• The Journal of Society for e-Business Studies
• /
• v.19 no.4
• /
• pp.31-43
• /
• 2014

These days a lot of cyber attacks are exploiting the vulnerabilities of S/W. According to the trend of vulnerabilities is announced periodically, security directions are suggested and security controls are updated with this trend. Nevertheless, cyber attacks like hacking during the year 2011 are increased by 81% compared to 2010. About 75% of these cyber attacks are exploiting the vulnerabilities of S/W itself. In this paper, we have suggested a VIR model, which is a spread model of malware infection for measuring economic loss by S/W vulnerability, by applying the SIR model which is a epidemic model. It is applied to estimate economic loss by HWP(Hangul word) S/W vulnerabilities.

• Korean Journal of Remote Sensing
• /
• v.37 no.3
• /
• pp.649-655
• /
• 2021

This study purposes to cross-validate its performance by applying the optimal seismic vulnerability assessment model based on previous studies conducted in Gyeongju to other regions. The test area was Pohang City, the occurrence site for the 2017 Pohang Earthquake, and the dataset was built the same influencing factors and earthquake-damaged buildings as in the previous studies. The validation dataset was built via random sampling, and the prediction accuracy was derived by applying it to a model based on a random forest (RF) of Gyeongju. The accuracy of the model success and prediction in Gyeongju was 100% and 94.9%, respectively, and as a result of confirming the prediction accuracy by applying the Pohang validation dataset, it appeared as 70.4%.

• Journal of Information Technology Applications and Management
• /
• v.26 no.4
• /
• pp.31-39
• /
• 2019

The 129 public institutions in Korea are subject to Information Security Management Condition Evaluation (ISMCE) as a part of the government management evaluation system by the Ministry of Economy and Finance. ISMCE is started in 2006 with the central government institutions, and applied to the all public institutions in 2009. This evaluation is annually conducted by the National Intelligence Service through the site visits, and the number of the evaluated institutions is increasing year by year. However, the process of ISMCE - identifying existing vulnerabilities in the information system - is conducted manually. To improve this inconvenience, this paper introduces the various evaluation system in the major countries, especially in the United States, and analyzes the Security Content Automation Protocol (SCAP) by NIST. SCAP is automation protocol for the system vulnerability management (in technical fields) and security policy compliance evaluation. Based on SCAP, this paper suggests an improvement plan for the ISMCE of Korea.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1605-1618
• /
• 2016

In recent years, security incidents - such as personal information leakage, homepage hacking, DDoS and etc. - targeting finance companies(banks, securities companies, credit card companies, insurance companies and etc.) have increased steadily. In this paper, we analyze problems of information security management level in the existing electronic financial infrastructure from perspective of compliance and information security certification system and propose improvements to enable sustainable high level of information security activities under a comprehensive management system for the financial sector characteristics using ISMS, SECU-STAR and CNIVAM system.

• 제어로봇시스템학회:학술대회논문집
• /
• 2005.06a
• /
• pp.1586-1589
• /
• 2005

GUMF (Global User Management Framework) that is proposed in this research can be applied to next generation network such as BcN (Broadband convergence Network), it is QoS guaranteed security framework for user that can solve present Internet's security vulnerability. GUMF offers anonymity for user of service and use the user's real-name or ID for management of service and it is technology that can realize secure QoS. GUMF needs management framework, UMS (User Management System), VNC (Virtual Network Controller) etc. UMS consists of root UMS in country dimension and Local UMS in each site dimension. VNC is network security equipment including VPN, QoS and security functions etc., and it achieves the QoSS (Quality of Security Service) and CLS(Communication Level Switching) functions. GUMF can offer safety in bandwidth consumption attacks such as worm propagation and DoS/DDoS, IP spoofing attack, and current most attack such as abusing of private information because it can offer the different QoS guaranteed network according to user's grades. User's grades are divided by 4 levels from Level 0 to Level 3, and user's security service level is decided according to level of the private information. Level 3 users that offer bio-information can receive secure network service that privacy is guaranteed. Therefore, GUMF that is proposed in this research can offer profit model to ISP and NSP, and can be utilized by strategy for secure u-Korea realization.

• Information Systems Review
• /
• v.17 no.3
• /
• pp.39-64
• /
• 2015

As information and information technology become more important in competitive corporate environments, the risk of information security breaches has increased accordingly. Although organizations establish security measures to manage information security risks, members of organizations do not comply with them well, and their information security behavior intention is unclear. Therefore, to understand the information security risk management intention of the members of organizations, the present study developed a research model using Protection Motivation Theory, Supervisory Authority Pressure, and Background factors. This study presents empirical research findings based on the analysis of survey data from 201 members of financial institutions. Perceived Severity, Self-efficacy, and Supervisory Authority Pressure had a positive effect on intention; however, Perceived Vulnerability and Response Efficacy did not affect intention. Security Avoidance Habit, which was considered a background factor, had a negative effect on all parameters, and did not have an effect on intention. Security Awareness Training, another background factor, had a positive effect on information security risk management intention and perceived vulnerability, self-efficacy, response efficacy, and supervisory authority pressure, and had no effect on perceived severity. This study used supervisory authority pressure and background factors in the field of information security, and provided a basis to use supervisory authority pressure in future studies on behavior of organizations and members of an organization. In addition, the use of various background factors presented the groundwork for the expansion of protection motivation theory. Furthermore, practitioners can use the study findings as a foundation for organization's security activities, and to improve regulations.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.17 no.4
• /
• pp.77-83
• /
• 2021

As Open Source Software(OSS) recently invigorates, many companies actively use the OSSes in their business software. With such OSS invigoration, our web application is developed in order to provide the safety in using the OSSes, and update the information on the new vulnerabilities and the patches at all times by crawling the web pages of the relevant OSS home pages and the managing organizations of the vulnerabilities. By providing the updated information, our application helps the OSS users and developers to be aware of such security issues, and gives them to work in the safer environment from security risks. In addition, our application can be used as a security platform to greatly contribute to preventing potential security incidents not only for companies but also for individual developers.

• Korean Journal of Remote Sensing
• /
• v.28 no.1
• /
• pp.159-169
• /
• 2012

The purpose of this study was to assess the vulnerability of forest ecosystem to climate change in South Korea using socio-environmental indicators and the results of two vegetation models named as Hydrological and Thermal Analogy Group(HyTAG), and MAPSS-Century 1(MC1). The changing frequency and direction of biome types estimated by HyTAG model was used for quantifying sensitivity and adaptive capacity of forest distribution. Similarly, the variation and changing tendency of net primary production and soil carbon storage estimated by MC1 model was used for quantifying sensitivity and adaptive capacity of forest function. As socio-environmental indicators, many statistical data such as financial autonomy rate and the number of forestry officer was prepared. All indicators were standardized, and then calculated using the vulnerability assessment equation. The period of vulnerability assessment was divided into the past(1971-2000) and the future(2021-2050). To understand what policy has a priority to climate change, distribution maps of each indicators was depicted and the vulnerability results were compared among administrative districts. Evident differences could be found in entire study area. These differences were mostly derived from regionalspecific adaptive capacity. The result and methodology of this study would be helpful for the development of decision-making supporting system and policy making in forest management with respect to climate change.

• Convergence Security Journal
• /
• v.17 no.1
• /
• pp.39-44
• /
• 2017

The existing enterprise information security activities were centered on the information security organization, and the top management considers information security and enterprise management to be separate. However, various kinds of security incidents are constantly occurring. In order to cope with such incidents, it is necessary to protect information in terms of business management, not just information security organization. In this study, we examine the existing corporate governance and IT governance, and present an information security governance model that can reflect the business goals of the enterprise and the goals of the management. The information security governance model proposed in this paper induces the participation of top management from the planning stage and establishes information security goals. We can strengthen information security activities by establishing an information security plan, establishing and operating an information security system, and reporting the results to top management through compliance audit, vulnerability analysis and risk management.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.9 no.3
• /
• pp.91-98
• /
• 2013

Node which plays the role of cache server does not exist in the wireless ad-hoc network consisting of only mobile nodes. Even if it exists, it is difficult to provide cache services due to the movement of nodes. Therefore, the cooperative cache technique is necessary in order to improve the efficiency of information access by reducing data access time and use of bandwidth in the wireless ad-hoc network. In this paper, the whole network is divided into zones which don't overlap and master node of each zone is elected. General node of each zone has ZICT and manages cache data to cooperative cache and gateway node use NZCT to manage cache information of neighbor zone. We proposed security structure which can accomplish send and receive in the only node issued id key in the elected master node in order to prepare for cache consistent attack which is vulnerability of distributed caching techniques. The performance of the proposed method in this paper could confirm the excellent performance through comparative experiments of GCC and GC techniques.