• Journal of Information Technology Services
• /
• v.19 no.1
• /
• pp.173-185
• /
• 2020

It is very important to evaluate training because it can systematically grasp the current status of training. Evaluation includes getting ongoing feedback from the learner, trainer and learner's supervisor, to improve the quality of the training and identify if the learner achieved the goals of the training. It also provides a justification for the implementation of training. Nonetheless, there is a lack of studies that attempt to evaluate information security training programs. In this study, we utilize the Philips model to evaluate the public training programs for the people who are in charge of the information security duties in the public sector and propose the training improvement plans. Research result has shown that it is necessary to evaluate the level of the trainees in advance and conduct training programs according to the information security skill level. In addition, it needs to conduct training according to duties such as information security management, information security operate and maintain. The limitation of this study is that each education program was not assessed individually because this study had developed an evaluation tool that could be used comprehensively.

• Journal of the Korean Home Economics Association
• /
• v.41 no.11
• /
• pp.49-60
• /
• 2003

The purposes of this study were (1) to assess the perceived evaluation of family financial risk safeguards and (2) to identify demographic variables, financial security and financial communication which were an influence on the perceived evaluation of family financial risk safeguards. The data were collected from 598 housewives using an on-line survey. The major findings of this study were as follows: first, the perceived evaluation of financial risk safeguards was lower than the median(2.80). Especially, the perceived evaluation of financial risk safeguard for children's education had the highest score. Second, the variables which were an influence on the financial communication of husbands and wives were‘financial security’ and ‘years which they have been married’. Third, the perceived evaluation of financial risk safeguards was significantly different according to financial security and the financial communication of husbands and wives.

• Proceedings of the KIEE Conference
• /
• 2003.07d
• /
• pp.2744-2746
• /
• 2003

ISO/IEC 15408 requires the TOE(Target of Evaluation) Security Environment section of a Protection Profile(PP) or Security Target(ST) to contain a list of assumptions about the TOE security environment or the intended usage of the TOE. This paper presents a specific conditions should be assumed to exist in the smart card environment and the analysis of those conditions developer of smart card PP must consider.

• Journal of Information Technology Applications and Management
• /
• v.26 no.4
• /
• pp.31-39
• /
• 2019

The 129 public institutions in Korea are subject to Information Security Management Condition Evaluation (ISMCE) as a part of the government management evaluation system by the Ministry of Economy and Finance. ISMCE is started in 2006 with the central government institutions, and applied to the all public institutions in 2009. This evaluation is annually conducted by the National Intelligence Service through the site visits, and the number of the evaluated institutions is increasing year by year. However, the process of ISMCE - identifying existing vulnerabilities in the information system - is conducted manually. To improve this inconvenience, this paper introduces the various evaluation system in the major countries, especially in the United States, and analyzes the Security Content Automation Protocol (SCAP) by NIST. SCAP is automation protocol for the system vulnerability management (in technical fields) and security policy compliance evaluation. Based on SCAP, this paper suggests an improvement plan for the ISMCE of Korea.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.4
• /
• pp.1449-1457
• /
• 2010

The intrusion prevention system solution is receiving the spotlight as the next generation security system. It is anticipated that the system will form a very active security market both domestically and overseas. Moreover, quality evaluation proving successful inspection of merchandises is required of domestic businesses seeking to operate in the international market, and general users also prefer those that have successfully passed inspection. This study has constructed a security quality evaluation model for intrusion prevention system by deriving and analyzing security quality evaluation items required by an intrusion prevention system solution and by classifying them in detail. The derived quality evaluation model will play an important role of assessing and improving the quality of intrusion prevention system.

• Journal of radiological science and technology
• /
• v.31 no.4
• /
• pp.347-353
• /
• 2008

This study is to prepare an evaluation standard about personal information protection and security management of a medical institution and to build up a grade standard of evaluation in PACS environment. We built up evaluation index based on 10 detailed items in four big categories (political security, technical security, data management security and physical security) by referring to ISO17799 (BS 7799), HIPPA (Health Insurance and Portability and Accountability Act of 1996) and domestic medical law. We have investigated at the thirty places where medical facility with the extracted security criteria and security evaluation index. Average score of physical security list, one of the big categories, was 18.5/20 (93%) at all medical institutions. Political security score was 18.5/30 (62%), data management security score was 12/20 (60%) and technical security score was 17.5/30 (58%). Therefore, security evaluation score was average 67 in 30 general hospitals, which was 4th level. The results showed that it is necessary to establish evaluation and management standard about personal information protection and security consciousness which are weak in PACS environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1153-1166
• /
• 2015

With the acceleration of information digitization caused by fast growth of Information Technology, the application of digital forensics has increased but it is underestimated because digital evidence is easy to forge. Especially, the evaluation of the reliability of digital forensics organization is judged only by judges domestically because there is no objective verification system or evaluation method of the capability of digital forensics organization. Therefore, the evaluation model and indices of the capability of digital forensics concentrated on the digital forensics organization, personnel, technology, facilities and the procedure in domestic justice system was presented in this research after reviewing the domestic and foreign evaluation method and the standard of the capability of digital forensics and information security. The standard for judicial evaluation of digital evidence and composition, management, evaluation of digital forensics organization would be presented based on this research.

• Journal of KIISE:Information Networking
• /
• v.31 no.2
• /
• pp.207-216
• /
• 2004

IPsec protocol has been developed to provide security services to Internet. Recently IPsec is implemented on the various operating systems Hence, it is very important to evaluate the stability of the Ipsec protocol as well as other protocols that provide security services. However, there has been little effort to develop the tools that require to evaluate the stability of IPsec protocols. Therefore, in this paper, we develope the security requirements and suggest a security evaluation system for the Internet packet protection protocols that provide security services at the If level that can be used to check if the security protocols Provide the claimed services correctly This system can be used as debugging tool for developing IPsec based security system.

• Journal of Information Processing Systems
• /
• v.16 no.5
• /
• pp.1064-1073
• /
• 2020

The general situation of system composition and safety management of high-speed railway terminal is investigated and a comprehensive evaluation index system of operational security is established on the basis of railway laws and regulations and previous research results to evaluate the operational security management of the high-speed railway terminal objectively and scientifically. Index weight is determined by introducing interval eigenvalue method (IEM), which aims to reduce the dependence of judgment matrix on consistency test and improve judgment accuracy. Operational security status of a high-speed railway terminal in northwest China is analyzed using the traditional model of fuzzy comprehensive evaluation, and a general technique idea and references for the operational security evaluation of the high-speed railway terminal are provided. IEM is introduced to determine the weight of each index, overcomes shortcomings of traditional analytic hierarchy process (AHP) method, and improves the accuracy and scientificity of the comprehensive evaluation. Risk factors, such as terrorist attacks, bad weather, and building fires, are intentionally avoided in the selection of evaluation indicators due to the complexity of risk factors in the operation of high-speed railway passenger stations and limitation of the length of the paper. However, such risk factors should be considered in the follow-up studies.

• Journal of Digital Convergence
• /
• v.17 no.1
• /
• pp.347-356
• /
• 2019

Recently, the liberalization of industrial control systems has been accompanied by a major change in the structural paradigm of information systems in the public and public sectors, and potential cyber security problems in the future major infrastructure control systems that cannot respond to the level of security of existing information systems. To cope with this, a cyber security evaluation tool that can evaluate security vulnerability in three dimensions against various infrastructure control system environment is needed. However, a cyber security evaluation in the domestic environments does not have the concept of the current security status and satisfy settings of the infrastructure. Also, the most of items in that environments have had short-term inspection themselves which makes a limitation by a technical area. In order to overcome this problems, many researches are needed to apply CSET (Cyber Security Evaluation Tool) which is the US cyber security evaluation tool to the control environment of various domestic infrastructure. In this paper, first, we analyze methods to apply to the major domain through the analysis of various case studies on existing security assessement tools. Finally, we discuss future directions.