• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 1995.11a
• /
• pp.51-58
• /
• 1995

The importance of the risk analysis tool has been recognized and its use also has been emphasized by a number of researchers recently The methodology were examined but neither algorithms nor practical applications have been implemented or practiced in Korea. In this paper, the architecture of the Buddy System, one of the automated risk assessment tools. is analyzed in depth to provide the algorithmic understanding and to promote the development of the risk analysis methodology. The Buddy System mainly uses three main factors of vulnerability, threat and countermeasures as a nucleus of the qualatative analysis with the modified loss expectancy value. These factors are identified and assessed by the separation of duties between the end user and security analyst. The Buddy System uses five axioms as its bases of assessment algorithm and the assessed vulnerability level is strictly within these axioms. Since the In-place countermeasures reduce the vulnerability level up to a certain level. the security analyst may use "what if " model to examine the impact of additional countermeasures by proposing each to reduce the vulnerability level further to within the acceptable range. The emphasis on the qualitative approach on vulnerability leveling is very well balanced with the quantitative analysis that the system performance is prominent.prominent.

• Journal of Environmental Science International
• /
• v.20 no.6
• /
• pp.789-798
• /
• 2011

Climate change assessment, together with climate change adaptation process, would be one of the worldwide important issues, and the study on climate change vulnerability indicator has been an essential problem for climate change adaptation. Vulnerability indicator can be used as a good tool to estimate the impact of climate change and to map out the distribution of its vulnerability over the given area both in Korea and other countries. This study addressed the conceptual summary on the assessment of climate change and its adaptation process. Previous studies on how to yield the vulnerability indicators of climate change are reviewed and several previous results of vulnerability indicators applied to Korean provinces are also discussed here.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.13 no.4
• /
• pp.813-818
• /
• 2018

In this paper, the assessment items were selected for water by drought, water quality by drought, and thermal diseases by heat wave. We described the selection background for these assessment items. and then we weighted the selected vulnerability assessment items. The vulnerability assessment procedures also describe the calculation methods applied in phases and the actual cases. The vulnerability assessment database was analyzed and a climate change vulnerability assessment system for heat waves and droughts using these vulnerability assessment procedures was designed.

• Journal of Information Technology and Architecture
• /
• v.9 no.4
• /
• pp.401-411
• /
• 2012

There has been increased interest for cloud computing services that can promote cost savings while increasing investment in information resources. Cloud computing, however, has a disadvantage physically located in the external information resources to take advantage of the economic benefits, the advantages and increase the vulnerability of information protection and control of information assets. In this study, due to the unique properties of the new services, including vulnerability, the vulnerability of cloud computing derive the vulnerability of cloud computing and control items were derived through the mapping between vulnerability and control items, that are not being managed to identify vulnerabilities Cloud computing risk factors are presented.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.7
• /
• pp.1-8
• /
• 2017

As the IT environment becomes more sophisticated, various threats and their associated serious risks are increasing. Threats such as DDoS attacks, malware, worms, and APT attacks can be a very serious risk to enterprises and must be efficiently managed in a timely manner. Therefore, the government has designated the important system as the main information communication infrastructure in consideration of the impact on the national security and the economic society according to the 'Information and Communication Infrastructure Protection Act', which, in particular, protects the main information communication infrastructure from cyber infringement. In addition, it conducts management supervision such as analysis and evaluation of vulnerability, establishment of protection measures, implementation of protection measures, and distribution of technology guides. Even now, security consulting is proceeding on the basis of 'Guidance for Evaluation of Technical Vulnerability Analysis of Major IT Infrastructure Facilities'. There are neglected inspection items in the applied items, and the vulnerability of APT attack, malicious code, and risk are present issues that are neglected. In order to eliminate the actual security risk, the security manager has arranged the inspection and ordered the special company. In other words, it is difficult to check against current hacking or vulnerability through current system vulnerability checking method. In this paper, we propose an efficient method for extracting diagnostic data regarding the necessity of upgrading system vulnerability check, a check item that does not reflect recent trends, a technical check case for latest intrusion technique, a related study on security threats and requirements. Based on this, we investigate the security vulnerability management system and vulnerability list of domestic and foreign countries, propose effective security vulnerability management system, and propose further study to improve overseas vulnerability diagnosis items so that they can be related to domestic vulnerability items.

• Journal of KIISE:Computing Practices and Letters
• /
• v.14 no.2
• /
• pp.246-250
• /
• 2008

This paper presents the design of network vulnerability analysis system which can integrate various vulnerability assessment tools to improve the preciseness of the vulnerability scan result. Manual checking method performed by a security expert is the most precise and safe way. But this is not appropriate for the large-scale network which has a lot of systems and network devices. Therefore automatic scanning tool is recommended for fast and convenient use. The scanning targets may be different according to the kind of vulnerability scanners, or otherwise even for the same scanning target, the scanning items and the scanning results may be different by each vulnerability scanner, Accordingly, there are the cases in which various scanners, instead of a single scanner, are simultaneously utilized with the purpose of complementing each other. However, in the case of simultaneously utilizing various scanners on the large-scale network, the integrative analysis and relevance analysis on vulnerability information by a security manager becomes time-consumable or impossible. The network vulnerability analysis system suggested in this paper provides interface which allows various vulnerability assessment tools to easily be integrated, common policy which can be applied for various tools at the same time, and automated integrative process.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.6
• /
• pp.1539-1552
• /
• 2018

The necessity of establishing a more secure cyber security system is emerging to protect NPP against cyber attacks as nuclear facilities become increasingly reliant on digital system. Proper security measures should be established through periodic analysis and evaluation of vulnerabilities. However, as Nuclear facilities has safety characteristics as their top priority and it requires a lot of time and cost to construct regarding the activities for vulnerability analysis, it is difficult to apply the existing vulnerability analysis environment and analysis tools. In this study, We propose a analytical vulnerability assessment method to overcome the limitations of existing vulnerability analysis methods through analysis the existing vulnerability analysis methods and the issues to be considered when applying the vulnerability analysis method.

• Earthquakes and Structures
• /
• v.5 no.5
• /
• pp.571-588
• /
• 2013

Many of the current buildings in Algeria were built in the past without any consideration to the requirements of the seismic code. Among these buildings, there are a large number of individual houses built in the 1980's by their owners. They are Reinforced Concrete (RC) frame structures with unreinforced hollow masonry infill walls. This buildings type experienced major damage in the 2003 (Algeria) earthquake, generated by deficiencies in the structural system. In the present study, special attention is placed upon examining the vulnerability of RC frame houses. Their situation and their general features are investigated. Observing their seismic behavior, structural deficiencies are identified. The seismic vulnerability of this type of buildings depends on several factors, such as; structural system, plan and vertical configuration, materials and workmanship. The results of the vulnerability assessment of a group of RC frame houses are presented. Using a method based on the European Macroseismic Scale EMS-98 definitions, presented in previous studies, distribution of damage is obtained.

• Journal of the Society of Naval Architects of Korea
• /
• v.50 no.6
• /
• pp.383-389
• /
• 2013

Analysis and review of survivability is one of the most important aspects when naval vessels are designed. Because aiming points of threat towards the naval vessels in the battle field could not be estimated exactly, probabilistic and statistic approach is frequently introduced to evaluate and enhance the vessel survivability. Some commercial survivability analysis programs are used to perform the analysis for enhancement of susceptibility, vulnerability and recoverability but, they are usually classified and impossible to be exported to other countries because of their national security. In this paper, a simplified vulnerability analysis program is developed to evaluate the vulnerability of the warship in aspects of structure, redundancy and its mission capability at the conceptual design stage. To verify the developed program, the analysis results were compared with those of the commercial program MOTISS(Measure of Total Integrated System Survivability).

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1007-1015
• /
• 2013

The automatic payment process of mobile phone micropayment system has not checked user's authentication. That is the structural vulnerability of mobile phone micropayment system. The malicious contents provider can cheat users and payment gateway through abusing the structural vulnerability. The payment gateway applies standard payment module after August, 2012 in order to solve the problem. But the standard payment module also has the vulnerability that makes damage of users. So the purpose of this paper is to suggest efficient improvement of standard payment module for user protection.