• The KIPS Transactions:PartC
• /
• v.9C no.4
• /
• pp.481-488
• /
• 2002

Guarantee of the data integrity is important to the Virtual Private Network (VPN) which can be improved cost decreasing and effective work by applying on Internet as the private network. Thus, the integrity function in the VPN must be maintained and the security manager must be check it occasionally. In this paper we propose the VPN Integrity Evaluation System (VIES) which is collecting, and evaluating automatically the vulnerable data of VPN against current hacking mechanisms in information security system. And this VIES obtain to the results which have objectivity and fairness of evaluation by driving off the evaluation scenario based on Common Criteria (CC), and general users or non-specialist can utilize easy the security evaluation of organization.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.109-113
• /
• 2007

With increasing the mont of processed information over the network, the importance of database system increases rapidly. There are two types of security system for database, access control and data encryption. However, it is hard to evaluate security of database systems using the Common Criteria(CC) as there is no protection profile(PP) for these systems. In this paper, we propose a protection profile for secure database systems which can be used in formal evaluation using the Common Criteria. The proposed protection profile can be used by both developer and consumer to evaluate security of database systems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.179-186
• /
• 2018

The number of devices connect to the internet is rapidly increasing with the advent of the IoT(Internet of Things). The IoT has improved the convenience of life. However, it makes security issues such as privacy violations. Therefore cybersecurity is the most important issue to be discussed nowadays. Especially, various protocols are used for same purpose due to rapidly increase of IoT market. To deal with this security threat noble vulnerability analysis is needed. In this paper, we contribute to the IoT security by proposing a new randomness-based test case evaluation methodology using variance and entropy. The test case evaluation method proposed in this paper can evaluate the test cases at a high speed regardless of the test set size, unlike the traditional technique.

• Convergence Security Journal
• /
• v.21 no.1
• /
• pp.45-53
• /
• 2021

When the security monitoring system is performed in a separation network, there is little normal anomaly detection in internal networks or high-risk sections. Therefore, after the establishment of the security network, a model is needed to evaluate state-of-the-art cyber threat anomalies for internal network in separation network to complete the optimized security structure. In this study, We evaluate it by generating datasets of cyber vulnerabilities and malicious code arising from general and separation networks, It prepare for the latest cyber vulnerabilities in internal network cyber attacks to analyze threats, and established a cyber security test evaluation system that fits the characteristics. The study designed an evaluation model that can be applied to actual separation network institutions, and constructed a test data set for each situation and applied a real-time security assessment model.

• Journal of Korea Multimedia Society
• /
• v.20 no.12
• /
• pp.1970-1979
• /
• 2017

Computerization of educational administration following educational informatization of government has been steadily improved for the purpose of teachers' offload and job efficiency, finally resulting that NEIS(National Education Information System) has been completed. The NEIS consists of Nationwide service of NEIS, Business portal system of NEIS, Authentication management system and so on. Students, parents and civil petitioners handle civil affairs through Nationwide service of NEIS and teachers and persons of task conduct theirs business by accessing the Business portal system of NEIS. At this time, users have to obtain their certification from Authentication management system. Previous Studies were mainly focused on the evaluation about its performance according to the introduction of NEIS. But from now on there is a growing interest in security assessment and an efficient method for security improvement to check if NEIS works properly. Therefore, in this thesis, we'll propose an analytic framework in which security assessment is carried out after comprehending the fault structures through performing Fault Fishbone Analysis based on the Fault Tree Analysis. As a result of the system applied, the system had the highest rate of improvement to 47.7 percent.

• Journal of Korea Society of Industrial Information Systems
• /
• v.10 no.2
• /
• pp.67-75
• /
• 2005

In this paper, we design and implement real time IP security packet analyzer on IPv4 and IPv6 network. This packet analyzer sniffs and analyzes the packets generated by the protocols that are used by IPsec, IKE, IPv4 and IPv6 such as AH, ESP, ISAKMP, IP, ICMP and so on. The purpose of this analyzer is to check current security status of the network automatically. In this paper we provide implementation details and the examples of security evaluation by using our security packet analyzer system.

• Analyses & Alternatives
• /
• v.6 no.2
• /
• pp.37-78
• /
• 2022

The U.S.-led international order, sustained by overwhelming national power since the end of the Cold War, is gradually being restructured from a unipolar international system to a bipolar international system or a multipolar international system, coupled with the weakening of U.S. global leadership and the rise of regional powers. Geopolitically, discussions have been constantly raised about the security instability that the reshaping of the international order will bring about, given that East Asia is a region where the national interests of the United States and regional powers sharply overlap and conflict. This study aims to critically analyze whether security discussions in Korea are based on appropriate crisis assessment and evaluation. This paper points out that the security crisis theory emerging in Korea tends to arise due to threat exaggeration and emphasizes the need for objective evaluation and conceptualization of the nature and the level of threats that the restructured international order can pose to regional security. Based on the analysis of changes in conflict patterns (frequency and intensity), occurring in East Asia during the periods divided into a bipolar system (1950-1990), a unipolar system (1991-2008), and a multipolar system (2009-current), this study shows that East Asia has not been as vulnerable to power politics as other regions. This investigation emphasizes that the complexity of Korea's diplomatic and security burden, which are aggravated by the reorganization of the international order, do not necessarily have to be interpreted as a grave security threat. This is because escalating unnecessary security issues could reduce the diplomatic strategic space of the Republic of Korea.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.2
• /
• pp.141-153
• /
• 2009

Recently, public and national institutions establish secure system with installed and operational by IT products for security. They required the Common Criteria for assurance of IT products. However, many company hard to decide when IT products release and develop investment because of cost and spend-time problem. Therefore, in this paper, we analyze domestic and international IT products evaluation services, and proposes simplification IT products evaluation service compared with previous services.

• Convergence Security Journal
• /
• v.13 no.5
• /
• pp.117-127
• /
• 2013

Even though, the Korean private Security Guard's industry is developing, it did not reached at the expected quality services because of the below cost tendering from flooded small security companies, consequently low pays and fragile benefits occur therefore, the skill level and morale decreased. Also, the private security guards field's education, training and development of expert certification system is not enough. One of the plans to solve these problems can be invigorate the certification system. The improving ways are suggested after the research and the analysis of the certification system as below. First, the qualification system to become a security leader will need to add directly related subject, skill examination and continuous refresh training. Moreover, it needs accurate needed the number of the securities and the reduction of the 1st examination exemption object. Second, the qualified system to be become securities will need to strengthen on standard of qualification and focus on skill evaluation, the job education need to state by the law, also exemption for applicant who approached requirements.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.4
• /
• pp.809-826
• /
• 2018

The entropy evaluation method for noise sources is one of the evaluation methods for the random number generator that is the essential element of modern cryptographic systems and cryptographic modules. The primary entropy evaluation methods outside of the country are more suitable to apply to hardware noise sources than software noise sources, and there is a difficulty in quantitative evaluation of entropy by software noise source. In this paper, we propose an entropy evaluation method that is suitable for software noise sources, considering characteristics of software noise sources. We select time-dependent noise sources that are software noise sources of Windows OS, and the heuristic analysis and experimental analysis are performed considering the characteristics of each time-dependent noise source. Based on these analyses, we propose an entropy harvest method from the noise source and the min-entropy estimation method as the entropy evaluation method for time-dependent noise sources. We also show how to use our entropy evaluation method in the Conditioning Component described in SP 800-90B of NIST(USA).