eGovFrame 보안 분석 및 대응 방안에 관한 연구
A Study on eGovFrame Security Analysis and Countermeasures
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
전자정부 표준 프레임워크는 국내 정부/공공기관 등 웹 환경 개발을 위한 공통 컴포넌트 재사용, 표준 모듈의 연계와종속성 해소 등 전반적인 기술을 제공하고 있다. 그러나, 획일화된 개발 환경은 코어 버전에 따른 구버전 업데이트 문제와 해킹이나 컴퓨터 바이러스 등에 의한 개인정보와 기밀정보 유출 가능성이 존재한다. 본 연구는 국내 eGovFrame을 운영하는웹사이트 중심으로 보안 취약성을 직접 분석한다. 내부 프로그래밍 언어 소스 코드 수준에서 취약점을 분석/분류한 결과, 대표 보안 취약성과 연계되는 5개 항목을 다시 추출할 수 있었다. 이에 대한 대응책으로, 2단계(1, 2차)를 통한 보안 설정과 기능 그리고 보안 정책을 설명한다. 본 연구는 향후 전자정부 프레임워크 보안 기능 개선하고 서비스 활성화에 이바지하고자 한다.
Abstract
The e-Government standard framework provides overall technologies such as reuse of common components for web environment development such as domestic government/public institutions, connection of standard modules, and resolution of dependencies. However, in a standardized development environment, there is a possibility of updating old versions according to core versions and leakage of personal and confidential information due to hacking or computer viruses. This study directly analyzes security vulnerabilities focusing on websites that operate eGovFrame in Korea. As a result of analyzing/classifying vulnerabilities at the internal programming language source code level, five items associated with representative security vulnerabilities could be extracted again. As a countermeasure against this, the security settings and functions through the 2 steps (1st and 2nd steps) and security policy will be explained. This study aims to improve the security function of the e-government framework and contribute to the vitalization of the service.
참고문헌 (29)
- "Introduction of the standard framework (applied cases –achievements)" (2022)[URL]
- "Download (Development Environment - Release Notes)" (2022)[URL]
- Canitano, G., "Development of framework for Attack", Defense Capture the Flag competition, Politecnico di Torino, 2022
- Shcherbakov, M., "Silent spring: Prototype pollution leads to remote code execution in node. js", USENIX Security Symposium 2023 (2023)
- "E-Government Standard Framework, ‘JAVA Only’ have to change" (2020)[URL]
- "Introduction of the standard framework (applied cases –technical support details)" (2022)[URL]
- "Spring Framework CVE® List" (2022)[URL]
- "Spring Java Framework Security Update Advisory" (2022)[URL]
- Mohamed, H. M., "Security Vulnerability Impact on Open Source:A Social Media Exploration", AMCIS 2022TREOS (2022)
- Bai, S., "Efficiently Weaponizing Vulnerabilities and Automating Vulnerability Hunting", pp.2022
- "Yangju City Hall -website" (2022)[URL]
- "Korea National University of Arts-website" (2022)[URL]
- "Hanam Urban Innovation Corporation -website" (2022)[URL]
- "Korea Credit Guarantee Fund" (2022)[URL]
- "Korea Tourism Information -E-learning" (2022)[URL]
- "Expanded to 11 types of private certifications on public sites...Added Hana Bank and Dream certifications" (2022)[URL]
- Ashouri, M., "Practical dynamic taint tracking for exploiting input sanitization error in java applications", Australasian Conference on Information Security and Privacy, pp.494~513 (2019), Springer
- Ponta, S. E., "Detection, assessment and mitigation of vulnerabilities in open source dependencies", Empirical Software Engineering, 25(5), pp.3175~3215 (2020)[DOI]
- 정병문, "스프링 서버 원격코드 실행 취약점(CVE-2018-1270)을 이용한 응용 공격 시나리오의 대응 방안", 한국전자통신학회 논문지, 14(2), pp.303~308 (2019), 한국전자통신학회[DOI]
- "Standard Framework Security Development Guide for E-Government SW Developers and Operators" (2020)[URL]
- "National Institute of Standards and Technology - CVE Record Metadata" (2020)[URL]
- "OWASP ZAP(OWASP Zed Attack Proxy)" (2022)[URL]
- "Burp Suite - Application Security Testing Software" (2022)[URL]
- "Nmap Security Scanner, Retrieved from" (2022)[URL]
- "SpiderLabs - ModSecurity" (2022)[URL]
- "Metasploit - Penetration Testing Software" (2022)[URL]
- "Personal Information Commission, major public institution website security check⋯ “See HTTPS applied”" (2021)[URL]
- "Guidelines for establishment and operation of information systems for administrative and public institutions" (2022)[URL]
- "Guidelines for Quality Management of E-Government Websites" (2021)[URL]