• The Journal of the Korea institute of electronic communication sciences
• /
• v.9 no.1
• /
• pp.137-142
• /
• 2014

Industrial control system (ICS) is a computer based system which are typically used in nation-wide critical infra-structure facilities such as electrical, gas, water, wastewater, oil and transportation. In addition, ICS is essentially used in industrial application domain to effectively monitor and control the remotely scattered systems. The highly developed information technology (IT) and related network techniques are continually adapted into domains of industrial control system. However, industrial control system is confronted significant side-effects, which ICS is exposed to prevalent cyber threats typically found in IT environments. Therefore, cyber security vulnerabilities and possibilities of cyber incidents are dramatically increased in industrial control system. The vulnerabilities that may be found in typical ICS are grouped into Policy and Procedure, Platform, and Network categories to assist in determining optimal mitigation strategies. The order of these vulnerabilities does not necessarily reflect any priority in terms of likelihood of occurrence or severity of impact. Firstly, corporate security policy can reduce vulnerabilities by mandating conduct such as password usage and maintenance or requirements for connecting modems to ICS. Secondly, platfom vulnerabilities can be mitigated through various security controls, such as OS and application patching, physical access control, and security software. Thirdly, network vulnerabilities can be eliminated or mitigated through various security controls, such as defense-in-depth network design, encrypting network communication, restricting network traffic flows, and providing physical access control for network components.

• Journal of Broadcast Engineering
• /
• v.22 no.3
• /
• pp.350-365
• /
• 2017

Steganography is a technique for secret data communication, which is not perceived by third person between a receiver and a transmitter. It has been developed for thousands of years for the transmission of military, diplomatic or business information. The development of digital media and communication has led to the development of steganography techniques in modern times. Technic of image steganography include the LSB, which fixes the number of embedded bits into a pixel, and PVD, which exploits the difference value in the neighboring pixel pairs. In the case of PVD image steganography, a large amount of information is embedded fluidly by difference value in neighboring pixel pairs and the designed range table. However, since the secret information in order is embedded, if an error of the number of embedded bits occurs in a certain pixel pair, all subsequent information will be destroyed. In this paper, we proposes the method, which improve the vulnerability of PVD property about external attack or various noise and extract secret information. Experimental process is comparison analysis about stego-image, which embedded various noise. PVD shows that it is not possible to preserve secret information at all about noise, but it was possible to robustly extract secret information for partial noise of stego-image in case of the proposed PVD image steganography with locally-fixed number of embedding bits.

• Journal of Korea Water Resources Association
• /
• v.52 no.6
• /
• pp.429-440
• /
• 2019

The numbers of multi-year droughts due to climate change are increasing worldwide. Boryeong Dam, located in Chungcheongnam-do, South Korea, was also affected by a 4-year drought from 2014 to 2017. Since traditional unilateral decision making processes to alleviate drought damage have, until now, resulted in conflicts between many of the involved groups, the need for active participation from both stakeholders and policymakers is greater than before. This study introduced Shared Vision Planning, a collaborative decision making process that involves participation from various groups of stakeholders, by organizing Water Policy Council for Climate Change Adaptation in Chungcheongnam-do. A Shared Vision Planning Model was then developed with a system dynamics software by working together with relevant stakeholders to actively reflect their requests through three council meetings. Multiple simulations that included various future climate change scenarios were conducted, and future drought vulnerability analysis results of Boryeong Dam and districts, in terms of frequency, length, and magnitude, were arrived at. It was concluded that Boryeong Dam was more vulnerable to future droughts than the eight districts. While the total water deficit in the eight districts was not so significant, their water deficit in terms of spatial discordance was proved to be more problematic. In the future, possible alternatives to the model will be implemented so that stakeholders can use it to agree on a policy for possible conflict resolutions.

• Journal of Internet Computing and Services
• /
• v.15 no.3
• /
• pp.79-90
• /
• 2014

User authentication based on ID and PW has been widely used. As the Internet has become a growing part of people' lives, input times of ID/PW have been increased for a variety of services. People have already learned enough to perform the authentication procedure and have entered ID/PW while ones are unconscious. This is referred to as the adaptive unconscious, a set of mental processes incoming information and producing judgements and behaviors without our conscious awareness and within a second. Most people have joined up for various websites with a small number of IDs/PWs, because they relied on their memory for managing IDs/PWs. Human memory decays with the passing of time and knowledges in human memory tend to interfere with each other. For that reason, there is the potential for people to enter an invalid ID/PW. Therefore, these characteristics above mentioned regarding of user authentication with ID/PW can lead to human vulnerabilities: people use a few PWs for various websites, manage IDs/PWs depending on their memory, and enter ID/PW unconsciously. Based on the vulnerability of human factors, a variety of information leakage attacks such as phishing and pharming attacks have been increasing exponentially. In the past, information leakage attacks exploited vulnerabilities of hardware, operating system, software and so on. However, most of current attacks tend to exploit the vulnerabilities of the human factors. These attacks based on the vulnerability of the human factor are called social-engineering attacks. Recently, malicious social-engineering technique such as phishing and pharming attacks is one of the biggest security problems. Phishing is an attack of attempting to obtain valuable information such as ID/PW and pharming is an attack intended to steal personal data by redirecting a website's traffic to a fraudulent copy of a legitimate website. Screens of fraudulent copies used for both phishing and pharming attacks are almost identical to those of legitimate websites, and even the pharming can include the deceptive URL address. Therefore, without the supports of prevention and detection techniques such as vaccines and reputation system, it is difficult for users to determine intuitively whether the site is the phishing and pharming sites or legitimate site. The previous researches in terms of phishing and pharming attacks have mainly studied on technical solutions. In this paper, we focus on human behaviour when users are confronted by phishing and pharming attacks without knowing them. We conducted an attack experiment in order to find out how many IDs/PWs are leaked from pharming and phishing attack. We firstly configured the experimental settings in the same condition of phishing and pharming attacks and build a phishing site for the experiment. We then recruited 64 voluntary participants and asked them to log in our experimental site. For each participant, we conducted a questionnaire survey with regard to the experiment. Through the attack experiment and survey, we observed whether their password are leaked out when logging in the experimental phishing site, and how many different passwords are leaked among the total number of passwords of each participant. Consequently, we found out that most participants unconsciously logged in the site and the ID/PW management dependent on human memory caused the leakage of multiple passwords. The user should actively utilize repudiation systems and the service provider with online site should support prevention techniques that the user can intuitively determined whether the site is phishing.