• Journal of Korea Society of Digital Industry and Information Management
• /
• v.8 no.1
• /
• pp.89-98
• /
• 2012

According to the enforcement of Personal Information Protection Act as of September 2011, the laws and regulations for the protection of personal information that were applied only to the certain sectors such as information & communication network, financial institutions, public sector etc. for the time being has been expanded to apply to all public and private sectors to process personal information. In particular, because the public institutions are obliged to be mandatorily conducted of the Privacy Impact Assessment, it will be enforced in earnest for each agency's informationization business that handles personal information. In this paper, I examine the most derived vulnerability and set up the improvement measure to supplement it with the examples of 10 of all the institutions conducting the Privacy Impact Assessment in the year 2011. And, I suggest the measures to be prepared by the institutions to observe the Personal Information Protection Act.

• Journal of Internet Computing and Services
• /
• v.18 no.5
• /
• pp.113-121
• /
• 2017

Company A's core competency is IT internet security services. The Web diagnosis team analyzes the vulnerability of customer's internet web servers and provides remedy reports. Traditionally, Company A management has utilized a simple table format report for resource planning. But these reports do not notify the timing of human resource commitment. So, upper management asked its team leader to organize a task team and design a visual dashboard for decision making with the help of outside professional. The Task team selected the web security diagnosis practice process as a pilot and designed a dashboard for performance evaluation. A structural design process was implemented during the heuristic working process. Some KPI (key performance indicators) for checking the productivity of internet web security vulnerability reporting are recommended with the calculation logics. This paper will contribute for security service management to plan and address KPI design policy, target process selection, and KPI calculation logics with actual sample data.

• The KIPS Transactions:PartC
• /
• v.10C no.1
• /
• pp.1-10
• /
• 2003

In this paper, we propose a secure communication framework for interaction and information sharing between a server and agents in DS-NVSA(Detection System of Network Vulnerability Scan Attacks) proposed in〔1〕. For the scalability and interoperability with other detection systems, we design the proposed IDMEF and IAP that have been drafted by IDWG. We adapt IDMEF and IAP to the proposed framework and provide SKTLS(Symmetric Key based Transport Layer Security Protocol) for the network environment that cannot afford to support public-key infrastructure. Our framework provides the reusability of heterogeneous intrusion detection systems and enables the scope of intrusion detection to be extended. Also it can be used as a framework for ESM(Enterprise Security Management) system.

• The KIPS Transactions:PartC
• /
• v.15C no.2
• /
• pp.125-132
• /
• 2008

As the development of Internet technology, the number of IDs managed by each individuals has been increased. And many software development institutes have developed ID/PW management solutions to facilitate secure and convenient management of ID/PW. However, these solutions also can be vulnerable in case of administrator's password exposure. Thus, we need to derive security requirements from the vulnerability analysis of these solutions, also we need evaluation criteria for secure ID/PW management solution development. In this paper, we analyze the vulnerability of ID/PW management solution and propose the evaluation criteria for secure ID/PW management solution.

• Journal of the Korea Society of Computer and Information
• /
• v.27 no.12
• /
• pp.179-188
• /
• 2022

In this paper, we propose an efficient and procedural software patch management phases. Every year, organizations have tens of thousands of known vulnerabilities and spend tens of thousands of hours and millions of dollars or more patching them. Despite these efforts, research has shown that the time it takes for an exploit to appear for a given patched vulnerability is shortening. As various types of organizations such as companies and universities manage patches in inconsistent ways, problems such as security problems, system instability, information leakage and work delay due to patches occur. In this paper, we look at the basics required for software patch management and define the factors to be considered for patch management and the effective steps for patch management. Therefore, this study will be used as a method to efficiently and procedurally execute the organization's patch management policy in the process of updating and patching the software in the organization to a new version as a solution to software function modification and security vulnerability.

• Proceedings of the Korean Geotechical Society Conference
• /
• 2009.03a
• /
• pp.930-939
• /
• 2009

Most of steep slope failures occurring in Korea have appeared during the localized heavy rain period, whereas the evaluation model of a disaster vulnerability analysis that has been proposed to date, has been prepared in consideration only of external factors comprising geographical features. This study calculated a wetness index and a contributory area which delivers moisture to the upper slant surface during the rainfall period, and also conducted a disaster vulnerability analysis in consideration of the convergence of surface water as well as the water system created during the occurrence of rainfall by including a curvature that shows a close relevance with the shape of the minute water system that is created temporarily during the occurrence of rainfall and with the convergence and divergence of surface water. When compared with a steep slope failure occurring within a selected model district in order to verify the prepared disaster analysis, a landslide occurring in the model district had emerged in a region in which the disaster vulnerability analysis was high and the density of the minor water system was also high. If these research results are extended nationwide, it is the most effective to use a disaster vulnerability analysis and the density of the minute water system; and it is supposed to be the simplest and the most effective method for preparing a disaster analysis of mountainous land shape such as the model district.

• Asia pacific journal of information systems
• /
• v.8 no.2
• /
• pp.37-51
• /
• 1998

This study attempts to draw a blueprint of risk analysis for Information Systems (IS). We introduce two main variables for measuring IS risk - business-impact intensity and IS-vulnerability index - through the investigation of information characteristics, business processes and human-related factors. IS-vulnerability index consists of two factors such as degree of openness and degree of preparedness to the threats. Based on these factors, we built two integrative frameworks for risk analysis and management: One is a conceptual framework to enhance the understandability of IS risk itself; the other is an integrative framework to improve the managerial insight of overall IS risk. We then conducted a field study to empirically validate the proposed framework using a structural equations modeling method. We found that IS maturity and business-impact intensity were positively correlated to degree of openness to the threats, while IS maturity was negatively correlated to degree of preparedness to the threats.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.1
• /
• pp.59-74
• /
• 2020

The web space where web applications run is the cyber information warfare of attackers and defenders due to the open HTML. In the cyber attack space, about 84% of worldwide attacks exploit vulnerabilities in web applications and software. It is very difficult to detect web vulnerability attacks with security products such as web firewalls, and high labor costs are required for security verification and assurance of web applications. Therefore, rapid vulnerability detection and response in web space by automated software is a key and effective cyber attack defense strategy. In this paper, we establish a security risk management model by intensively analyzing security threats against web applications and software, and propose a method to effectively diagnose web and application vulnerabilities. The testing results on the commercial service are analyzed to prove that our approach is more effective than the other existing methods.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.4
• /
• pp.117-125
• /
• 2018

Recently, VoIP technology is widely used in our daily life. Even VoIP has become a technology that can be easily accessed from services such as home phone as well as KakaoTalk.[1] Most of these Internet telephones use the RTP protocol. However, there is a vulnerability that the audio data of users can be intercepted through packet sniffing in the RTP protocol. So we want to create a tool to check the security level of a VoIP network using the RTP protocol. To do so, we capture data packet from and to these VoIP networks. For this purpose, we first configure a virtual VoIP network using Raspberry Pi and show the security vulnerability by applying our developed sniffing tool to the VoIP network. We will then analyze the captured packets and extract meaningful information from the analyzed data using the Google Speech API. Finally, we will address the causes of these vulnerabilities and possible solutions to address them.

• Journal of Internet Computing and Services
• /
• v.14 no.3
• /
• pp.23-33
• /
• 2013

Recently in the field of IT, cloud computing technology has been deployed rapidly in the current society because of its flexibility, efficiency and cost savings features. However, cloud computing system has a big problem of vulnerability in security. In order to solve the vulnerability of cloud computing systems security in this study, impact types of virtual machine about the vulnerability were determined and the priorities were determined according to the risk evaluation of virtual machine's vulnerability. For analyzing the vulnerability, risk measurement standards about the vulnerability were defined based on CVSS2.0, which is an open frame work; and the risk measurement was systematized by scoring for relevant vulnerabilities. Vulnerability risk standards are considered to suggest fundamental characteristics of vulnerability and to provide the degree of risks and consequently to be applicable to technical guides to minimize the vulnerability. Additionally, suggested risk standard of vulnerability is meaningful as the study content itself and could be used in technology policy project which is to be conducted in the future.