• Journal of Digital Convergence
• /
• v.13 no.8
• /
• pp.43-49
• /
• 2015

As the cloud computing law was passed in March, 2015, many private companies and public organizations give consideration to introduce cloud computing services. However, most of them are still concerned about the security issues in cloud computing services. To solve the problem, a certification system of cloud security is necessary as an enabler for adoption of the trusted cloud services. There have been a number of studies about certification systems for cloud security, but only few studies exist about certification scheme of cloud security. Therefore, in this study, foreign certification systems for cloud security are analyzed to draw requirements for developing a domestic certification scheme for cloud security. Based on the result of analysis, this study proposes the three certification schemes of cloud security, which have been reviewed by the focus group interview method to draw advantages and disadvantages of each scheme.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1231-1238
• /
• 2013

In the background of rapidly increasing domestic cloud service demand, worries about security and privacy incidents can hinder the promotion of cloud service industry. Thus, it is crucial that the independent 3rd party assures the reliability for using the cloud service. This paper compares several external and internal cloud service certification cases, for example CSA certification, FedRAMP certification, KCSA certification, and concludes that insufficient security and privacy controls are prevailing. As a consequence, several enhanced countermeasures by using ISO/IEC 27017, KISA's ISMS considering manageability and expertise are proposed in the cloud service certification system.

• Convergence Security Journal
• /
• v.15 no.5
• /
• pp.9-15
• /
• 2015

Cloud computing has emerged with promise to decrease the cost of server additional cost and expanding the data storage and ease for computer resource sharing and apply the new technologies. However, Cloud computing also raises many new security concerns due to the new structure of the cloud service models. Therefore, several cloud service certification system were performed in the world in order to meet customers need which is the safe and reliable cloud service. This paper we propose the new risk analysis method different compare with existing method for secure the reliability of certification considering public IaaS(Infrastructure as a Service) cloud service properties.

• Journal of Digital Convergence
• /
• v.11 no.11
• /
• pp.53-58
• /
• 2013

Due to the wide spread of the perception of cloud computing, the usage of cloud computing is increasing globally. Cloud computing is able to converge the various industrial domains based on ICT and it is more and more popular because it has a lot of benefits such as cost savings etc. in global economic recession. However, if cloud computing service is to achieve its potential, it is necessary to clearly understand the critical issues such as service security, performance and availability and so on from the perspectives of the providers and the consumers of the cloud service. In addition, customers focus on how to get and use the safe and reliable cloud service. In order to meet these problems, Korea cloud service certification system and Japanese ASP-SaaS-Cloud certification system were performed in each country. This paper aims at comparing and analyzing between them and describing the difference. Eventually, we propose the improvement strategy of Korea cloud service certification system based on the comparison results between them.

• Journal of the Semiconductor & Display Technology
• /
• v.20 no.4
• /
• pp.83-88
• /
• 2021

Cloud services have become the core infrastructure of the digital economy as a basis for collecting, storing, and processing large amounts of data to trigger artificial intelligence-based services and industrial innovation. Recently, cloud services have been spotlighted as a means of responding to corporate crises and changes in the work environment in a national disaster caused by COVID-19. While the cloud is attracting attention, the speed of adoption and diffusion of cloud services is not being actively carried out due to the lack of trust among users and uncertainty about security, performance, and cost. This study compares and analyzes the "Cloud Service Quality and Performance Management System" and the "Cloud Service Certification System" and suggests complementary points and improvement measures for the cloud service quality and performance management system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.2
• /
• pp.251-265
• /
• 2013

Cloud computing provided as a service type by sharing IT resources cannot be activated unless the issue of information security is solved. The enterprise attempts to maximize the efficiency of information and communication resources by introducing cloud computing services. In comparison to the United States and Japan, however, cloud computing service in korea has not been activated because of a lack of confidence in the security. This paper suggests core evaluation criteria and added evaluation criteria which is removed the redundancy of the security controls from existing ISMS for Korean cloud computing through a comparative analysis between domestic and foreign security controls of cloud certification scheme and guidelines and information security management system. A cloud service provider certified ISMS can minimize redundant and unnecessary certification assessment work by considering added evaluation criteria.

• Journal of Digital Convergence
• /
• v.10 no.11
• /
• pp.59-65
• /
• 2012

The evolution of cloud computing service over the recent years is potentially one of the major advances in information and communication technology. However, if cloud computing service is to achieve its potential, there needs to be a clear understanding of the various issues such as service security, performance and availability and so on, both from the perspectives of the providers and the consumers of the cloud service. As more and more information on individuals, companies and public sectors are placed in the cloud service, concerns are beginning to grow about just how safe and reliable an environment it is. In order to overcome these situations, the Korea cloud service certification system and U.S. FedRAMP were performed in each country. This paper aims at comparing and analyzing between Korean cloud service certification systems and U.S. FedRAMP and describing the difference between them. Eventually, we propose the improvement strategy of Korea cloud service certification systems based on the comparison results between them.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1267-1276
• /
• 2013

Cloud consumers who use cloud computing services are obliged to review and monitor the legal compliance of cloud providers who are consigned the processes of the PII (personally identifiable information) from them. This paper presented possible scenarios for cloud PII outsourcing and suggested PIMS (personal information management system) controls for outsourcing management between cloud consumers and cloud providers by analyzing both international standards and domestic certification schemes related to cloud computing and/or privacy management based on the legal obligations for PII outsourcing from Korean "Personal Information Protection Act (PIPA)". The controls suggested can be applicable for developing the guidance of complying with privacy laws in organizations or the checklist of PII outsourcing management in PIMS certification.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.23 no.3
• /
• pp.19-26
• /
• 2023

Critical information infrastructure designations for cloud service providers continue to spread around the world as energy, financial services, health, telecommunications, and transportation sectors move to the cloud. In addition, in the case of Ukraine, the removal of restrictions on the use of cloud for national critical facilities and the rapid transition of critical data to the cloud enabled the country to effectively respond to cyberattacks targeting Russian infrastructure. In Korea, the ISMS-P is operated to implement a systematic and comprehensive information protection management system and to improve the level of information protection and personal information protection management in organizations. Control items considering the cloud environment have been modified and added to the audit of companies. However, due to the different technical levels of clouds between domestic and global, it is not easy to obtain information on the findings of cloud providers such as Microsoft for the training of domestic certification auditors on hyperscale scale. Therefore, this paper analyzes findings in hyperscale clouds and suggests ways to improve cloud-specific control items by considering the compatibility of hyperscale environments with ISO/IEC 27001 and SOC(System and Organization Control) security international standards.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.4
• /
• pp.913-921
• /
• 2012

On the strength of the rapid development and propagation of U-healthcare service, the service technologies are full of important changes. However, U-healthcare service has security problem that patient's biometric information can be easily exposed to the third party without service users' consent. This paper proposes a distributed model according authority and access level of hospital officials in order to safely access patients' private information in u-Healthcare Environment. Proposed model can both limit the access to patients' biometric information and keep safe system from DoS attack using time stamp. Also, it can prevent patients' data spill and privacy intrusion because the main server simultaneously controls hospital officials and the access by the access range of officials from each hospital.