• 한국IT서비스학회지
• /
• 제8권1호
• /
• pp.47-58
• /
• 2009

The information protection security diagnosis institution was applied services since 2004, for the leveling up of public information protection and the establishment of the stability and reliability of information communication. And this security diagnosis was implemented actually on the 142 firms in 2005, the 160 firms in 2006 and the 205 firms in 2007. But this is recognized by the some firms as one of the unnecessary regulations. And there are some difficulties with collecting the subjective and reliable source data for establishing the information protection security diagnosis target. In this research, the enhanced model on the selection of information protection security diagnosis target firms was suggested by the interview with some expert and the analysis for the related actual data. By the model which are introduced from the statistical analysis of the related data and the summary of some expert's suggestions, information protection security diagnosis target can include the information telecommunication service providers taking 5 billion won as sales in a year, and web service providers like as shopping mall site, with the personal records of 2 million subscribers.

• 한국컴퓨터정보학회논문지
• /
• 제24권9호
• /
• pp.35-42
• /
• 2019

In this paper, we propose an approach to apply network-based moving target defense into Internet of Things (IoT) networks. The IoT is a technology that provides the high interconnectivity of things like electronic devices. However, cyber security risks are expected to increase as the interconnectivity of such devices increases. One recent study demonstrated a man-in-the-middle attack in the statically configured IoT network. In recent years, a new approach to cyber security, called the moving target defense, has emerged as a potential solution to the challenge of static systems. The approach continuously changes system's attack surface to prevent attacks. After analyzing IPv4 / IPv6-based moving target defense schemes and IoT network-related technologies, we present our approach in terms of addressing systems, address mutation techniques, communication models, network configuration, and node mobility. In addition, we summarize the direction of future research in relation to the proposed approach.

• 시큐리티연구
• /
• 제56호
• /
• pp.9-30
• /
• 2018

범죄 문제가 심각한 우리 사회의 현실에서, 최근에는 범죄와 범죄두려움 문제를 실질적으로 줄이기 위하여 CPTED 등 각종 범죄의 사전 예방 전략을 도입하고 있으며, 소위 타겟하드닝(Target Hardening) 또한 범죄예방, 특히 침입범죄의 방지 전략의 하나로서 활용되고 있다. 침입범죄와 같이 가장 빈번하게 발생하면서 국민 특히 취약계층 서민들의 생활안전을 꾸준하고 집요하게 위협하는 위험도 높은 범죄 유형에 대응하기 위해 그간 우리 사회가 자원을 투자해 온 셉테드 전략은 CCTV나 조명, 경보장치 등 간접적이고 심리적인 억제를 중심으로 하고 있어서 직접적으로 방어하기에는 사실상 실효성에 많은 한계가 있다. 바로 이런 한계를 극복하기 위한 타겟하드닝은 침입범죄와 같은 범죄를 보다 직접적이고 실효적으로 차단하고 방지하는 전략으로 잘 알려져 있다. 우리나라에서도 2016년에 전국 최초로 안산시에서 실험이 이루어졌고 이 연구는 실험지역을 선정하여 침입방어성능이 인증된 방범시설을 주요 침입구인 창문 등에 설치하는 타겟하드닝 전략을 수행한 후 침입범죄 감소효과를 경찰 공식 범죄통계를 활용하여 분석한 것이다. 소위 범죄전이효과도 살펴보기 위해 방범인증시설 설치지역과 주변 완충지역, 그리고 통제지역과의 범죄발생을 비교하는 WDQ(Weighted Displacement Quotient) 분석을 수행하였다. 분석 결과 타겟하드닝 CPTED기법의 침입 범죄 경감의 효과는 상당한 것으로 나타났다. 통제지역에서도 침입범죄가 다소 감소한 것은 사실이지만, 방범인증시설이 설치된 실험지역의 주택들은 침입 범죄가 설치 후에 크게 감소하였다. 완충지대로 범죄전이 효과는 보이지 않았으며 오히려 주변지역의 범죄 또한 감소하였다.

• 융합보안논문지
• /
• 제16권5호
• /
• pp.65-71
• /
• 2016

최근 무선 센서 네트워크는 다양한 분야에 적용되고 있다. 무선 센서 네트워크는 안정적인 네트워크 설계 뿐만 아니라 보안이나, 군 그리고 병원의 응급 처리에도 적용되고 있다. 이러한 다양한 응용 중에서 어떤 침입자나 위기 상황이 발생했을 경우 이를 신속히 위치를 추적하는 방법이 아주 필수적인 연구 분야가 되고 있다. 이러한 방법을 측위라고 정의하고, 센서 노드의 전파범위를 기반으로 측위를 효율적으로 처리하는 기법을 제안한다. 또한 측위를 위하여 필수적인 효율적인 클러스터링 방법과 알고리즘을 제안한다.

• 대한전기학회:학술대회논문집
• /
• 대한전기학회 2003년도 하계학술대회 논문집 D
• /
• pp.2744-2746
• /
• 2003

ISO/IEC 15408 requires the TOE(Target of Evaluation) Security Environment section of a Protection Profile(PP) or Security Target(ST) to contain a list of assumptions about the TOE security environment or the intended usage of the TOE. This paper presents a specific conditions should be assumed to exist in the smart card environment and the analysis of those conditions developer of smart card PP must consider.

• 시큐리티연구
• /
• 제6호
• /
• pp.327-340
• /
• 2003

As a countermeasure under accidental occurrence situation, First, as application form of martial arts, A security guard foster ability that can protect a target person of guard and own body under accidental occurrence situation through incessant martial arts practice. To achieve this purpose, incessant training mental power and physical strength reinforcement should be kept on to prevent, therefore make a safety control function for such as weapon, small arms, explosive, vehicles terror etc. happened under accidental occurrence situation. Second, according to the contents of training based on the classification category of martial arts for security guard under accidental situation, a security guard must keep safety distance necessarily lest a target person of gurad should be attacked by attacker, therefore, intercept an attack opportunity if a safety distance between a target person of guard and attacker is not kept. Third, It is to practice confrontation techniques based on the type of attack. A security guard must develp situation disposal ability that can cope properly with the attack using empty hands, murderous weapon, small arms, explosive by case or individual or mass of threat that impose danger and injury in a target person's body of guard.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제16권3호
• /
• pp.1063-1075
• /
• 2022

In recent years, container techniques have been broadly applied to cloud computing systems to maximize their efficiency, flexibility, and economic feasibility. Concurrently, studies have also been conducted to ensure the security of cloud computing. Among these studies, moving-target defense techniques using the high agility and flexibility of cloud-computing systems are gaining attention. Moving-target defense (MTD) is a technique that prevents various security threats in advance by proactively changing the main attributes of the protected target to confuse the attacker. However, an analysis of existing MTD techniques revealed that, although they are capable of deceiving attackers, MTD techniques have practical limitations when applied to an actual cloud-computing system. These limitations include resource wastage, management complexity caused by additional function implementation and system introduction, and a potential increase in attack complexity. Accordingly, this paper proposes a software-defined MTD system that can flexibly apply and manage existing and future MTD techniques. The proposed software-defined MTD system is designed to correctly define a valid mutation range and cycle for each moving-target technique and monitor system-resource status in a software-defined manner. Consequently, the proposed method can flexibly reflect the requirements of each MTD technique without any additional hardware by using a software-defined approach. Moreover, the increased attack complexity can be resolved by applying multiple MTD techniques.

• 대한전기학회:학술대회논문집
• /
• 대한전기학회 2003년도 하계학술대회 논문집 D
• /
• pp.2747-2749
• /
• 2003

Security is concerned with the protection of assets from threats, where threats are categorised as the potential for abuse of protected assets. All categories of threats should be considered, but in the domain of security greater attention is given to those threats that are related to malicious or other human activities ISO/IEC 15408 requires the TOE(Target of Evaluation) Security Environment section of a Protection Profile(PP) or Security Target(ST) to contain a list of threats about the TOE security environment or the intended usage of the TOE. This paper presents a specific physical threats should be considered in the smart card PP which developers of smart card PP must consider.

• 정보보호학회논문지
• /
• 제22권5호
• /
• pp.1191-1204
• /
• 2012

정보보안시스템을 무력화하는 공격이 나타남에 따라, 정보보안제품의 취약성을 분석하는 보안 테스팅에 대한 관심이 높아지고 있다. 보안제품 개발의 주요 단계인 침투 테스팅은, 공격자가 악용할 수 있는 취약성을 찾기 위해 컴퓨터 시스템을 실제적으로 테스팅하는 것이다. 침투 테스팅과 같은 보안 테스팅은 대상 시스템에 대한 정보 수집, 가능한 진입점 식별, 침입 시도, 결과 보고 등의 과정을 포함한다. 따라서 취약성 분석 및 보안 테스팅에서 일반성, 재사용성, 효율성을 극대화하는 것이 매우 중요하다. 본 논문에서는, 정보보호제품이 자신의 보안 기능을 무력화하거나 우회하는 공격에 대응할 수 있는 자체보호기능 및 우회불가성을 제공하는 가를 평가할 수 있는 위협분석 기반의 소프트웨어 보안 테스팅을 제안한다. 위협분석으로 취약성을 식별한 후, 보안 테스팅의 재사용성과 효율성을 개선하기 위해 소프트웨어 모듈과 보안 기능에 따라 테스팅 전략을 수립한다. 제안기법은 위협 분석 및 테스팅 분류, 적절한 보안테스팅 전략 선정, 보안 테스팅으로 구성된다. 사례연구와 보안테스팅을 통해 제안 기법이 보안 시스템을 체계적으로 평가할 수 있음을 보였다.

• International journal of advanced smart convergence
• /
• 제5권3호
• /
• pp.27-31
• /
• 2016

High-tech industries in a state well enough to troubleshoot hacking information introduction a big barrier to delay the growth of the market related to IoT(Internet of Things) as is likely to be on the rise. This early on, security issues introduced in the solution, a comprehensive solution, including the institutional laws/precautions needed. Recent examples of frequent security threats while IoT is the biggest issue of introducing state-of-the-art industry information due to the vulnerable security hacking. This high-tech industries in order to bridge the information responsible for the target attribute, target range, and the protection of security and how to protect the subject, IoT environment (domestic industrial environment) considering the approach is needed. IoTs with health care and a wide variety of services, such as wearable devices emerge. This ensures that RFID/USN-based P2P/P2M/M2M connection is the implementation of the community. In this study, the issue on the high-tech industrial information and the vulnerable security issues of IoT are described.