• Journal of Information Processing Systems
• /
• 제16권1호
• /
• pp.61-82
• /
• 2020

The security risk management used by some service providers is not appropriate for effective security enhancement. The reason is that the security risk management methods did not take into account the opinions of security experts, types of service, and security vulnerability-based risk assessment. Moreover, the security risk assessment method, which has a great influence on the risk treatment method in an information security risk assessment model, should be security risk assessment for fine-grained risk assessment, considering security vulnerability rather than security threat. Therefore, we proposed an improved information security risk management model and methods that consider vulnerability-based risk assessment and mitigation to enhance security controls considering limited security budget. Moreover, we can evaluate the security cost allocation strategies based on security vulnerability measurement that consider the security weight.

• Asia pacific journal of information systems
• /
• 제18권4호
• /
• pp.1-26
• /
• 2008

Rapid progress of information technology and widespread use of the personal computers have brought various conveniences in our life. But this also provoked a series of problems such as hacking, malicious programs, illegal exposure of personal information etc. Information security threats are becoming more and more serious due to enhanced connectivity of information systems. Nevertheless, users are not much aware of the severity of the problems. Using appropriate password is supposed to bring out security effects such as preventing misuses and banning illegal users. The purpose of this research is to empirically analyze a research model which includes a series of factors influencing the effectiveness of passwords. The research model incorporates the concept of risk based on information systems risk analysis framework as the core element affecting the selection of passwords by users. The perceived risk is a main factor that influences user's attitude on password security, security awareness, and intention of security behavior. To validate the research model this study relied on questionnaire survey targeted on evening class MBA students. The data was analyzed by AMOS 7.0 which is one of popular tools based on covariance-based structural equation modeling. According to the results of this study, while threat is not related to the risk, information assets and vulnerability are related to the user's awareness of risk. The relationships between the risk, users security awareness, password selection and security effectiveness are all significant. Password exposure may lead to intrusion by hackers, data exposure and destruction. The insignificant relationship between security threat and perceived risk can be explained by user's indetermination of risk exposed due to weak passwords. In other words, information systems users do not consider password exposure as a severe security threat as well as indirect loss caused by inappropriate password. Another plausible explanation is that severity of threat perceived by users may be influenced by individual difference of risk propensity. This study confirms that security vulnerability is positively related to security risk which in turn increases risk of information loss. As the security risk increases so does user's security awareness. Security policies also have positive impact on security awareness. Higher security awareness leads to selection of safer passwords. If users are aware of responsibility of security problems and how to respond to password exposure and to solve security problems of computers, users choose better passwords. All these antecedents influence the effectiveness of passwords. Several implications can be derived from this study. First, this study empirically investigated the effect of user's security awareness on security effectiveness from a point of view based on good password selection practice. Second, information security risk analysis framework is used as a core element of the research model in this study. Risk analysis framework has been used very widely in practice, but very few studies incorporated the framework in the research model and empirically investigated. Third, the research model proposed in this study also focuses on impact of security awareness of information systems users on effectiveness of password from cognitive aspect of information systems users.

• 한국정보시스템학회지:정보시스템연구
• /
• 제17권1호
• /
• pp.23-43
• /
• 2008

Nowadays, openness and accessibility of information systems increase security threats from inside and outside of organization. Appropriate password is supposed to bring out security effects such as preventing misuses and banning illegal users. This study emphasizes on choosing passwords from perspective of information security and investigated user's security awareness affecting behavioral intention. The research model proposed in this study includes user's security belief which is influenced by risk awareness factors such as information assets, threats and vulnerability elements. The risk awareness factors ale derived from risk analysis methodologies for information security. User's risk awareness is a factor influencing the security belief, attitude toward security behavior, and security behavioral intention. According to the result of this study, while vulnerability is not related to the risk awareness, information assets and threats are related to the user's risk awareness. There is a significant relationship between risk awareness and security belief. Also, user's security behavioral intention is significantly affected by security attitude.

• 한국컴퓨터정보학회논문지
• /
• 제24권11호
• /
• pp.99-107
• /
• 2019

사이버 보안을 위한 활동인 '위험관리(Risk management)'와 '보안관제(security monitoring)' 업무는 미래에 발생할 보안 위협에 대비하고 보안 사고를 최소화 하는 활동이라는 점에서 깊은 상관관계를 가지고 있다. 또한 위험관리와 보안관제 분야 모두 관리자에게 시각적으로 그 정보자산에 대한 위협을 보여주는 패턴 모델을 적용하는 것이 효과적이다. 검증받은 패턴모델로는 전통적인 품질관리 분야에서 오랫동안 사용되어온 '관리도'(control chart)모델이 존재하지만 정보시스템의 사이버 위험관리와 보안관제에서의 활용은 부족하다. 이에 본 논문에서는 위험관리와 보안관제 시스템을 통합한 사이버 SRM(Security Risk Monitoring)시스템을 설계하였다. SRM은 '관리도'의 패턴을 이용한 '보안대책' (security control)의 적용 전략을 제시한다. 보안대책은 기존의 표준화된 보안대책 집합인 ISMS, NIST SP 800-53, CC를 통합적으로 적용하였다. 이를 활용하여 2014~2018년 까지 4년간 우리나라사이버위기 경보동향을 분석하였고 이는 향후 보다 유연한 보안대책 수립을 가능하게 한다.

• The Journal of Asian Finance, Economics and Business
• /
• 제7권6호
• /
• pp.221-231
• /
• 2020

This research investigates the relationship among product risk, financial risk, security risk, privacy risk, perceived satisfaction, and purchase intention. Validated measurements were identified from a literature review. The measurement model and the conceptual model depicting hypothesized relationships were evaluated based on responses from 306 customers using confirmatory factor analysis and structural equation modeling. The results showed that product risk, financial risk, security risk, and privacy risk impacted on perceived satisfaction. Besides, product risk, privacy risk, and perceived satisfaction influenced purchase intentions. Thus, this study focused on the influences of product risk, financial risk, security risk, and privacy risk on their cognitive attitudes toward websites. That means the more consumer perceive security, the more they avoid shopping online. The study is important to show how perceived risk affects online shopping behaviors, and it invites marketers to make necessary adjustments to prevent perceived risks to increase and online shopping to decrease. The findings of this study suggest the creation of a framework on the effect of perceived risk types on online shopping. Managers need to take perceived risks into account when designing their electronic marketing channels. In addition, shopping websites should strengthen their transaction security by appropriately using various available resources and new information technologies.

• 디지털융복합연구
• /
• 제17권1호
• /
• pp.141-148
• /
• 2019

디지털 기술의 발전으로 지능화 및 융합화가 가속화됨에 따라, 비즈니스 모델 및 인프라, 기술 등 여러 측면에서 기존 방식을 초월한 변화가 요구되고 있다. 변화된 비즈니스 환경에서는 다양한 보안 위험이 점증하고 있으며, 보안 위험관리의 중요성이 더욱 커지고 있다. 기존의 정보자산 기반의 위험관리에서 벗어나 비즈니스 중심의 위험관리가 대두되고 있는 시점에서 이를 위해서는 비즈니스 목표 달성을 위한 위험성향(Risk Appetite)을 파악하는 것이 필수적이며, 이는 추후 프로세스에서 발생하는 제반 의사결정 과정에 있어 판단 기준을 제공한다. 따라서 본 논문에서는 기존 위험성향 선행연구 분석 및 보호동기이론을 분석하여, 보안 위험성향 수준을 파악할 수 있는 프레임워크를 개발하였다. 또한 개발된 위험성향 프레임워크의 실무적 타당성을 검토하기 위해, 보안 위험관리 실무 전문가들로 구성된 자문위원회를 통해 적용가능성과 중요성을 검토하였다. 검토 결과, 재무, 운영, 기술, 평판, 컴플라이언스, 문화 6개의 보안 위험성향 고려 위험분야와 인지된 심각성, 인지된 취약성, 자기효능감, 반응효능감 4개의 요인이 보안 위험성향 측정을 위한 프레임워크 구성요소로서 타당한 것으로 검토되었다.

• Journal of Information Processing Systems
• /
• 제12권2호
• /
• pp.226-233
• /
• 2016

Cloud computing is a distributed computing model that has lot of drawbacks and faces difficulties. Many new innovative and emerging techniques take advantage of its features. In this paper, we explore the security threats to and Risk Assessments for cloud computing, attack mitigation frameworks, and the risk-based dynamic access control for cloud computing. Common security threats to cloud computing have been explored and these threats are addressed through acceptable measures via governance and effective risk management using a tailored Security Risk Approach. Most existing Threat and Risk Assessment (TRA) schemes for cloud services use a converse thinking approach to develop theoretical solutions for minimizing the risk of security breaches at a minimal cost. In our study, we propose an improved Attack-Defense Tree mechanism designated as iADTree, for solving the TRA problem in cloud computing environments.

• Asia pacific journal of information systems
• /
• 제15권2호
• /
• pp.65-96
• /
• 2005

It is generally believed that, compared to traditional commerce, Electronic Commerce(EC) is more difficult to gain and sustain customers. One of the major reasons that customers do not use EC is lack of trust. Previous researches on the EC user's trust suggested that risk is an antecedent of trust and the concept of trust is highly related to risk. This study proposed a combined model in which includes the factors based on generic information security risk analysis methodology and trust factors in EC. The objectives of this study are follows; first, investigating the relationship between trust and risk that are antecedent factors of purchase intention, and second, examining the validity of information security risk analysis approach in EC environment. Based on the survey results of 143 MBA students statistical analysis showed that factors like threats and controls were significantly related to risk, but assets did not have statistically significant relationship with risk. Controls and knowledge of EC had meaningful effect on user's trust. This study found that risk analysis methodology which is generally used at organizational level is practically useful at user level on EC environment. In conclusion, the results of this study would be applied to generic situation of information security for analyzing and managing the risk. Besides, this study emphasized that EC vendors need to pay more attention to the information security risk to gain customer's trust.

• 정보보호학회논문지
• /
• 제25권6호
• /
• pp.1595-1606
• /
• 2015

위험분석은 위험을 허용 가능한 수준으로 관리하기 위한 방안을 수립하는 데 활용된다. 이러한 위험관리 의사결정에 있어서 위험의 시각화는 중요하다. 그러나 기존의 위험 시각화 방식은 위험의 요소들을 고려하여 입체적으로 위험을 시각화하는 데 있어서 한계를 지닌다. 본 논문에서는 기밀성, 무결성, 가용성 측면에서 개별적 혹은 종합적으로 위험을 표현할 수 있는 개선된 위험도 3차원 시각화 방법을 제시한다. 제안된 방법을 기업의 위험분석 평가에 적용하여 유효성을 검증한다. 제안된 시각화 방법은 내부통제를 위한 정보보호 의사결정 과정에 효과적으로 활용될 수 있다.

• 융합보안논문지
• /
• 제20권2호
• /
• pp.15-28
• /
• 2020

스마트시티는 기존 도시의 문제를 해결하고 새로운 부가가치를 창출할 것으로 큰 기대를 받고 있으나, 보안위험 증가에 우려 또한 증가하고 있다. 보안위험 인식에 따른 스마트시티에 대한 부정적 태도는 4차산업혁명 기술 활성화 및 스마트시티의 발전을 위해서도 개선해야 하는 문제이다. 이에 본 연구는 지각된 위험 이론과 사용자 저항이론을 바탕으로 스마트시티 내 위험요인과 스마트시티 저항 태도 간 관계를 통계적으로 분석하였다. 288명의 연구 표본을 대상으로 한 실증 분석결과에 따르면, 보안 위험, 사회적 위험, 신체적 위험요인은 스마트시티 저항에 직접적인 영향을 미치는 반면, 경제적, 성능, 사생활 침해에 대한 위험은 유의미한 영향이 없는 것으로 나타났다. 또한, 보안위험이 다른 위험에 선행요인으로 작용할 수 있다는 것을 검증하였으며, 스마트시티 환경에서는 사생활 침해 위험과 보안 위험에 대해 구분해서 논의할 필요성이 있음을 확인하였다. 본 연구는 일반인들 관점에서 스마트시티 인식에 부정적인 영향을 미치는 위험요인을 논의함으로써, 스마트시티 활성화를 위해 보안 및 안전 문제와 더불어 사회적 교류를 위한 정책적 방안 마련이 필요함을 보여준다.