• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.12 no.5
• /
• pp.237-242
• /
• 2012

Cyber attacks have rapidly increased by exploiting the underlying vulnerabilities in the target software. However, identifying and correcting these vulnerabilities are extremely difficult and time consuming tasks. To address these problems efficiently, we propose a systematic methodology for security vulnerability assessment process on binary code in the paper. Specifically, we first classified the existing vulnerabilities based on whether the target software run in a Web environment and features of the software. Based on the classification, we determined the list and scope of the vulnerabilities. As our future research direction, we need to further refine and validate our methodology.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2004.05b
• /
• pp.724-727
• /
• 2004

With the development of modem communication and networking technology, more and more computing and communication facilities, automation equipments, hone information appliances and different type of networking terminals come into home all over the world. The user can control information appliances in home environments. The home environment can communicate with the external network via phone line, wired LAN, wireless LAN, or mixed. However, home information appliances that are connected to the external network are under attack and need to be secured. So specifying suitable security requirements and policies for digital home environment is critical in hone networking environments. This paper analyzes the possible vulnerability to home network, and specifies the security requirements derived from the vulnerability analysis for digital home environment

• Journal of Internet Computing and Services
• /
• v.9 no.4
• /
• pp.79-84
• /
• 2008

In these days, many organizations try to manage their assets in safe way due to fast change in information-communication environment. In Korea, risk analysis and vulnerability analysis for security improvement of critical asset is booming by enforcement of Act on security of information and communication infrastructure. It is obligate that each critical information infrastructure needs to get vulnerability analysis. In this paper, we proposed Object Oriented Asset Classification model for asset analysis and risk analysis.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.179-186
• /
• 2018

The number of devices connect to the internet is rapidly increasing with the advent of the IoT(Internet of Things). The IoT has improved the convenience of life. However, it makes security issues such as privacy violations. Therefore cybersecurity is the most important issue to be discussed nowadays. Especially, various protocols are used for same purpose due to rapidly increase of IoT market. To deal with this security threat noble vulnerability analysis is needed. In this paper, we contribute to the IoT security by proposing a new randomness-based test case evaluation methodology using variance and entropy. The test case evaluation method proposed in this paper can evaluate the test cases at a high speed regardless of the test set size, unlike the traditional technique.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.243-253
• /
• 2022

Recently, cyber attacks on national infrastructure facilities have continued to occur. As a result, the vulnerabilities of ICS-CERTs have more than doubled from last year, and the vulnerabilities to industrial control systems such as nuclear facilities are increasing day by day. Most control system operators formulate vulnerability countermeasures based on the vulnerability information sources of industrial control systems provided by ICS-CERT in the United States. However, it is difficult to apply this to the security of domestic control systems because ICS-CERT does not contain all relevant vulnerability information and does not provide vulnerabilities to domestic manufacturer's products. In this research, we will utilize publicly available vulnerability-related information such as CVE, CWE, ICS-CERT, and CPE to discover vulnerabilities that may exist in control system assets and may occur in the future. I proposed a plan that can predict possible vulnerabilities and applied it to information on major domestic control systems.

• Journal of the Society of Naval Architects of Korea
• /
• v.50 no.6
• /
• pp.383-389
• /
• 2013

Analysis and review of survivability is one of the most important aspects when naval vessels are designed. Because aiming points of threat towards the naval vessels in the battle field could not be estimated exactly, probabilistic and statistic approach is frequently introduced to evaluate and enhance the vessel survivability. Some commercial survivability analysis programs are used to perform the analysis for enhancement of susceptibility, vulnerability and recoverability but, they are usually classified and impossible to be exported to other countries because of their national security. In this paper, a simplified vulnerability analysis program is developed to evaluate the vulnerability of the warship in aspects of structure, redundancy and its mission capability at the conceptual design stage. To verify the developed program, the analysis results were compared with those of the commercial program MOTISS(Measure of Total Integrated System Survivability).

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.3
• /
• pp.579-590
• /
• 2018

In May 2014, AppCard(Which is a smartphone application designed to register and use a credit card in a mobile phone by credit card company.) was attacked by smshing and a vulnerability which could not obtainable phone number. After that, credit card companies have supplemented and operated by introducing additional authentication methods to supplement the vulnerability. However, The analysis of the authentication environments, purposes and methods is not enough to lower the level of vulnerability and risk from existing accidents. This study analyzes the authentication process of the AppCard in the electronic financial service by applying the NIST's authentication guidelines, identifies the problems and suggests improvement directions. The method analyzed in this study can be applied to the analysis of the authentication method in addition to the application card, so that it will be highly utilized.

• Proceedings of the IEEK Conference
• /
• 1998.10a
• /
• pp.83-86
• /
• 1998

In recent years, security has been more and more significant in network environment. The internetworkding communication including ATM network will be exposed to all kinds of attacks, such as eavesdropping, spoofing, service denial and traffic analysis etc. So, in this paper, we focused on ATM network threats, security service and ATM security mechanisms for threats.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.15 no.11
• /
• pp.2399-2403
• /
• 2011

Radio Frequency Identification(RFID) has been considered as an key infrastructure for the ubiquitous society. However, due to the inherent drawbacks, RFID causes var- ious security threats like privacy problems, tag cloning, etc. This paper analyses the security risk analysis process from the perspective of the RFID tag life cycle, identify the tag usage process, identify the associated vulnerability and threat to the confidentiality, integrity and availability of the information assets and its implications for privacy, and the mitigate the risks.

• Journal of Korea Multimedia Society
• /
• v.24 no.3
• /
• pp.440-447
• /
• 2021

Smartphones are currently being produced with similar functions, shapes, and software. The foldable smartphone is a product that dramatically changed the shape of the existing smartphone. Therefore, it affects the functions and software. In this paper, we analyze the potential security vulnerability of current mobile authentication methods by dividing them into two parts, security vulnerabilities of non-foldable smartphones, and security vulnerability that appears with the changed smartphone structure. According to the analysis result, the classic and current mobile user authentication methods appears to be easily affected by the smartphone display structure. Finally, we propose an appropriate authentication method as well as the concept of security measures for smartphones with foldable screen. Our method shows that it is more secure than the conventional authentication methods in foldable display smartphone.