전자금융 소프트웨어 보안기술 수준평가 지표
A Security Technology Level Indicators for Electronic Financial Software
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
금융서비스에 IT기술을 결합한 핀테크 산업이 발전되고 있다. 본 논문에서는 전자금융 소프트웨어에 대한 기술 수준을 측정하기 위한 보안기술 수준평가 지표를 제시하였다. 지표는 공통평가기준분석, 컴플라이언스 분석, 기술수준평가방법 분석을 통해 개발되었다. 보안기술수준은 보안감사(15개),보안통신(4개), 암호지원(5개), 사용자 데이터보호(30개), 식별 및 인증(14개), 자원 활용(6개), 대상시스템접근(10개), 안전한 경로 및 채널(2개), 보안기능 관리 데이터보호(19개), 보안관리(13개)로 총 118개 기준으로 측정된다. 보안기술 평가지표를 금융유관기관에 적용해 본 결과 두 가지 장점을 확인하였다. 첫째, 전반적인 보안 영역을 대상으로 종합적으로 정량화된 평가 가능하며, 둘째, 해당 소프트웨어에 대한 법적 미준수 사항 파악이 용이하였다. 이 지표는 앞으로 핀테크 기술의 보안수준 진단체계구축을 위한 지표로 활용될 수 있다.
Abstract
Fintech industry combining existing financial service with IT technology, has beendeveloped. This paper was proposed criteria of technical level measurement for electronic financialsoftware. Indicators have been developed in the order of Common Criteria Analysis, ComplianceAnalysis, and Technical Levels Evaluation Analysis. The security technology level was proposed bythe compliance standard with a total of 118 articles such as Security Aduit (5 measurement arti-cles), Security Communication(4), Cryptologic Support(5), User Data Protection (30), Identificationand Authentication(14), Resource Utilization(6), Acess of Target System(10), Safe Path and Chan-nel(2), Protection of Security Function Management Data(19), Security Management(13). Byapplying proposed evaluation indicators into a financial company, it has confirmed two advan-tages. Firstly, quantitative assessment can be performed comprehensively to the overall securityrelated area. Secondly, it is easy to identify legal non-compliance to specific software. This indi-cators can be used for building security level diagnostic system in fintech area.
참고문헌 (34)
- Byeong Gyu Roh, "Common Criteria v3.1-based methodology and rating", Review of Korean Society for Internet Information, 9(3), pp.67~77 (2008)
- Daniel, M., "Common criteria based security requirements engineering process for development of secure information systems", Computer Standard & Interface, 29 (2006)
- Financial Security Institute, "Financial IT Security Compliance Reference Guide", ~ (2015)
- Financial Supervisory Service, "Electronic banking supervisory regulations", ~ (2015)
- Financial Supervisory Service, "Electronic Financial Transactions Ac", ~ (2015)
- Financial Supervisory Service, "IT examination manual", ~ (2014)
- Financial Supervisory Serviceh, "IT examination manual", ~ (2014)
- Gordon, T. J., "A Proposed Convention for Measuring the State of th Art of Products of Process", Technological Forecating and Social Change, 20, pp.1~26 (1981)
- Hayes, I., "Metrics for IT Outsourcing Level Management", Clarity Consulting, ~ (2001)
- Hea Suk Jo, "Common Criteria v2. 3 and v3. 1comparative analysis", REVIEW OF KIISC, 17(6), pp.9~19 (2007)
- Heyong Mok park, "A study on the process improvement for efficiency elevation of IT security products evaluation", pp.2004
- 이혜진, "공통평가기준 기반의 보안기능요구사항 도출을 위한 보호프로파일 재사용 방법", 석사, 소프트웨어공학전공, pp.2013
- "ISO", IEC 15408-1, “Infomation technology - Security techniques - Evaluation criteria for IT Security -Part 1 : Introduction and general model”, 2009
- "ISO", IEC 15408-2, “Infomation technology - Security techniques - Evaluation criteria for IT Security -Part 2 : Security functional componets”, 2009
- "ISO", IEC 15408-3, “Infomation technology - Security techniques - Evaluation criteria for IT Security -Part 3 : Security assurance componets”, 2009
- "ISO", IEC 18045, “Infomation technology - Security techniques - Methodology for IT Security evaluation”, 2009
- "ISO", IEC TR 15446, Infomation technology -Security techniques - Guide for the production of Protection Profiles and Security Targets, 2008
- 박진석, "CC에서의 소프트웨어 개발보안 활용에 대한 연구", 정보보호학회논문지, 24(1), pp.171~182 (2014), 한국정보보호학회[DOI]
- 원종혁, "융합 보안관제시스템 구축 활성화 연구", 정보기술아키텍처 연구, 12(4), pp.535~552 (2015), 한국엔터프라이즈아키텍처학회
- Ken Research, "Technology level Model Research", ~ (1976)
- Mark, S. M., "Computer security assurance using the common cirteria", Thomson, 2005
- Martino, J, "Technology Forecast for Decision Maring(3rd ed)", ~ (1993)
- Melvin, A., "Decision-Making using the Analytic Hierarchy Process(AHP)and SAS", IML, 2012
- Saaty, R. W., "The Analytic Hierarchy Process-what it is and how it is used", Pergamon Journal, 5 (1987)
- Sang Gee Kim, "On Analysis of the Characteristics and Indicatiors of Technology Level Evaluation", pp.2013
- Sang Ho Kim, "A study on IT security evaluation using process maturity model and security management system certification : focused on common criteria, SSE-CMM, BS 7799", pp.2005
- 김상호, "공통평가기준에 의한 보안정책모델 평가방법", 정보보호학회논문지, 13(5), pp.57~67 (2003), 한국정보보호학회
- Sang Ho Lee, "Application of common criteria for evaluation of information protection system", pp.2002
- Su Yeon Lee, "A study on CC for security assurance requirements : focused on domestic common criteria", pp.2012
- The Bank of Korea, "Usage report domestic Internet banking services", ~ (2014)
- Financial privacy and cyber security management practices audit report, "The Board of Audit and Inspection of Korea", ~ (2014)
- 강연희, "공통평가기준을 기반으로 한 보안평가관리 시스템의 개발", 한국전자거래학회지, 10(3), pp.67~83 (2005), 한국전자거래학회
- Young Tae Kim, "A Study on Compliance Evaluation Indicators of Corporate Information Security and Personal Data Protection, SSE-CMM, BS 7799", pp.2012
- 최영진, "클라우드 서비스 사용자 관점에서의 취약점과 보안관리체계", 정보기술아키텍처 연구, 9(4), pp.401~411 (2012), 한국엔터프라이즈아키텍처학회