security control can prevent was confirmed, and the effectiveness of several strategies for implementing the security controls were compared. This study will be a useful reference for utilities or researchers who cannot use design basis threat (DBT) directly and be helpful when introducing security controls to NPPs that do not have actual security functions.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제9권12호
• /
• pp.5116-5134
• /
• 2015

In this paper, due to the network security defense is mainly static defense, a dynamic classification network security defense strategy model is proposed by analyzing the security situation of complex computer network. According to the network security impact parameters, eight security elements and classification standard are obtained. At the same time, the dynamic classification algorithm based on fuzzy theory is also presented. The experimental analysis results show that the proposed model and algorithm are feasible and effective. The model is a good way to solve a safety problem that the static defense cannot cope with tactics and lack of dynamic change.

• 융합보안논문지
• /
• 제4권2호
• /
• pp.71-75
• /
• 2004

The Common Criteria (CC) philosophy is to provide assurance based upon an evaluation of the IT product or system that is to be trusted. Evaluation has been the traditional means of providing assurance. It is essential that not only the customer' srequirements for software functionality should be satisfied but also the security requirements imposed on the software development should be effectively analyzed and implemented in contributing to the security objectives of customer's requirements. Unless suitable requirements are established at the start of the software development process, the re suiting end product, however well engineered, may not meet the objectives of its anticipated consumers. By the security evaluation, customer can sure about the quality of the products or sys tems they will buy and operate. In this paper, we propose a selection guide for If products by show ing relationship between security engineering and security evaluation and make help user and customer select appropriate products or system.

• Journal of Information Processing Systems
• /
• 제16권1호
• /
• pp.61-82
• /
• 2020

The security risk management used by some service providers is not appropriate for effective security enhancement. The reason is that the security risk management methods did not take into account the opinions of security experts, types of service, and security vulnerability-based risk assessment. Moreover, the security risk assessment method, which has a great influence on the risk treatment method in an information security risk assessment model, should be security risk assessment for fine-grained risk assessment, considering security vulnerability rather than security threat. Therefore, we proposed an improved information security risk management model and methods that consider vulnerability-based risk assessment and mitigation to enhance security controls considering limited security budget. Moreover, we can evaluate the security cost allocation strategies based on security vulnerability measurement that consider the security weight.

• 한국정보통신학회논문지
• /
• 제20권1호
• /
• pp.81-86
• /
• 2016

본 논문에서는 다중 채널 보안카드 설계 기법을 제공한다. 해당 보안 카드는 투명하게 제작되어 스마트폰의 화면과 합쳐서 나타나는 정보를 통해 비밀값을 도출하게 된다. 이는 기존 보안카드가 가지는 레이아웃의 물리적인 한계를 제거하여 보안카드가 가지는 복잡도를 향상시켰으며 1채널 보안카드의 단점인 물리적 노출에 대한 취약점을 다중 채널로 확장하여 한 번의 물리적 보안카드의 노출이 모든 비밀 정보의 노출로 연결되는 문제점도 해결하였다.

• 한국정보통신학회논문지
• /
• 제26권2호
• /
• pp.265-270
• /
• 2022

4차 산업혁명 시대가 도래하면서 보안의 패러다임도 바뀌고 있다. 클라우드 컴퓨팅과 코로나바이러스로 인해 원격근무가 활발해지면서 업무 환경이 변화하고 동시에 공격기법들도 지능화·고도화되는 현 상황에서기업에서는 새로운 보안 모델을 도입해 현재 보안시스템을 더 강화해야 한다. 제로 트러스트 보안은 모든 것을 의심하고 신뢰하지 않는다는 핵심 개념을 기반으로 모든 네트워크를 감시하고 접근 요청자에 대한 엄격한 인증과 최소한의 접근 권한을 허용함으로써 보안성을 높인다. 또한, 접근제어 강화를 위한 제로 트러스트 기반 보안시스템을 위해 식별 주체 및 데이터에 대한 NAC와 EDR 활용과 MFA를 통한 엄격한 신원 인증에 대해 설명 한다. 본 논문은 기존 보안시스템의 한계점을 극복하는 제로 트러스트 보안시스템을 소개하고, 접근제어를 강화하는 방안을 제안한다.