• Journal of Korea Society of Digital Industry and Information Management
• /
• v.7 no.4
• /
• pp.57-66
• /
• 2011

We implemented the document DRM applying role based access control(RBAC) mechanism for preventing the information leakage of a document which is transmitted in network environment. It must prevent to access document not related to user role and duty, and must allow operation to document for improving security, considering user role and security level according to a document importance. We improved the security of document DRM by adding to the access control module applying RBAC for satisfying security requirements. Though the user access document, our system allows operation authorizations to document by the user's role & security level and the security attribute of RBAC. Our system prevents indiscriminate access to the documents by user who is not associated with the role, and prevents damage the confidentiality and integrity.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.61-69
• /
• 2022

When a large-scale cyber attack or terrorism occurs and the country suffers enormous damage or poses a fatal threat to security, social interest in nurturing cybersecurity workforce increases. In addition, the government often suggests policies and guideline to train cybersecurity workforce. However, the system that can systematically manage trained cyber workforce after they are employed in related organizations or companies is still weak. Software workforce has a standardized qualification level model, so appropriate jobs are set and managed for each level. Cyber workforce also need a specialized qualification level model that takes into account their career, academic background, and education&training performance. By assigning a qualification level, the duties that can be performed for each level should be set, and the position and duty of the department should also be assigned in consideration of the level. Therefore, in this paper, we propose a qualification level model for cyber security workforce.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.5 no.4
• /
• pp.87-97
• /
• 2009

Internet network routing system is used to prevent spread and distribution of malicious data traffic. This study is based on analysis of diagnostic weakness structure in the network security domain. We propose an improved integrated multi-level protection domain for in the internal route of groupware. This paper's protection domain is designed to handle the malicious data traffic in the groupware and finally leads to lighten the load of data traffic and improve network security in the groupware. Infrastructure of protection domain is transformed into five-stage blocking domain from two or three-stage blocking. Filtering and protections are executed for the entire server at the gateway level and internet traffic route ensures differentiated protection by dividing into five-stage. Five-stage multi-level network security domain's malicious data traffic protection performance is better than former one. In this paper, we use a trust evaluation metric for measuring the security domain's performance and suggested algorithm.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.4
• /
• pp.763-777
• /
• 2021

Information security started as an IT operation process and is now recognized as an important issue of information technology, and each international organization is newly defining the concept. Information security itself is a new combination of IT technologies, a set of technologies and a technology area. As IT outsourcing becomes common in many public sectors, SLAs are introduced to evaluate the level of IT services. In the area of information security, many studies have been conducted on the derivation and selection of SLA performance indicators, but it is difficult to find a way to apply the performance indicators to service level evaluation and performance systems. This thesis conducted a study on the application of a service evaluation system for information security performance indicators based on the public sector and a performance system including compensation regulations. It presents standards and rewards(incentive and penalty) that define expectation and targets of performance indicators that take into account the environment and characteristics of a specific public sector, and defines appropriate SLA costs. It proposes a change plan for the organizational structure for practical SLA application and service level improvement.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.1
• /
• pp.227-235
• /
• 2016

As various measures of law observance obligations such as mandatory obligation of privacy impact assessment (PIA) for public institutions and authorization of information security management system (ISMS) are put into practice, increase in demand for information security consulting and securement of information security consultants are emerging as a major issue. The purpose of this study is to empirically investigate what core competencies information security consultants should possess and how much they actually possess them. By analyzing the differences in perception between practitioners and managers on core competencies, this study understands difference of views between the two groups and suggests ideas for cultivation of information security consultants.

• Asia pacific journal of information systems
• /
• v.9 no.3
• /
• pp.143-157
• /
• 1999

EDI is one of the most important information technologies in todays business environment. This study is an exploratory study on the EDI control of Korean companies in their early stage of EDI implementation. The purpose of this study is to examine the impact of EDI controls on the security and usefulness of EDI systems for Korean companies who have adopted EDI. The data of fifty-one Korean companies for financial, manufacturing, and trade industries are collected by the mail survey and interview methods. The level of EDI control is mediocre on the average. The level of EDI security is low while that of EDI usefulness is mediocre. The empirical results show that the EDI controls in general improve the EDI security and usefulness significantly. Especially, the application and security control affect the EDI security significantly while the management, application, and security controls affect the EDI usefulness significantly. The gap between the level and perceived importance of control does not affect the EDI security but decreses the EDI usefulness at the marginal level of significance. The limitation of this study is that only a small number of companies are available for data collection because Korea is in the early stage of EDI implementation.

• Journal of National Security and Military Science
• /
• s.5
• /
• pp.131-172
• /
• 2007

Government duties in the cases of crisis are aimed at supporting efficient military operations in the fields of non-military affairs and resource mobilization, maintenance of government functions, and search for the public security of living during the war. In crisis, the government must change its functions into the total-war system with all resources available for the efficient performance of military operations, war economy, public safety and security as well as government continuance. The main contents of "Chung-Mu Plan" include the alternative measures to control the circulation of life necessities, emergency electricity, water and gas; recover public facilities from the disaster; and accommodate the wounded and refugees. Governments have practiced Ul-chi and ChungMoo exercises to improve government's management capabilities and master standard operating procedures including systematic distribution plans in the national and local level. However, such plans have not yet sufficient enough for the maintenance of public security of living. In addition to the conceptual ambiguity, major problems are the inappropriate system of the war economy, legal institutions, and administrative SOPs for the efficient maintenance of it. Thus, for the betterment of national crisis management system, the government should have the manual stated from every step and level dealing with crisis to the legal institutions. It is important to empower the National Emergency Planning Commission for the policy consistency and efficient/effective implementation. The comprehensive plans must have an integrated cooperative system of the central/local governments, military and civil society with actual practices and exercises for the maintenance of the public security of living.

• Proceedings of the KIEE Conference
• /
• 2001.05a
• /
• pp.245-247
• /
• 2001

This paper presents a series of simulation results of transient stability on SCOPF operated power system whose transmission capabilities are limited by voltage stability. Three steps of voltage security guidelines, 5[%], 7[%], 10[%] are introduced to increase power transfer from generation centers to load center and observed the effects of voltage guidelines to transient stability for three kinds of load level(peak, medium, off-peak). As a result, dynamic characteristics weren't affected by the voltage security limits in model system, but became worse for the off-peak level than peak case, and sustain oscillations are observed for the all load level. This gives us some intitutions for the development and applications of security limits to use SCOPF program in open electric market.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1179-1189
• /
• 2019

Cyber security evaluation is a series of processes that estimate the level of risk of assets and systems through asset analysis, threat analysis and vulnerability analysis and apply appropriate security measures. In order to prepare for increasing cyber attacks, systematic cyber security evaluation is required. Various indicators for measuring cyber security level such as CWSS and CVSS have been developed, but the quantitative method to apply appropriate security measures according to the risk priority through the standardized security evaluation result is insufficient. It is needed that an Scoring system taking into consideration the characteristics of the target assets, the applied environment, and the impact on the assets. In this paper, we propose a quantitative risk assessment model based on the analysis of existing cyber security scoring system and a method for quantification of assessment factors to apply to the established model. The level of qualitative attribute elements required for cyber security evaluation is expressed as a value through security requirement weight by AHP, threat influence, and vulnerability element applying probability. It is expected that the standardized cyber security evaluation system will be established by supplementing the limitations of the quantitative method of applying the statistical data through the proposed method.

• The Journal of the Korea Contents Association
• /
• v.5 no.2
• /
• pp.107-114
• /
• 2005

This paper proposes to analyze a security level about information property systems. This method uses objective and quantitative risk level assessment. The method analyzes administrative, physical and technical aspects of information property system commonly. This method also uses administrative, physical and technical weights. Individually according to requirements security assessment purpose. And it shows risks weighting mean and importance of information property by graph. The most right and up systems in maps is prior to other systems. Also, Quantitative analysis presents more objective and efficient results for security level assessment of information system.