클라우드 보안인증제도의 주요 쟁점 및 개선 방안 연구
A Study on Key Issues and Improvement Strategies of Korea Cloud Security Assurance Program
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
이 연구는 클라우드 컴퓨팅 환경의 급속한 발전과 이에 따른 보안 위협에 주목하여, 현재 대한민국의 클라우드 보안인증제도(CSAP)를 미국의 FedRAMP, 유럽연합의 EUCS 제도와 비교 분석하고, 그 한계를 진단함으로써 개선 방안을 모색한다. 주요 내용은 공공부문을 포함한 산업 전반의 민간클라우드 서비스 활용 확대와 클라우드 서비스 제공자의 보안인증 획득 과정에서 나타난 장애요인에초점을 맞추고, 클라우드 보안인증 활성화와 정보보호 체계 강화를 위한 구체적인 제안을 포함한다. 제안된 개선 방안에는 중복인증 부담 완화, 암호화 알고리즘 요건의 유연화, 산업군별 보안 요구사항관리, 보안인증기준의 상세화, 공유 책임 모델의 명확화 및 사후관리 체계 개선 등이 포함된다. 이러한 제안들은 CSAP의 실용성 및 보안성을 향상시키고, 국내 클라우드 산업의 글로벌 경쟁력 강화 및사용자의 보안 신뢰도 제고에 기여할 것으로 기대된다.
Abstract
This study examines the rapid development of cloud computing and related security threats, specifically assessing the Korea Cloud Security Assurance Program (CSAP) by comparing it with the US's FedRAMP and the EU's EUCS to identify improvement areas. It focuses on the challenges Cloud Service Providers face in obtaining security certification and proposes enhancements to activate cloud security certification and bolster the information protection system. Recommendations include reducing the burden of duplicate certifications, increasing flexibility in encryption algorithm requirements, management of security requirements by industry sector, refining security certification standards, clarifying shared responsibilities, and improving postmanagement systems. These measures aim to enhance CSAP's effectiveness, boost the domestic cloud industry's global competitiveness, and strengthen user confidence in security.
참고문헌 (34)
- Giulio C. D., "IT security and privacy standards in comparison: Improving FedRAMP authorization for cloud service providers", 2017 17th IEEE, 2017, 1090~1099
- Katz, R, "Economic impact of cloud adoption in Asia-Pacific: The importance of Pro-Cloud policies to promote development and economic growth" (2023), Telecom Advisory Services LLC
- Sunyaev, A, "Cloud services certification", Communications of the ACM, 56(2), pp.33~36 (2013)
- J-H. Jeong, "An exploratory study for activating cloud computing : Focusing on legislative alternatives", Journal of Korean Association for Regional Information Society, 20(4), pp.73~96 (2017)
- S-A. Lee, "Socio-economic benefits analysis of improvement of cloud security certification system(CSAP)", Journal of Regulation Studies, 30(2), pp.35~68 (2021)
- "ISO", IEC 17000:2020, Conformity assessment –Vocabulary and general principles, 2020
- National Institute of Standards and Technology, "NIST cloud computing security reference architecture, Draft SP 500-299", ~ (2013)
- Grobauer, B., "Understanding cloud computing vulnerabilities", IEEE Security & Privacy, 9(2), pp.50~57 (2011)
- Key issues and countermeasures in cloud security, "S-W. Ahn", Software Policy & Research Institute, ~, pp.Software Policy & Research Institute Issue Report, No. 2017-006 (2017)
- "ITU-T, X.1601, Security framework for cloud computing", ~ (2015)
- National Security Agency, "Mitigating cloud vulnerabilities", ~ (2020)
- Pearson, S, "Privacy, security and trust issues arising from cloud computing", 2010 IEEE Second International Conference on Cloud Computing Technology and Science, pp.693~702 (2010)
- National Institute of Standards and Technology, "Guidelines on security and privacy in public cloud computing, SP 800-144", ~ (2011)
- 2022 ICT technology level survey and technology competitiveness analysis report, "Institute of Information & Communications Technology Planning & Evaluation", ~ (2024)
- The 1st Cloud Computing Development Basic Plan, "Ministry of Science and ICT", ~ (2015)
- The 2nd Cloud Computing Development Basic Plan, "Ministry of Science and ICT", ~ (2018)
- The 3rd Cloud Computing Basic Plan, "Ministry of Science and ICT", ~ (2021)
- J-H. Jeong, "Legislative impact analysis of commercial cloud use in the public sector", Legislative Impact Analysis, (52) (2021), National Assembly Research Service
- National Intelligence Service, "National cloud computing security guidelines", ~ (2023)
- Korea Internet & Security Agency, "Cloud computing service security assurance program guide", ~ (2023)
- Ministry of Science and ICT, "Preliminary announcement on the partial amendment of the public notice on cloud computing service security assurance", Announcement No. 2024-0092, ~ (2024)
- National Institute of Standards and Technology, "Standards for security categorization of federal information and information systems", FIPS PUB 199, ~ (2004)
- FedRAMP, "FedRAMP security controls baseline", ~ (2023)
- FedRAMP, "FedRAMP continuous monitoring strategy guide", ~ (2018)
- European Union Agency for Cybersecurity, "EUCS -Cloud services scheme", ~ (2020)
- Windhorst, I, "Dynamic certification of cloud services", 2013 International Conference on Availability, Reliability and Security (ARES), pp.412~417 (2013)
- Lins, S, "Trust is good, control is better: Creating secure clouds by continuous auditing", IEEE Transactions on Cloud Computing, 6(3), pp.890~903 (2018)
- Cloud computing policies and their economic impacts in Asia and the Pacific, "Katz, R", Asian Development Bank Institute (ADBI), ~ (2024)
- 2023 administrative and public institutions cloud computing demand forecast survey results, "Ministry of the Interior and Safety", ~ (2023)
- 2023 cloud industry status survey report, "Ministry of Science and ICT", ~ (2023)
- National Cyber Security Center, "List of eligible commercial cloud computing services for national public institutions", ~ (2024)
- Survey on the current state and perceptions of cloud computing, "KDI Economic Information and Education Center", ~ (2021)
- Comments of the computer & communications industry association regarding foreign trade barriers to U.S. exports for 2022 reporting, "Computer & Communications Industry Association", ~ (2022)
- 2023 national trade estimate report on foreign trade barriers, "United States Trade Representative", ~ (2023)