선박용 Security Information Event Management (SIEM) 개발을 위한 보안 정책 모델에 관한 연구
Research on Security Detection Policy Model in the SIEM for Ship
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
According to International Association of Classification Societies (IACS) Unified Requirement (UR) E26, ships contracted for construction after July 1, 2024 should be designed, constructed, commissioned and operated taking into account of cyber security. In particular, ship network monitoring tools should be installed in accordance with requirement 4.3.1 in IACS UR E26. In this paper, we propose a Security Information and Event Management (SIEM) security policy model for ships as an effective threat detection method by analyzing the cyber security regulations and ship network status in the maritime domain. For this purpose, we derived the items managed in the SIEM from the maritime cyber security regulations such as those of International Maritime Organization (IMO) and IACS, and defined 14 detection policies considering the status of the ship network. We also presents the detection policy for non-expert crews to understand it, and occurrence conditions depending on the ship's network environment to minimize indiscriminate alarms. We expect that the results of this study will help improve the efficiency of ship SIEM to be installed in the future.
Abstract
According to International Association of Classification Societies (IACS) Unified Requirement (UR) E26, ships contracted for construction after July 1, 2024 should be designed, constructed, commissioned and operated taking into account of cyber security. In particular, ship network monitoring tools should be installed in accordance with requirement 4.3.1 in IACS UR E26. In this paper, we propose a Security Information and Event Management (SIEM) security policy model for ships as an effective threat detection method by analyzing the cyber security regulations and ship network status in the maritime domain. For this purpose, we derived the items managed in the SIEM from the maritime cyber security regulations such as those of International Maritime Organization (IMO) and IACS, and defined 14 detection policies considering the status of the ship network. We also presents the detection policy for non-expert crews to understand it, and occurrence conditions depending on the ship's network environment to minimize indiscriminate alarms. We expect that the results of this study will help improve the efficiency of ship SIEM to be installed in the future.
참고문헌 (17)
- Baltic International Maritime Conference, "The Guidelines on cyber security onboard ships edition 1", ~ (2016)
- Cha, B. R., "Trends of SOC & SIEM Technology for Cybersecurity", Smart media Journal, 6(4), pp.41~49 (2017)
- Gang, N. S., "Analysis of onboard ship cybersecurity", Journal of the Korean Society of Marine Engineering, 42(6), pp.463~471 (2018)
- "Rec 166 – Recommendation on Cyber Resilience" (2020)[URL]
- "unified- requirements E26 Cyber resilience of ships –Rev.1" (2022)[URL]
- "unified- requirements E27 cyber resilience of on-board systems and equipment-Rev.1" (2022)[URL]
- International Maritime Organization, "Maritime cyber risk management in safety management systems, resolution MSC.428(98)", 1~ (2017)
- International Maritime Organization, "Guidelines on maritime cyber risk management, MSC-FAL", Circ.3, pp.2022, 1~6
- Ko, K. J., "Application of integrated security control of artificial intelligence technology and improvement of cyber-threat response process", The Journal of the Korea Contents Association, 21, pp.59~66 (2021)
- Korea Maritime Institute, "IMO International Maritime Policy Trends", 3~ (2023)
- Lee, E.S, "A study on the development of a training course for ship cyber security officers", Journal of the Korean Society of Marine Environment & Safety, 26(7), pp.830~837 (2020)
- "Framework for improving critical infrastructure cybersecurity ver 1.1" (2018)[URL]
- Oil Companies International Marine Forum, "Tanker management and self assessment 3 – A Best Practice Guide", 2~ (2017)
- Oil Companies International Marine Forum, "SIRE-overview-factsheet", 1~2 (2018)
- Park, J. S., "The components of a cyber ship model", Bulletin of the Society of Naval Architects of Korea, 57(4), pp.7~13 (2020)
- Shibata J, "Journey towards cyber-resilience of ship", Maritime cyber security and resilience symposium (2023)
- "HD Hyundai Marine Solution to enter ship cyber security" (2024)[URL]