의료기관 종별 웹 사이트 정보보안 관리 실태 연구
A Study on Information Security Management of Hospital Web Sites
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
In this paper, we evaluated web security vulnerability and privacy information management of hospital web sites which are registered at the Korea Hospital Association. Vulnerability Scanner (WVS) based on the OWASP Top 10 was used to evaluate the web security vulnerability of the web sites. And to evaluate the privacy information management, we used ten rules which were based on guidelines for protecting privacy information on web sites. From the results of the evaluation, we discovered tertiary hospitals had relatively excellent web security compared to other type of hospitals. But all the hospital types had not only high level vulnerabilities but also the other level of vulnerabilities. Additionally, 97% of the hospital web sites had a certain level of vulnerability, so a security inspection is needed to secure the web sites. We discovered a few SQL Injection and XSS vulnerabilities in the web sites of tertiary hospitals. However, these are very critical vulnerabilities, so all hospital types have to be inspected to protect their web sites against attacks from hacker. On the other hand, the inspection results of the tertiary hospitals for privacy information management had a better compliance rate than that of the other hospital types.
Abstract
In this paper, we evaluated web security vulnerability and privacy information management of hospital web sites which are registered at the Korea Hospital Association. Vulnerability Scanner (WVS) based on the OWASP Top 10 was used to evaluate the web security vulnerability of the web sites. And to evaluate the privacy information management, we used ten rules which were based on guidelines for protecting privacy information on web sites. From the results of the evaluation, we discovered tertiary hospitals had relatively excellent web security compared to other type of hospitals. But all the hospital types had not only high level vulnerabilities but also the other level of vulnerabilities. Additionally, 97% of the hospital web sites had a certain level of vulnerability, so a security inspection is needed to secure the web sites. We discovered a few SQL Injection and XSS vulnerabilities in the web sites of tertiary hospitals. However, these are very critical vulnerabilities, so all hospital types have to be inspected to protect their web sites against attacks from hacker. On the other hand, the inspection results of the tertiary hospitals for privacy information management had a better compliance rate than that of the other hospital types.
참고문헌 (18)
- MPIS, , Proceedings of Medical Center Privacy Information Security, pp.142~143 (2014)
- 전영주, "의료정보 유출의 문제점과 의료정보보호", 한국컴퓨터정보학회논문지, 17(12), pp.251~258 (2012), 한국컴퓨터정보학회
- HIMSS, "2012 HIMSS Analytics Report:Security of Patient Data", Kroll, 11~ (2012)
- E. S. Kang, "Information Security for CxO", pp.60~61 (2015), Hanbit media
- Now is the time for security at Application Level, "T. Lanowitz", Gartner Research, 3~7 (2005)
- G. H. Kim, "Implementation and Design of Proxy System for Web vulnerability Analysis", JKIECS, 9(9), pp.1011~1018 (2014)
- 신영기, "호텔기업의 홈페이지 보안취약성 평가 연구", 호텔경영학연구, 23(3), pp.123~143 (2014), 한국호텔외식관광경영학회
- 장희선, "Web Vulnerability Scanner를 이용한 취약성 분석", 융합보안 논문지, 12(4), pp.71~76 (2012), 한국융합보안학회
- "OWASP"[URL]
- 이재현, "OWASP 및 WASC 중심의 웹 애플리케이션 보안에 관한 고찰", 한국항행학회논문지, 15(3), pp.372~377 (2011), 한국항행학회
- Guidelines for Protecting Privacy Information in Web Sites, "MOPAS", Ministry of Public Administration and Security, 16~38 (2012)
- Chris Sanders, "Practical Packet Analysis:Using Wireshark to Solve Real-World Network Problems", pp.2~12 (2007), No Starch Press
- KISA, "User Guide for Safe Password 2010-22", pp.6~8 (2010), KISA
- Acunetix, "Web Vulnerability Scanner v. 9. 5Product Manual", pp.36~37 (2014), Acunetix
- Internet & Security Focus 2013, "Y. K. Seong", Korea Internet & Security Agency, 73~74 (2013)
- Guide for Diagnosing and Eliminating Web Vulnerabilities, "KISA", KISA, 13~32 (2013)
- 안선주, "의료기관의 정보보안 수준 측정을 위한 평가모형 개발", 병원경영학회지, 10(4), pp.98~112 (2005), 한국병원경영학회
- 전영주, "전자의무기록(EMR)의 활용과 환자정보보호", 보건의료산업학회지, 7(3), pp.213~224 (2013), 보건의료산업학회