• Asia pacific journal of information systems
• /
• 제18권4호
• /
• pp.1-26
• /
• 2008

Rapid progress of information technology and widespread use of the personal computers have brought various conveniences in our life. But this also provoked a series of problems such as hacking, malicious programs, illegal exposure of personal information etc. Information security threats are becoming more and more serious due to enhanced connectivity of information systems. Nevertheless, users are not much aware of the severity of the problems. Using appropriate password is supposed to bring out security effects such as preventing misuses and banning illegal users. The purpose of this research is to empirically analyze a research model which includes a series of factors influencing the effectiveness of passwords. The research model incorporates the concept of risk based on information systems risk analysis framework as the core element affecting the selection of passwords by users. The perceived risk is a main factor that influences user's attitude on password security, security awareness, and intention of security behavior. To validate the research model this study relied on questionnaire survey targeted on evening class MBA students. The data was analyzed by AMOS 7.0 which is one of popular tools based on covariance-based structural equation modeling. According to the results of this study, while threat is not related to the risk, information assets and vulnerability are related to the user's awareness of risk. The relationships between the risk, users security awareness, password selection and security effectiveness are all significant. Password exposure may lead to intrusion by hackers, data exposure and destruction. The insignificant relationship between security threat and perceived risk can be explained by user's indetermination of risk exposed due to weak passwords. In other words, information systems users do not consider password exposure as a severe security threat as well as indirect loss caused by inappropriate password. Another plausible explanation is that severity of threat perceived by users may be influenced by individual difference of risk propensity. This study confirms that security vulnerability is positively related to security risk which in turn increases risk of information loss. As the security risk increases so does user's security awareness. Security policies also have positive impact on security awareness. Higher security awareness leads to selection of safer passwords. If users are aware of responsibility of security problems and how to respond to password exposure and to solve security problems of computers, users choose better passwords. All these antecedents influence the effectiveness of passwords. Several implications can be derived from this study. First, this study empirically investigated the effect of user's security awareness on security effectiveness from a point of view based on good password selection practice. Second, information security risk analysis framework is used as a core element of the research model in this study. Risk analysis framework has been used very widely in practice, but very few studies incorporated the framework in the research model and empirically investigated. Third, the research model proposed in this study also focuses on impact of security awareness of information systems users on effectiveness of password from cognitive aspect of information systems users.

• 한국통신학회논문지
• /
• 제35권12C호
• /
• pp.995-1003
• /
• 2010

영상, 동영상 및 3D 모델의 인증 및 복사방지를 위한 콘텐츠 기반 해쉬 함수는 강인성 및 보안성의 성질을 만족하여야 한다. 이들 중 해쉬의 보안성을 분석하기 위한 방법으로 미분 엔트로피 방법이 제시되었으나, 이는 영상 해쉬 추출에서만 적용되었다. 따라서 본 논문에서는 미분 엔트로피 기반의 3D 모델 해쉬 특징 추출의 보안성을 분석하기 위한 모델링을 제안한다. 제안한 보안성 분석 모델링에서는 3D 모델 해싱 기법 중 가장 일반적인 두 가지 형태의 특정 추출 방법을 제시한 다음, 이들 방법들을 미분 엔트로피 기반으로 보안성을 분석하였다. 과로부터 해쉬 추출 방법에 대한 보안성을 분석하고 보안성과 강인성과의 상호보완관계에 대하여 논하였다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제14권11호
• /
• pp.4331-4354
• /
• 2020

Nepal is a sensitive and disaster-prone country where safety and security risk are of high concern for travelers. Digital technologies can play a vital role in addressing safety and security issues in the country. This research work proposes a Digital tourism security system design for addressing the safety and security issues in tourism industry of Nepal. The study uses Design science research methodology to identify artifacts, interactions, information flow and dependencies between them which are then mapped with existing prevalent technology to provide design solutions. Data is obtained from interview of tourist and experts as a primary source and technical documents/draft, software documentations, surveys as secondary source. Generalized information model, Use cases model, Network architecture model, Layered taxonomy model and Digital tourism technology reference model are the outcomes of the study. The work is very important as it talks specifically about implementation and integration of digital technologies in tourism security governance at federal, provincial, municipal and rural level. The research supplements as a knowledge document for design and implementation of digital tourism security system in practice. As there is very less work on digital systems in tourism security of Nepal, this work is a pioneer and first of its kind.

• International Journal of Computer Science & Network Security
• /
• 제24권1호
• /
• pp.140-150
• /
• 2024

Database-as-a-Service is one of the prime services provided by Cloud Computing. It provides data storage and management services to individuals, enterprises and organizations on pay and uses basis. In which any enterprise or organization can outsource its databases to the Cloud Service Provider (CSP) and query the data whenever and wherever required through any devices connected to the internet. The advantage of this service is that enterprises or organizations can reduce the cost of establishing and maintaining infrastructure locally. However, there exist some database security, privacychallenges and query performance issues to access data, to overcome these issues, in our recent research, developed a database security model using a deterministic encryption scheme, which improved query execution performance and database security level.As this model is implemented using a deterministic encryption scheme, it may suffer from chosen plain text attack, to overcome this issue. In this paper, we proposed a new model for cloud database security using nondeterministic encryption, order preserving encryption, homomorphic encryptionand database distribution schemes, andour proposed model supports execution of queries with equality check, range condition and aggregate operations on encrypted cloud database without decryption. This model is more secure with optimal query execution performance.

• 정보보호학회논문지
• /
• 제19권2호
• /
• pp.117-125
• /
• 2009

일반적으로 컨택센터에서는 고객의 개인정보 취급이 필수적이며, 중요정보자산인 고객의 개인정보를 취급하는 고객정보취급자의 수가 매우 많아, 내부 고객정보 유출 가능성 등의 위협요인이 존재하고 있다. 본 논문에서는 컨택센터의 특성과 위협요인 및 취약점을 분석하였으며, 고객의 개인정보를 효과적으로 보호할 수 있는 방안을 연구하였다. 또한 내부 정보 유출 가능성을 사전에 예방할 수 있는 개인정보 보호 방안을 마련하였다. 그리고 컨택센터의 고객 개인정보보호 방안에 대하여 ISMS (Information Security Management System) 표준을 따르는 "컨택 센터의 고객 개인정보 보호 모델"을 수립하여 제안한다.

• 스마트미디어저널
• /
• 제13권3호
• /
• pp.45-52
• /
• 2024

오늘날 점점 증가하는 위협 환경에서는 보안 이벤트에 대한 신속하고 효과적인 탐지 및 대응이 필수적이다. 이러한 문제를 해결하기 위해 많은 기업과 조직에서는 다양한 보안관제시스템을 도입하여 보안 위협에 대응하고 있다. 그러나 기존 보안관제시스템은 보안 이벤트의 복잡성과 다양한 특성으로 인해 어려움을 겪고 있다. 본 연구에서는 인공지능 기반의 자동화된 통합보안관제시스템 모델을 제안하였다. 인공지능 기술인 딥러닝을 기반으로 하여 다양한 보안 이벤트에 대해 효과적인 탐지와 이를 처리하는 기능들을 제공한다. 이를 위해 모델은 기존의 보안관제시스템 한계를 극복하기 위하여 다양한 인공지능 알고리즘과 머신러닝 방법을 적용한다. 제안된 모델은 운영자의 업무량을 줄이고 효율적인 운영을 보장하며 보안 위협에 대한 신속한 대응을 지원하게 될 것이다.

• 한국컴퓨터정보학회논문지
• /
• 제13권5호
• /
• pp.163-170
• /
• 2008

컴포넌트에 대한 의존도 및 활용도가 증가하면서 컴포넌트의 보안성 강화를 위한 필요성이 증가하고 있다. 컴포넌트는 재사용을 통한 소프트웨어의 개발 생산성을 향상시키는 이점을 제공한다. 이러한 이점에도 불구하고 컴포넌트의 보안 취약성은 재사용에 제한을 한다. 이의 개선을 위해 컴포넌트의 보안성을 높이는 경우에 가장 문제가 되는 부분이 재사용성에 대한 제한이 확대된다는 것이다. 따라서 컴포넌트의 재사용성과 보안성을 동시에 고려하는 컴포넌트의 모델이 제공되어야 한다. 이의 해결책으로 정보은폐와 수정의 용이성을 제공하여 보안성과 재사용을 확대할 수 있도록 재사용 모델을 결합하고 포장 및 애스펙트 모델을 통합한 컴포넌트 재사용 확대를 위한 관심사의 분리보안 모델을 제안하고 응용시스템을 구축하여 모델의 적합성을 검증하였다. 이의 응용은 핵심 및 보안 관심사의 분리를 통한 컴포넌트 기능의 확장과 수정의 용이성을 제공함으로써 보안성을 높이는 동시에 재사용성을 확대한다.

• 정보보호학회논문지
• /
• 제22권6호
• /
• pp.1243-1252
• /
• 2012

최근 모바일 스마트 기기의 보편화로 인하여 사용자 인터페이스로부터 개인 정보를 직접 획득하는 유형의 공격(숄더 서핑 공격, 레코딩 공격 등) 위협이 크게 증가하고 있다. 이러한 공격 가능성 및 안전성에 대한 체계적 평가를 위해 정형화된 안전성 분석 모델이 필요하지만, 이에 적합한 모델이 존재하지 않는다. 본 논문에서는 모바일 스마트 기기환경의 안전성 및 사용성 분석 모델인 STM-GOMS 모델을 제안한다. STM-GOMS 모델은 HCI 인지 모델을 안전성 분석에 처음으로 활용한 이전 연구 사례를 메모리 한계 관점에서 개선한 GOMS 기반 모델로 인증 기법의 사용성과 안전성 평가가 가능하다. 본 논문에서는 현재 스마트 기기에서 사용 중인 패스워드 입력 기법을 STM-GOMS 모델로 분석하여 사용성과 숄더 서핑 공격에 취약함을 보이고 이를 실험을 통해 검증한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제12권8호
• /
• pp.3567-3588
• /
• 2018

In the Internet of Things (IoT) concept, devices communicate autonomously with applications in the Internet. A significant aspect of IoT that makes it stand apart from present-day networked devices and applications is a) the very large number of devices, produced by diverse makers and used by an even more diverse group of users; b) the applications residing and functioning in what were very private sanctums of life e.g. the car, home, and the people themselves. Since these diverse devices require high-level security, an operational model for an IoT system is required, which has built-in security. We have proposed the societal model as a simple operational model. The basic concept of the model is borrowed from human society - there will be infants, the weak and the handicapped who need to be protected by guardians. This natural security mechanism works very well for IoT networks which seem to have inherently weak security mechanisms. In this paper, we discuss the requirements of the societal model and examine its feasibility by doing a proof-of-concept implementation.

• International Journal of Contents
• /
• 제7권3호
• /
• pp.71-81
• /
• 2011

This paper is mainly associated with setting out an agenda for the transformation of security by creating a new framework for a security system, which can maximise its effectiveness. Noticeably, this research shows empirically that crimes are getting a major cost to organisations, which if reduced by security and investigations could reap substantial rewards to the finances of an organisation. However, the problem is that the delivery of security is frequently delegated to personnel (e.g. security guards) with limited training, inadequate education, and no real commitment to professionalism - 'sub-prime' security, finally causing security failures. Therefore, if security can be enhanced to reduce the crime cost, this will produce financial benefits to business, and consequently could produce a competitive advantage. For this, the paper basically draws upon Luke's theoretical framework for deconstructing 'power' into three dimensions. Using this three-dimensional approach, the paper further sets out a model of how security can be enhanced, utilising a new Security Risk Management (SRM) model, and how can this SRM model create competitive advantage in business. Finally, this paper ends with the six strategies needed to enhance the quality of security: refiguring as SRM, Professional Staff, Accurate Measurement, Prevention, Cultural Change, and Metrics.