• Journal of the Korea Safety Management & Science
• /
• v.14 no.3
• /
• pp.119-126
• /
• 2012

Recently, the breakdown of online banking servers and the leakage of customer information give rise to much concern about the security of information systems in financial and banking companies in Korea. The enforcement of security for information system becomes much more important issue than earlier. However, the security reinforcement of information system is restricted by a budget. In addition, the activities' cost to secure information system from threatening are under uncertain circumstances and should be established by a human decision maker who is basically uncertain and vague. Thus, making the budget for information system is exposed to any extent of the risk for these reasons. First, we introduce brief fuzzy set theory and fuzzy AHP (Analytic Hierarchy Process) methodology. Then, the cost elements that comprise yearly budget are presented and the priorities among the cost elements are calculated by fuzzy AHP. The cost elements that are exposed to risk are evaluated from the both perspectives of the risk impact and risk occurrence possibility which are expressed as linguistic terms. To get information on the risk profiles-pessimistic, most likely, and optimistic-for each cost element, the evaluation is accomplished and the result is presented. At last, the budget ranges-minimum, mode, maximum-for each cost element are estimated with the consideration of the risk profiles.

• Korean Security Journal
• /
• no.30
• /
• pp.117-138
• /
• 2012

To cope with rapidly increasing crimes, the Smart-home system has become common to minimize and prevent crimes in the residential space. Accordingly, the interest on the security-related Smart-home system is also increasing. First is the establishment of Smart-home security standard. At present, the Smart-home security systems are implemented by individual policies of construction companies or by the requirement of residents. Each construction company has their own characteristics in the Smart-home security system; while there is no standardized system. Second is the introduction of Smart-home security certificate system. Like people have certificates, now the residential spaces may also need certificates. A certificate system that represents the performance of residential spaces cannot be an absolute criterion in the evaluation of apartment quality, however, it can be a basic requirement for the convenient residential environment and policies being implemented by the government. If a certificate system would be introduced, construction companies will compete with each other to provide with better security system and apartment operation companies will hire more specialized security personnel in order to get higher certificates. Consequently, better security of residential space will be secured. It is also required to develop and establish response measures by studying the key changes and trends of Smart-home security system. The advance in mechanical security devices will bring about more changes in the future. Therefore, more various in-depth studies are required on the basic specifications of security system in the residential spaces.

• Journal of the Korea Convergence Society
• /
• v.8 no.10
• /
• pp.61-66
• /
• 2017

Recently, IoT technology is rapidly developing with the keyword "Anytime, Anywhere, Convenient". In addition, security problems in IoT systems are exploding and the damage is increasing as well. In this paper, we propose a method to develop IoT system safely by using internationally recognized CC evaluation in ICT by identifying the standardization and security technology development status defining IoT system security requirements. For this purpose, IoT system and service security aspects are analyzed. Based on this, it is possible to design the security functional requirements and to demonstrate the rationale of the security objective through the correspondence relation, and it is possible to design the protection profile for the IoT system. This is a sufficient basis for the development methodology to be presented in this paper because it is used as a means of referring to the set of security requirements of administrators, developers, and users.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.5
• /
• pp.45-57
• /
• 2009

In this paper, we implemented the conference system based on DTLS for saving securely the VoIP, which is served sprightly in the latest, securely and tested (and also analyzed) the system. As VoIP technology development, demand of conference system is increased and the related technologies are growed. But Security protocol to protect conference service is getting late than conference technology. In this paper, we studied based on DTLS protocol that can provide function of signaling, channel security, media channel security and application of group key and apply to VoIP conference system based UDP unchanged. In this paper, we searched suggested security protocols based on DTLS can apply to conference system and implement and apply the protocol to conference system. And we tested (and also alayzed) overhead of encryption and key management mechanism.

• Journal of Electrical Engineering and Technology
• /
• v.12 no.5
• /
• pp.2051-2066
• /
• 2017

This paper deals with reconfigurable secured mobile systems where the reconfigurability has the potential of providing a required adaptability to change the system requirements. The reconfiguration scenario is presented as a run-time automatic operation which allows security mechanisms and the addition-removal-update of software tasks. In particular, there is a definite requirement for filtering and intrusion detection mechanisms that will use fewer resources and also that will improve the security on the secured mobile devices. Filtering methods are used to control incoming traffic and messages, whereas, detection methods are used to detect malware events. Nevertheless, when different reconfiguration scenarios are applied at run-time, new security threats will be emerged against those systems which need to support multiple security objectives: Confidentiality, integrity and availability. We propose in this paper a new approach that efficiently detects threats after reconfigurable scenarios and which is based on filtering and intrusion detection methods. The paper's contribution is applied to Android where the evaluation results demonstrate the effectiveness of the proposed middleware in order to detect the malicious events on reconfigurable secured mobile systems and the feasibility of running and executing such a system with the proposed solutions.

• Nuclear Engineering and Technology
• /
• v.45 no.5
• /
• pp.637-652
• /
• 2013

Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security.. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system.

• Journal of Internet Computing and Services
• /
• v.25 no.1
• /
• pp.167-176
• /
• 2024

Chatbot services are used in various fields in connection with AI services. Security research on AI is also in its infancy, but research on practical security in the service implementation stage using it is more insufficient. This paper analyzes the security requirements for chatbot services linked to AI services. First, the paper analyzes the recently published papers and articles on AI security. A general implementation model is established by investigating chatbot services provided in the market. The implementation model includes five components including a chatbot management system and an AI engine Based on the established model, the protection assets and threats specialized in Chatbot services are summarized. Threats are organized around threats specialized in chatbot services through a survey of chatbot service managers in operation. Ten major threats were drawn. It derived the necessary security areas to cope with the organized threats and analyzed the necessary security requirements for each area. This will be used as a security evaluation criterion in the process of reviewing and improving the security level of chatbot service.

• Convergence Security Journal
• /
• v.15 no.1
• /
• pp.27-36
• /
• 2015

A discussion on false alarm is a series of problems about a waste of police resources. The the false alarm primarily increase machine the cost of security firm but ultimately increase the costs of national and social management. Verified Report System has been in operation since July 1, 2013, We could analyze the actual operation of 112 report on false alarm rate was 82.4% before this system launched, but after implementation of the Verified Report System, this rate level downs below 69.7% records. So 12.7% is declined at the rate of false alarm. However, the actual alarm rate of Electronic Security itself is just only 0.3 % in the total number of cases responding in contrast to Police is considerable. It is more urgent to evolve the Verified Report System, so penalty system against the false alarm, Police registration system of sensors, and strengthening of the task of the company for installation and management of detection equipment are urgently needed.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.629-632
• /
• 2002

공공기관은 자신의 정보시스템에 대한 보안 대책을 수립하기 위하여 자체 보안·분석평가를 수행함으로써 적절한 보안 목표와 방향을 설정해야 한다. 하지만, 현재 연구되어 있는 위험분석 및 보안평가방법론등은 복잡하고 전문적인 사항이 많으므로 자체 보안분석을 수행하기에는 인력 및 비용이 많이 소요된다. 이를 위하여 본 논문에서는 정보시스템의 위험분석방법론에서 제시하는 자산, 취약점, 위협, 대응책에 보안평가방법론을 포함하여 정보시스템에 대한 모델링, 가정, 증상, 원인, 해결책등을 통한 자가진단 보안 분석·평가 방법을 제시한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.533-537
• /
• 2003

보안 시스템의 안전성을 분석하기 위해서는, 정형적 방법론을 사용하여 보안 시스템에 대한 이론적인 수학적 모델을 정형적으로 설계하고, 보안 속성을 정확히 기술해야만 한다. 본 논문에서는 보안 시스템의 안전성을 검증하기 위한 보안모델의 구성요소와 안전성 검증방법을 설명한다. 그리고 보안모델을 설계하고 안전성을 분석하기 위한 SEW(Safety Evaluation Workshop)의 전체 구조와 SPR(Safety Problem Resolver) 정형검증도구의 검증방법 및 기능에 대해 소개하고자 한다.