안전한 가상자산 서비스를 위한 ISMS 인증항목 개선에 관한 연구: CCSS 인증제도 비교를 중심으로
Improvement of ISMS Certification Components for Virtual Asset Services: Focusing on CCSS Certification Comparison
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
비트코인이 등장한 이후, 다양한 가상자산이 가상자산 거래소의 가상자산 서비스를 통해 활발하게 거래되고 있다. 최근 가상자산거래소에대한 보안사고가 자주 발생하고 있어 정부는 가상자산 거래소의 정보보호 강화를 위해 Information Security Management System (ISMS) 인증획득을 의무화하고 있으며, 이를 위한 56개 특화항목을 추가로 제정하였다. 본 논문에서는 ISMS와 암호화폐를 이용하는 모든 정보시스템에 대한요구사항을 담고있는 CryptoCurrency Security Standard (CCSS)의 도메인 중요도를 비교하고 상호매핑을 한 후 그 결과를 분석하여 각 인증제도의특성을 통찰하였으며, 도출된 개선항목의 중요도 평가를 통해 개선항목에 대한 우선순위를 High, Medium, Low 등 3단계로 분류하여 High Level4가지 항목에 대한 개선사항들을 도출하였다. 이러한 결과는 가상자산 및 정보시스템 보안에 대한 우선순위를 제공하고 인증항목 개선에 대한방법 및 체계적인 의사결정을 지원할 수 있을 뿐만 아니라 가상자산서비스에 대한 신뢰성 및 안전성을 제고하여 가상자산 거래 활성화에 기여할수 있을 것으로 보인다.
Abstract
Since the advent of Bitcoin, various virtual assets have been actively traded through virtual asset services of virtual asset exchanges. Recently, security accidents have frequently occurred in virtual asset exchanges, so the government is obligated to obtain informationsecurity management system (ISMS) certification to strengthen information protection of virtual asset exchanges, and 56 additionalspecialized items have been established. In this paper, we compared the domain importance of ISMS and CryptoCurrency Security Standard(CCSS) which is a set of requirements for all information systems that make use of cryptocurrencies, and analyzed the results after mappingthem to gain insight into the characteristics of each certification system. Improvements for 4 items of High Level were derived by classifyingthe priorities for improvement items into 3 stages: High, Medium, and Low. These results can provide priority for virtual asset andinformation system security, support method and systematic decision-making on improvement of certified items, and contribute tovitalization of virtual asset transactions by enhancing the reliability and safety of virtual asset services
참고문헌 (34)
- S. Nakamoto, "A peer-to-peer electronic cash system", Decentralized Business Review, 21260~ (2008)
- 정용식, "블록체인 기반 가상화폐 거래의 보안 위험 및 대응방안", 한국정보전자통신기술학회 논문지, 11(1), pp.100~106 (2018), 한국정보전자통신기술학회
- "Cryptocurrency Exchange Hacks (Updated 2022 List)"[URL]
- Analysis of government audit issues, "Strategy and Finance Committee", National Policy Committee, ~, pp.Vol.4 (2020)
- K. Grobys, "When the blockchain does not block: On hackings and uncertainty in the cryptocurrency market", Quantitative Finance, 21(8), pp.1267~1279 (2021)
- L. König, "The risks of the blockchain a review on current vulnerabilities and attacks", Journal of Internet Services and Information Security, 10(3), pp.110~127 (2020)
- Y. Maleh, "Blockchain for cybersecurity and privacy: Architectures, challenges, and applications" (2020), CRC Press
- J. H. Lee, "Systematic approach to analyzing security and vulnerabilities of blockchain systems", pp.2019
- Positions and responses of major countries on cryptocurrency, In Capital Market Focus, "B. Y. Kim", Korea Capital Market Institute, ~, pp.Vol.25 (2017)
- R. Zhang, "Security and privacy on blockchain", ACM Computing Surveys (CSUR), 52(3), pp.1~34 (2019)
- N. Amiet, "Blockchain vulnerabilities in practice", Digital Threats: Research and Practice, 2(2), pp.1~7 (2021)
- A. Mense, "Security vulnerabilities in ethereum smart contracts", Proceedings of the 20th International Conference on Information Integration and Webbased Applications & Services, pp.375~380 (2018)
- H. Poston, "Mapping the OWASP top ten to blockchain", Procedia Computer Science, 177, pp.613~617 (2020)
- M. Al. Ketbi, "Establishing a security control framework for blockchain technology", Interdisciplinary Journal of Information, Knowledge, and Management, 16, pp.307~ (2021)
- J. Bucko, "Security and trust in cryptocurrencies", Central European Conference in Finance and Economics, pp.14~24 (2015)
- G. Bello, "Adapting financial technology standards to blockchain platforms", Proceedings of the 2019 ACM Southeast Conference, pp.109~116 (2019)
- T. Hardjono, "A contract service provider model for virtual assets", The Journal of FinTech, 1(2) (2022)
- V. Tumas, "VaVite:Verifiable information exchange for virtual asset service providers", 2020 Principles, Systems and Applications of IP Telecommunications (IPTComm), pp.1~8 (2020)
- T. Hardjono, "Privacy-preserving claims exchange networks for virtual asset service providers", 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.1~8 (2020)
- T. Hardjono, "Toward a publickey management framework for virtual assets and virtual asset service providers", The Journal of FinTech, 1(1) (2021)
- T. Hardjono, "Future directions for regulated private wallets and VASP trust infrastructures", 2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.1~3 (2021)
- T. Hardjono, "Attestation infrastructures for private wallets", arXiv preprint arXiv:2102.12473, ~ (2021)
- G. Soana, "Regulating cryptocurrencies checkpoints: Fighting a trench war with cavalry?", Economic Notes, 51(1) (2022)
- "All Cryptocurrencies"[URL]
- "Bitcoin"[URL]
- C. Decker, "Bitcoin transaction malleability and MtGox", European Symposium on Research in Computer Security, pp.313~326 (2014), Springer
- Y. Tsuchiya, "How cryptocurrency is laundered: Case study of Coincheck hacking incident", Forensic Science International: Reports, 4(100241) (2021)
- "Top Cryptocurrency Spot Exchanges"[URL]
- I. S. Choi, "A study on the regulation of risks associated with the use of virtual currencies", Ph.D, pp.2019
- "Introduction of the certification system"[URL]
- "Act on Promotion of Information and Communications Network Utilization and Information Protection"[URL]
- "Announcement of detailed inspection items for ISMS for virtual asset business"[URL]
- "Crpto Currency Security Standard"[URL]
- "ISO 31000:2018(en) Risk management — Guidelines"[URL]