• 한국디지털정책학회:학술대회논문집
• /
• 한국디지털정책학회 2003년도 창립학술대회
• /
• pp.241-250
• /
• 2003

With an increasing awareness of information security, the market demand for better information security goods and services causes shortage in well trained information security manpower. This study analyzes the priorities of the options available to the qualitative information security manpower training policy. The analysis is conducted through four hierarchies: goals, criteria, sub-criteria and alternatives for each of which priorities are developed through the rating approach of the Analytic Hierarchy Process (AHP). 3 criteria and 8 sub-criteria are involved in the four hierarchies. The analysis result indicates that the fundamental information security technology is the most desirable.

• Journal of Digital Convergence
• /
• 제11권2호
• /
• pp.43-50
• /
• 2013

Recently, Cyber threats that is doing intelligence and sophistication from the organization's information assets to secure order technical disciplines, as well as managerial and environmental sectors, such as mind-response system is must established. In this paper, possible to analyze the case for the theory in network security, such as the logical network and physical network separation suitable for the corporate environment and constantly respond and manage the Information Security Management Model A secure network design is proposed. In particular, the proposed model improvements derived from the existing network, network improvements have been made in order to design improved ability to respond to real-time security and central manageability, security threats, pre-emptive detection and proactive coping, critical equipment in the event of a dual hwalreu through applied features such as high-availability, high-performance, high-reliability, ensuring separation of individual network security policy integrated management of individual network, network security directional.

• Journal of Information Technology Applications and Management
• /
• 제26권4호
• /
• pp.31-39
• /
• 2019

The 129 public institutions in Korea are subject to Information Security Management Condition Evaluation (ISMCE) as a part of the government management evaluation system by the Ministry of Economy and Finance. ISMCE is started in 2006 with the central government institutions, and applied to the all public institutions in 2009. This evaluation is annually conducted by the National Intelligence Service through the site visits, and the number of the evaluated institutions is increasing year by year. However, the process of ISMCE - identifying existing vulnerabilities in the information system - is conducted manually. To improve this inconvenience, this paper introduces the various evaluation system in the major countries, especially in the United States, and analyzes the Security Content Automation Protocol (SCAP) by NIST. SCAP is automation protocol for the system vulnerability management (in technical fields) and security policy compliance evaluation. Based on SCAP, this paper suggests an improvement plan for the ISMCE of Korea.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권1호
• /
• pp.240-263
• /
• 2021

One of the biggest challenges that the software industry is facing today is to create highly efficient applications without affecting the quality of healthcare system software. The demand for the provision of software with high quality protection has seen a rapid increase in the software business market. Moreover, it is worthless to offer extremely user-friendly software applications with no ideal security. Therefore a need to find optimal solutions and bridge the difference between accessibility and protection by offering accessible software services for defense has become an imminent prerequisite. Several research endeavours on usable security assessments have been performed to fill the gap between functionality and security. In this context, several Multi-Criteria Decision Making (MCDM) approaches have been implemented on different usability and security attributes so as to assess the usable-security of software systems. However, only a few specific studies are based on using the integrated approach of fuzzy Analytic Network Process (FANP) and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) technique for assessing the significant usable-security of hospital management software. Therefore, in this research study, the authors have employed an integrated methodology of fuzzy logic, ANP and TOPSIS to estimate the usable - security of Hospital Management System Software. For the intended objective, the study has taken into account 5 usable-security factors at first tier and 16 sub-factors at second tier with 6 hospital management system softwares as alternative solutions. To measure the weights of parameters and their relation with each other, Fuzzy ANP is implemented. Thereafter, Fuzzy TOPSIS methodology was employed and the rating of alternatives was calculated on the foundation of the proximity to the positive ideal solution.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• 제32권6호
• /
• pp.1183-1192
• /
• 2022

Information and Information processing systems must maintain a certain level of security during the total life cycle of Information. To maintain a certain level of security, security management processes are applied to software, automobile development, and the U.S. federal government information system over a life cycle, but theme of no similar security management process in Korea. This paper proposes a Korean-style security risk management framework to maintain a certain level of security in the total life cycle of information and information processing system in the defense sector. By applied to the defense field, we intend to present the direction of defense security work in the future and induce an shift in security paradigm.

• Journal of Information Technology Applications and Management
• /
• 제18권2호
• /
• pp.91-108
• /
• 2011

Enormous losses of shareholders and consumers caused by the risks threatening today's business (e.g., accounting fraud and inside trading) have ignited the necessity of international regulations on corporate ethics and internal control, such as Basel II and SOX. Responding to these regulations, companies are establishing governance system, applying it consistently to the core competency of the company, and increasing the scope of the governance system. Recently occurred security related incidents require companies to take more strict accountability over information security. One of the results includes strengthening of legislation and regulations. For these reasons, introduction of information security governance is needed. Information security governance governs the general information security activities of the company (establishment of information security management system, implementation of information security solutions) in the corporate level. Recognizing that the information security is not restricted to IT domain, but is the issue of overall business, this study develops information security governance framework based on the existing frameworks and systems of IT governance. The information security governance framework proposed in the study include concept, objective, and principle schemes which will help clearly understand the concepts of the information security governance, and execution scheme which will help implement proper organization, process and tools needed for the execution of information security governance.

• Journal of Information Technology Services
• /
• 제15권3호
• /
• pp.33-50
• /
• 2016

In a dynamic IT environment, employees often utilize external IT resources to work more efficiently and flexibly. However, the use of external IT resources beyond its control may cause difficulties in the company. This is known as "Shadow IT." In spite of efficiency gains or cost savings, Shadow IT presents problems for companies such as the outflow of enterprise data. To address these problems, appropriate measures are required to maintain a balance between flexibility and control. Therefore, in this study, we developed a new information security management system called AIIMS (Advanced IT service & Information security Management System) and the Shadow IT Evaluation Model. The proposed model reflects a Shadow IT's attributes such as innovativeness, effectiveness, and ripple effect. AIIMS consists of five fields: current analysis; Shadow IT management plans; management process; education and training; and internal audit. There are additional management items and sub-items within these five fields. Using AIIMS, we expect to not only mitigate the potential risks of Shadow IT but also create successful business outcomes. Now is the time to draw to the Light in the Shadow IT.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• 제22권3호
• /
• pp.553-564
• /
• 2012

Today's security initiatives tend to integrate the physical and information securities which have been run by completely separate departments. That is, the converged security management becomes the core in the security market trend. However, to the best of our knowledge, we cannot find any solutions how to combine these two security events for the converged security. In this paper, we propose an information security object-driven approach which utilizes the physical security events to enhance and improve the information security. For scalability, we also present a systematic method using the analytic hierarchy process finding the meaningful event combinations among the large number of physical security events. In particular, we show the whole implementation processes in detail where we consider the information security object 'illegal computing system access' combined with two physical security devices - access controller and CCTV+video analyzer system.

• Korean Security Journal
• /
• 제56호
• /
• pp.55-81
• /
• 2018

The purpose of this study is to find significant activities in human resource management (HRM) to solve growing-pains caused by the rapid external growth in private security business. To this end, we applied the HRM factors suggested by the National Job Capability Standard (NCS) to the private security and investigated the relative importance using the Analytic Hierarchy Process (AHP). The results were as follows. First, the importance of 4 HRM criteria in the private security was ranked in order of recruitment, operation, benefit, and retirement. Particularly, the relative importance of recruitment reached 63.8%. Second, the composite importance was calculated by dividing the 4 HRM criteria into 14 capability sub-criteria and 46 capability alternatives. As a result, personnel planning and hiring at the recruitment turned out as the areas that needed the most improvement. In addition, the operating and planning of education involved in the highest rank, 8th and 10th respectively. Based on these results, we suggested critical HRM factors for developing the private security business as well as proposed research directions and methods for further studies.

• Journal of Korea Society of Digital Industry and Information Management
• /
• 제12권1호
• /
• pp.71-79
• /
• 2016

The main security threats in MANET are integrity and non-repudiation. In the meantime, a lot of secure routing protocols have been designed in order to block these security threats. In this paper, partnership-based authentication technique is proposed in order to provide participation exclusion of network and non-repudiation for the nodes. The proposed technique is a technique that participates in data communication for only the nodes receiving the authentication through the authentication process for the nodes. For this, the proposed technique is largely consists of two steps. The first step is the process that issued the certificate after the reliability for the nodes participating in the network is evaluated. And in the second step, the key exchange agreement with the neighbor nodes is performed and data communication is made after setting security path with responding nodes. The level of security in data transmission is improved because the process of path setting is performed through cooperation with a neighboring nodes having high reliability during the course of these two steps. The superiority of proposed technique in this paper was confirmed through the comparative experiment.