전자금융기반시설 취약점 분석·평가 점검기준의 합리적 개선방안
The Rational Improvement Plans of Inspection Standards on Vulnerability Analysis and Evaluation in Electronic Financial Infrastructure
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
금융회사는 전자금융거래의 안전성 및 신뢰성을 확보하기 위하여 전자금융기반시설에 대해 취약점 분석․평가를 실시하고 있다. 그러나 금융회사에서 전자금융기반시설 취약점 분석․평가 시 활용하는 금융분야 취약점 분석․평가 기준은 2012년도에 배포된 이후 업데이트되지 않았으며, 금융분야 정보공유․분석센터, 정보보호 전문서비스 기업 등 취약점 분석․평가 전문기관이 자체적으로 현행화 작업은 진행하고 있으나 표준화되어 있지 않아 금융회사에서 취약점 분석․평가 시 혼란을 야기하고 있다. 본 논문에서는 현행 전자금융기반시설 취약점 분석․평가 점검기준의 문제점에 대해 분석하고 금융회사 전자금융기반시설 특성에 맞는 합리적인 점검기준을 위한 방안과 정보보호관리체계 인증을 활용한 보완점을 제안하였다. 또한, 금융회사 자율보안체계에 따른 취약점 분석․평가 자체점검기준수립 사례를 제시하였다.
Abstract
To secure the safety and reliability of the electronic financial transactions, the financial company perform vulnerability analysis and evaluation on the electronic financial infrastructure. However, the financial sector vulnerability analysis and evaluation criteria that are used in the analysis and evaluation of electronic financial infrastructure vulnerabilities by financial companies have not been updated since its distribution in 2012, Although vulnerability analysis and evaluation agencies such as the financial information sharing and analysis center and the information security professional services company are updating their own vulnerability analysis and evaluation standards, since the standards are not standardized, financial companies are confused when performing vulnerability analysis and evaluation. n this paper, we analyze the problems of the existing analysis and evaluation criteria of the electronic financial infrastructure and propose a measure to establish a reasonable inspection standard in accordance with the characteristics of the financial institution's electronic financial infrastructure and suggest a supplementary point using the information security management system. In addition, We introduced example case of establishing the criteria of analyzing and evaluating the vulnerability according to the autonomous security system of the financial company
참고문헌 (16)
- "2017 National information security white paper, National Intelligence Service", National Intelligence Service, ~ (2017)
- Financial Services Commission, "Electronic financial transactions Act", ~ (2017)
- Ministry of Science and ICT, "Enforcement decree of the act on promotion of information and communications network utilization and information protection", Etc, ~ (2017)
- The Board of Audit and Inspection of Korea, "Information security and cyber safety management and supervision actual condition in financial sector", ~ (2014)
- I. S. Kim, "Electronic financial security theory", IT Forum (2015)
- 박근덕, "전자금융기반시설 정보보호 수준강화 방안 (정보보호 관리수준 분석을 통한)", 정보보호학회논문지, 26(6), pp.1605~1618 (2016), 한국정보보호학회[DOI]
- Financial Services Commission, "Enforcement decree of the electronic financial transactions Act", ~ (2017)
- Financial Services Commission, "Vulnerability analysis and measurement criteria in financial sector", ~ (2012)
- Ministry of Science and ICT, "Act on the protection of information and communications infrastructure", ~ (2017)
- Critical network infrastructure vulnerability analysis and measurement criteria, "Ministry of Science, ICT and Future Planning", Ministry of science, ICT and future planning, ~, pp.Ministry of science, ICT and future planning notice No. 2013-37 (2013)
- Financial Security Institute, "Status of issuance of information security management system certificate", ~ (2017)
- Financial Security Institute, "Inspection criteria of information security management system in financial sector", ~ (2017)
- Korea Internet & Security Agency, "2016ISMS certification status", ~ (2016)
- Korea Internet & Security Agency, "Information security management system certification system guide", ~ (2017)
- S. J. Park, "A study on the harmonization of public regulation and self-regulation for the constructing secure e-banking environment", pp.2016
- 2016 financial security institute annual report, , Financial Security Institute, ~ (2016)