기업 정보보안 전략 수립을 위한 보안 사고 유형 분류에 관한 연구
A Study on Categorization of Accident Pattern for Organization’s Information Security Strategy Establish
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
Corporation’s valuable intelligent asset is being threatened from the skills of threatening subject that has been evolved along with the growth of the information system and the amount of the information asset. Domestically, attempts of various private information attacks, important information extortion, and information damage have been detected, and some of them have abused the vulnerability of security of information system, and have become a severe social problem that generates security incident. When accessing to the security, most of companies used to establish a strategy with a consistent manner and a solution plan. However, this is not a proper way. The order of priorities vary depending on the types of business. Also, the scale of damage varies significantly depending on the types of security incidents. And method of reaction and critical control point vary depending on the types of business and security incidents. In this study, I will define the security incidents by their types and preponderantly examine how one should react to those security incidents. In this study, analyzed many types of security accidents that can occur within a corporation and an organization considering various factors. Through this analysis, thought about factors that has to be considered by corporations and organizations when they intend to access to the information security. This study focuses on the response methodology based on the analysis of the case analysis of the leakage of industrial secret and private secret other than the conceptual response methodology that examines the way to prevent the leakage of the industry security systems and the industry information activities. And based on these factors, want to be of help for corporations to apply a reasonable approach when they establish a strategy to information security.
Abstract
Corporation’s valuable intelligent asset is being threatened from the skills of threatening subject that has been evolved along with the growth of the information system and the amount of the information asset. Domestically, attempts of various private information attacks, important information extortion, and information damage have been detected, and some of them have abused the vulnerability of security of information system, and have become a severe social problem that generates security incident. When accessing to the security, most of companies used to establish a strategy with a consistent manner and a solution plan. However, this is not a proper way. The order of priorities vary depending on the types of business. Also, the scale of damage varies significantly depending on the types of security incidents. And method of reaction and critical control point vary depending on the types of business and security incidents. In this study, I will define the security incidents by their types and preponderantly examine how one should react to those security incidents. In this study, analyzed many types of security accidents that can occur within a corporation and an organization considering various factors. Through this analysis, thought about factors that has to be considered by corporations and organizations when they intend to access to the information security. This study focuses on the response methodology based on the analysis of the case analysis of the leakage of industrial secret and private secret other than the conceptual response methodology that examines the way to prevent the leakage of the industry security systems and the industry information activities. And based on these factors, want to be of help for corporations to apply a reasonable approach when they establish a strategy to information security.
참고문헌 (51)
- Aljifri, H., "International Legal Aspects of Cryptography", Computers and Security, 22(3), pp.196~203 (2003)
- "Announcement on National Industrial Security Center, NISC", ~ (2015)
- Besnard, D., "Computer security impaired by legitimate user", pp.253~264 (2004), Computers and Security
- Bharadwaj, A., "Effects of Information Technology Failures on the Market Value of Firms", The Journal of Strategic Information Systems archive, 18(2), pp.66~79 (2009)
- Brancheau, J. C., "Key Issues in Information Systems Management : 1994-95 SIM Delphi Results", MIS Quarterly, 20(2), pp.225~242 (1996)
- Broderick, J. S., "Information Security Risk Management-When should it be Managed?", Information Security Technical Report, 6(3), pp.12~18 (2001)
- ISO 17799, "Implementing Information Security Based on ISO 27001", pp.2006, Calder, A.
- Cavusoglu, H., "Economics of IT Security Management : Four Improvements to Current Security Practices", Communications of the Association for Information Systems, 14(3), pp.3~ (2004)
- Dhillon, G., "Computer Crimes : Theorizing about the Enemy within", Computers and Security, 20(8), pp.715~723 (2001)
- Doherty, N.F., "Do Information Security Policies Reduce the Incidence of Security Breaches : An Exploratory Analysis", Information Resources Management Journal, 4, pp.21~38 (2005)
- Ettredge, M., "Information Transfer among Internet Firms: the Case of Hacker Attacks", Journal of Information Systems, 17(2), pp.71~82 (2003)
- Finne, T., "Information Systems Risk Management : Key Concepts and Business Processes", Computer and Security, 19(3), pp.234~242 (2000)
- Flint, D. J., "Exploring the Phenomenon of Customers Desired Value Change in a Business-to-Business Context", Journal of Marketing, 66, pp.102~117 (2002)
- Hagen, J.M., "Implementation and Effectiveness of Organizational Information Security Measures", Information Management and Computer Security, 16(4), pp.377~397 (2008)
- Halliday, S., "A Business Approach to Effective Information Technology Risk Analysis and Management", Information Management and Computer Security, 4(1), pp.19~31 (1996)
- Hawkins, S., "Awareness and Challenges of Internet Security", Information Management and Computer Security, 8(3), pp.131~143 (2000)
- Hu, Q., "The Role of External and Internal Influences on Information Systems Security Practices : An Institutional Perspective", The Journal of Strategic Information Systems Archive, 16(2), pp.153~172 (2006)
- "Information Security Specialist’s CISSP Note", ~ (2012)
- Jahner, S., "Beyond Technical Aspects of Information Security : Risk Culture as a Success Factor for IT Risk Management", AMCIS 2005 Proceedings, pp.462~ (2005)
- Karyda, M., "Information security policies : a contextual perspective", Computers and Security, pp.246~260 (2005)
- 김문선, "산업보안 역량 수준평가 및 개선방안", 품질경영학회지, 41(4), pp.649~658 (2013), 한국품질경영학회[DOI]
- A Fact-Finding on Leak Out of Personal Data, "Korea Communications Commission", KCC, ~ (2015)
- Kotulic, A.J., "Why There aren’t more Information Security Research Studies", Information and Management, 41(5), pp.597~607 (2004)
- Lebek, B., "Investigating the Influence of Security, Privacy, and Legal Concerns on Employees Intention to Use BYOD Mobile Devices", Proceedings of the Nineteenth Americas Conference on Information Systems, pp.15~17 (2005)
- Lee, A.S., "Retrospect and Prospect : Information Systems Research in the Last and Next Twenty-Five Years", Journal of Information Technology, 25(4), pp.336~348 (2010)
- 이장훈, "중소기업 기술보호 개선방안에 대한 연구", 산업경영시스템학회지, 37(2), pp.77~84 (2014), 한국산업경영시스템학회
- Lewis, A., "Time to Elevate IT Security to the Boardroom", e Secure, 1(1), pp.28~ (2000)
- Lohmeyer, D. F., "Managing Information Security", The McKinsey Quarterly, Special Edition : Risk and Resilience, 2, pp.12~16 (2002)
- "National Defense Science and Technology Vocabulary", ~ (2011)
- National Institute of Standards and Technology, "An Introduction to Computer Security : The NIST Handbook", 800~812 (2000)
- NIST, "Information Security Handbook : A Guide for Managers", ~ (2006)
- Peppard, J., "The Conundrum of IT Management", European Journal of Information Systems, pp.336~345 (2007)
- Pfhleeger, C.P., "Security in Computing" (1997), Prentice Hall, United States of America
- Posthumus, S., "A Framework for the Governance of Information Security", Computers and Security, 23(8), pp.638~646 (2004)
- Ransbotham, S., "Choice and Chance : A Conceptual Model of Paths to Information Security Compromise", Information Systems Research, 20(1), pp.121~139 (2009)
- Sarker, S., "Using an Adapted Grounded Theory Approach for Inductive Theory Building About Virtual Team Development", DATA BASE for Advances in Information Systems, 2(1), pp.38~56 (2001)
- Smith, E., "Information Security Education", in Proceedings of the WISE 4 Conference (2004)
- Son, J.Y., "Organizational Buyer’s Adoption and Use of B2B Electronic Marketplace : Efficiency and Legitimacy-Oriented Perspectives", Journal of Management Information Systems, 24(1), pp.55~99 (2007)
- Spears, J.L., "User Participation in Information Systems Security Risk Management", MIS Quarterly, pp.503~522 (2010)
- "LAN Security will become a Priority in the Networks of Tomorrow" (2000)[URL]
- Stiles, P., "Boards at work : How directors view their roles and responsibilities" (2001), Oxford University Press
- Straub, D., "Coping with Systems Risk :Security Planning Models for Management Decision Making", MIS Quarterly, 22(4), pp.441~469 (1998)
- "The 9th Korean Standard Industrial Classification", ~ (2007)
- Thomson, M.E., "Information Security Awareness : Educating Your Users Effectively", Information Management and Computer Security, 6(4), pp.167~173 (1998)
- "Unfair Competition Prevention and Business Secret Protection Law", ~ (2007)
- Vidgen, R., "Coevolving Systems and the Organization of Agile Software Development", Information Systems Research, 20(3), pp.355~376 (2009)
- Von Solms, R., "From policies to culture", Computers and Security, 23(4), pp.275~279 (2004)
- Von Solms, S. H., "Information Security Management through Measurement", in Prodeedings of the SEC99 conference (1999)
- Whiteman, W., "Principles of Information Security" (2003), Thomson-Course Technology
- Wood, C.C., "Why Information Security is Now Multi-Disciplinary, Multi-Departmental, and Multi-Organizational in Nature", Computer Fraud and Security, (1), pp.16~17 (2004)