• 디지털산업정보학회논문지
• /
• 제6권4호
• /
• pp.307-317
• /
• 2010

The majority of financial and general business organizations have had individual damage from hacking, worms, viruses, cyber attacks, internet fraud, technology and information leaks due to criminal damage. Therefore privacy has become an important issue in the community. This paper examines various elements of the information security management system and discuss about Information Security Management System Models by using the analysis of the financial statue and its level of information security assessment. These analyses were based on the Information Security Management System (ISMS) of Korea Information Security Agency, British's ISO27001, GMITS, ISO/IEC 17799/2005, and COBIT's information security architecture. This model will allow users to manage and secure information safely. Therefore, it is recommended for companies to use the security management plan to improve the companies' financial and information security and to prevent from any risk of exposing the companies' information.

• Journal of Information Technology Applications and Management
• /
• 제23권3호
• /
• pp.61-69
• /
• 2016

Growing information threats have threatened organization to lose information security controls in these days. Many organizations have accepted the various information security management systems does mention necessity of a continuous evaluation process for the executions of information security management in a theoretical aspect. This study suggests a continuous evaluation process for information security management reflecting the real execution of managers and employees in organizations.

• 디지털융복합연구
• /
• 제12권2호
• /
• pp.563-570
• /
• 2014

정보보호의 중요성이 커지면서 안전행정부, 미래창조과학부, 교육부, 국가정보원 등 소관부처별 정보보안에 대한 심사기준을 제정하고 평가를 시행하고 있는 실정이다. 특히 2010년 G-ISMS, 2011년 개인정보보호법 시행 등 최근 정보보호의 중요성이 커지면서 보다 효과적인 정보보호 관리를 위한 노력이 커지고 있다. 이러한 각종 정보보호 인증과 심사는 공공기관의 정보보호 수준을 향상시키는데 많은 도움을 주고 있으나, 실무 기관에서는 연중 수시로 있는 소관부처별 인증심사로 인해 업무효율성이 저하되고 효과적인 보안관리에는 한계가 있다. 본 논문에서는 현재 공공기관을 대상으로 실시되는 정보보호 관리 심사기준을 분석하고, 한계점과 개선방향을 제시하고자 한다.

• 디지털산업정보학회논문지
• /
• 제14권2호
• /
• pp.19-25
• /
• 2018

With the development of IT technology, various services such as artificial intelligence and autonomous vehicles are being introduced, and many changes are taking place in our lives. However, if secure security is not provided, it will cause many risks, so the information security becomes more important. In this paper, we analyzed the research trends of main themes of information security over time. In order to conduct the research, 'Information Security' was searched in the Web of Science database. Using the abstracts of theses published from 1991 to 2016, we derived main research topics through topic modeling and time series regression analysis. The topic modeling results showed that the research topics were Information technology, system access, attack, threat, risk management, network type, security management, security awareness, certification level, information protection organization, security policy, access control, personal information, security investment, computing environment, investment cost, system structure, authentication method, user behavior, encryption. The time series regression results indicated that all the topics were hot topics.

• Journal of Information Technology Applications and Management
• /
• 제27권4호
• /
• pp.1-19
• /
• 2020

Infringement of information security has caused the corporate image to be damaged and share price to fall, and it is emerging as an organizational risk. The value of information assets in enterprises has led to a higher level of security than in the past. As a result, companies are aware of the need for officers to protect information and to oversee a security management system. However, despite the growing importance of information security officers, there is a lack of research on their roles and characteristics. This study validates the relationship between determinants that affect the performance of information security. And a structural equation model was presented and empirically analyzed to see the impact of the internal and external characteristics of the staff in charge of information security on the organization's information security performance.

• Industrial Engineering and Management Systems
• /
• 제13권1호
• /
• pp.87-100
• /
• 2014

Risk management is recognized as a significant element in Information Security Management while the failure mode and effects analysis (FMEA) is widely used in risk analysis in manufacturing industry. This paper aims to present the development work of the Information Security FMEA Circle (InfoSec FMEA Circle) which is used to support the risk management framework by modifying traditional FMEA methodologies. In order to demonstrate the "appropriateness" of the InfoSec FMEA Circle for the purposes of assessing information security, a case study at Hong Kong Science and Technology Parks Corporation (HKSTP) is employed. The "InfoSec FMEA Circle" is found to be an effective risk assessment methodology that has a significant contribution to providing a stepwise risk management implementation model for information security management.

• 한국항행학회논문지
• /
• 제15권6호
• /
• pp.1220-1227
• /
• 2011

IT 기술이 발전함에 따라 생활 자체가 지식 혹은 정보 기반 체제로 변화되어 가고 있다. 하지만 IT 기술의 발전 이면에는 사이버 공격 기술을 향상시키고 있으며, 이에 따라 DDoS 대란 등의 사이버 테러가 빈번히 발생하여 주요 자료가 유출되고 있다. 또한 다양한 공격 경로를 통해 정보시스템으로 유입된 악성코드로 인해 기업의 업무 손실 및 정보 자산에 대한 피해가 증가하고 있다. 이러한 환경에서 조직 및 사용자가 보존해야 할 정보 자산을 관리적, 기술적, 물리적 체계를 수립하는 정보보호관리체계를 기반으로 지속적인 점검을 수행하여 조직 내의 위기관리 프로세스가 구축되어야 한다. 또한 제도 및 프로세스의 수립 외에도 악의적인 악성코드가 내부로 유입되는 위협으로부터 내부 자산을 보호하기 위해 정보보호제품을 도입하여야 한다. 따라서 본 논문에서는 정보보호관리체계 및 정보보호제품의 도입 방안을 통해 기업 및 정부 정보보안을 강화하는 방안에 대하여 제안하고자 한다.

• Journal of Information Technology Applications and Management
• /
• 제23권1호
• /
• pp.79-96
• /
• 2016

As numerous security breaches on a variety of information assets such as personal information, corporate secrets, computer servers, and networks have occurred, information security has emerged as a critical social issue. However, researches on economically rational information security decision-making have been few. Such researches are especially rare in South Korea where information security is considered to be a discipline of engineers. This study aims to identify the preferred themes and methodologies of information security economics research in the field of information systems by reviewing papers published in Management Information Systems Quarterly (MISQ), Information Systems Research (ISR), European Journal of Information Systems (EJIS), Management Science (MS), and Information and Management (I&M). We hope that the results of the study will be helpful in rational managerial or policy decision-making for practitioners and suggest future research topics for researchers.

• Journal of Information Technology Applications and Management
• /
• 제16권3호
• /
• pp.73-86
• /
• 2009

To establish an effective security strategy, business enterprises need a security benchmarking tool. The strategy helps to lessen an impact and a damage in any threat. This study analyses many aspects of information security management and suggests a way to deal with security investments by considering important factors that affect security manager's decision. To address the different threats resulting from a major cause of accidents inside an enterprise, we investigate an approach that followed ISO17799. We unfold a criminology theory that has designated many measures against the threat as suggested by General Deterrence Theory. The study proposes a coherent model of the theory to improve the security measures especially in handling and protecting company assets and human lives as well.

• 대한산업공학회지
• /
• 제28권1호
• /
• pp.44-56
• /
• 2002

For the risk analysis and risk assessment techniques to be effectively applied to the field of information technology (IT) security, it is necessary that the required activities and specific techniques to be applied and their order of applications are to be determined through a proper risk management model. If the adopted risk management model does not match with the characteristics of host organization, an inefficient management of security would be resulted. In this paper, a risk management model which can be well adapted to Korean domestic IT environments is proposed for an efficient security management of IT. The structure and flow of the existing IT-related risk management models are compared and analysed, and their common and/or strong characteristics are extracted and incorporated in the proposed model in the light of typical threat types observed in Korean IT environments.