본문 바로가기
KERD
논문KCI 등재

PDR Matrix 관점에서의 국내 인터넷 뱅킹 Safeguard 필요성 분석 및 평가

Analysis and Evaluation of a Need of Safeguard in Korean’s Internet Banking Based on PDR Matrix

박창민|김휘강|허건일
한국지식정보기술학회 (Korea Knowledge Information Technology Society)|2016.04|한국지식정보기술학회 논문지 (Journal of Knowledge Information Technology and Systems)|제11권 제2호|pp. 119-154

1

조회

0

다운로드

0

인용

0

참고문헌

키워드

PDR matrixInternet banking safeguards
주제분류학제간연구

초록

인터넷 뱅킹 safeguard에 대한 자세한 안내 부족 및 강제적 사용으로 인해 사용자 불만이 나날이 높아져 가고 있다. 하지만 이러한 불만을 감수함에도 불구하고 대규모 전자금융사고가 끊임없이 발생함에 따라 safeguard 무용론에 대한 주장이 계속 제기되고 있다. 하지만 이것은 ActiveX로 인해 발생되는 불편함을 safeguard 사용에 관한 문제에 결부시킨 매우 잘못된 상황이다. 불편해서 불필요하다는 식이 아닌 각각의 인터넷 뱅킹 safeguard의 객관적인 성능과 상호간의 관계에 근거하여 그것의 필요성을 판단해야 한다. 이에 따라 본 논문에서는 PDR matrix 즉, Prevention, Detection, Response로 구분한 정보보호 라이프 사이클과 6개의 인터넷 뱅킹 위협(계정 도용, 공인 인증서 탈취, 악성코드 감염, 입력 값 변조, 입력 값 탈취, 피싱/파밍)을 기준으로 현존하는 국내 인터넷 뱅킹 safeguard의 필요성을 분석 및 평가하였다. 이를 통해 4개의 중복 영역과 2개의 부재 영역을 식별하였고 중복 영역의 경우 관련 성능 평가를 통해 각각의 필요성을 분석한 결과 계정 도용 및 입력 값 탈취의 P 영역의 그래픽 인증, 피싱/파밍의 P 영역의 피싱 방지 프로그램을 제외한 모든 safeguard가 반드시 필요함을 알 수 있었다. 그러나 해당 결과를 바탕으로 한 사용자 설문 조사를 통해 본 연구 결과와 사용자의 생각 사이에 간극이 존재함을 알 수 있었고 이를 좁히기 위하여 인터넷 뱅킹 위협 및 safeguard에 대한 구체적인 안내, 사용자의 눈높이에 맞춘 안내, safeguard에 대한 사용자의 최종적 선택권 제고 등 세 가지의 대응방안을 제시했다.

Abstract

Complaints among users have increased because of insufficient explanation about safeguard and forced use of safeguard. Someone has said that Internet banking safeguard(hereafter safeguard) is unnecessary because large-scale Internet banking fraud has happened continuously although financial companies have taken complaints among users lying down. But this is a misconception that people try to couple inconvenience caused by ActiveX with use of safeguard. We should judge necessity of respectively safeguard based on objective capacity and interrelation, as opposed to safeguard is unnecessary because of inconvenience. Therefore in this paper we analyzed and evaluated existing domestic safeguard’s necessity based on PDR matrix namely, information security lifecycle which is classified Prevention, Detection, Response and six of Internet banking threats(account theft, public certificate snatch, malware infection, input data modification, input data snatch, phishing/pharming). This made us identify four overlapped sections and two empty sections of safeguard and know that all safeguards are certainly necessary except graphic authentication in P section of account theft and phishing/pharming, phishing prevention program in P section of phishing/pharming in case of overlapped section by evaluating their capacity. But we recognized a gap between the findings of our research and user’s thought by surveying Internet banking users. So we proposed three ways to narrow the gap such as giving specific information regarding Internet banking threat and safeguard to user, giving information considered user’s level to user, guaranteeing user’s a choice regarding use of safeguard.

참고문헌 (106)

  1. C. A. Kim, "Change of the export regulation policy of the cryptographic product in United States", Information Society Development, 224(11-1), pp.44~47 (1999)
  2. "SEED" (2015)[URL]
  3. Korea Internet & Security Agency, "Internet 30th anniversary, 2012 Korea Internet White Paper", ~ (2014)
  4. J. K. Yoo., "Application of security technology for Internet banking compatibility", Payment and Information Technology, 41, pp.59~84 (2010)
  5. "Joint ministries concerned, Countermeasure for simplifying payment in e-commerce", ~ (2014)
  6. "Financial Services Commission, Action plan in 2015", ~ (2015)
  7. "National Assembly, Partial revision of Electronic Financial Transaction Act", ~ (2014)
  8. "Financial Services Commission, Notification 2015-3rd", ~ (2015)
  9. "Financial Services Commission, Notification 2015-7th", ~ (2015)
  10. "Ministry of Science, ICT and future planning, Countermeasure for improving use of ActiveX in private", ~ (2015)
  11. "MBrowser: Microsoft Edge and Internet Explorer 11" (2015)[URL]
  12. "The Final Countdown for NPAPI" (2014)[URL]
  13. "Danish Bankers Association" (2015)[URL]
  14. "Telecommunication Financial Fraud Prevention Council, Comprehensive countermeasure for preventing telecommunication financial fraud", ~ (2013)
  15. "Safe internetbanking.be" (2015)[URL]
  16. "Dutch Basnking Association" (2015)[URL]
  17. "Financial Fraud Auctoin UK, Fraud the facts 2015", ~ (2015)
  18. Bruce Schneier, "The process of security", ~ (2000)
  19. James LaPiedra, "The information security process - prevention, Detection and response", ~ (2001)
  20. CBSS, "A Resource guide for BANK EXECUTIVES", ~ (2014)
  21. 이상진, "인터넷 뱅킹 서비스 취약점 분석 및 보안대책", 융합보안 논문지, 7(2), pp.119~128 (2007), 한국융합보안학회
  22. S. Y. Kim, "E-banking fraud’s type and countermeasure", Payment and Information Technology, 38, pp.34~62 (2009)
  23. "Telecommunications Technology Association, Analysis and management of e-commerce service’s threat", ~ (2011)
  24. S. M. Lee., "Current status of e-commerce and classification of security threat in domestic", Review of The Korea Institute of Information Security & Cryptology, 21(7), pp.53~61 (2011)
  25. L. Peotta., "A formal classification of internet banking attacks and vulnerabilities", International Journal of Computer Science &Information Technology, 3(1) (2011)
  26. "ICT and Future Planning, We intend to increase information security industry in earnest as creative economy’s blue ocean" (2015)[URL]
  27. "Telecommunications Technology Association" (2015)[URL]
  28. "The Tolly Group" (2015)[URL]
  29. "National Software Testing Laboratories" (2015)[URL]
  30. "ICSA Labs" (2015)[URL]
  31. "NSS Labs" (2015)[URL]
  32. "RFC 2544 - Benchmarking Methodology for Network Interconnect Devices" (2015)[URL]
  33. "RFC 3511 - Benchmarking Methodology for Firewall Performance" (2015)[URL]
  34. "Performance Measurement Methodologies for Network Security Devices(TTAS_KO-12_0044)" (2015)[URL]
  35. H. S. Kim.‚, "On the security of internet banking in South Korea" (2010), Computing Science Group
  36. C. S. Weir., "Usable security : User preferences for authentication methods in eBanking and the effects of experience", Interacting with Computers, 22(3), pp.153~164 (2010)
  37. "Genise, and Pauline, Usability evaluation:methods and techniques: Version 2.0", ~ (2007)
  38. "KB Kookmin Bank’s Secrutiy Center" (2015)[URL]
  39. "Standard Chartered Bank’s security program installation" (2015)[URL]
  40. "Shinhan Bank’s Security Center" (2015)[URL]
  41. "KEB Bank’s Security Center" (2015)[URL]
  42. "Woori Bank’s Security Center" (2015)[URL]
  43. "Hana Bank’s Security Center" (2015)[URL]
  44. "Citibank’s Security Center" (2015)[URL]
  45. "Kyongnam Bank’s Security Center" (2015)[URL]
  46. "Kwangju Bank’s Security Center" (2015)[URL]
  47. "Daegu Bank’s Security Service" (2015)[URL]
  48. "Busan Bank’s Security Service" (2015)[URL]
  49. "JB Bank’s Security Center" (2015)[URL]
  50. "Jeju Bank’s Security Center" (2015)[URL]
  51. "Industrial Bank of Korea’s Security Center" (2015)[URL]
  52. "NH Bank’s Security Center" (2015)[URL]
  53. "Suhyup Bank’s Security Service" (2015)[URL]
  54. "National Forestry Cooperatives Federation’s Banking Security Center" (2015)[URL]
  55. "MG Community Credit Cooperatives’ PC Security Service" (2015)[URL]
  56. "National Credit Union Federation of Korea’s Additional Service" (2015)[URL]
  57. "KoreaPostBank" (2015)[URL]
  58. "AhnLab Online Security 2.0" (2015)[URL]
  59. "nProtect Netizen v5.5" (2015)[URL]
  60. "Raonsecure USIM Smart Authorization" (2015)[URL]
  61. "Wizvera Safehard" (2015)[URL]
  62. "Mirageworks’ public certification protection technology based Sandbox" (2015)[URL]
  63. "FlyHigh’s public certification storage technology based CPU" (2015)[URL]
  64. "OPEN WEB nFilter of NSHC" (2015)[URL]
  65. "GOTP of DigitalZone" (2015)[URL]
  66. "Dementor Web of Dementor" (2015)[URL]
  67. "TouchEn key of Raonsecure" (2015)[URL]
  68. "SecureKeyStroke of SoftCamp" (2015)[URL]
  69. "NaRu of Wizvera" (2015)[URL]
  70. "INISAFE Sandbox of INITECH" (2015)[URL]
  71. "iFDS of INTEREZEN" (2015)[URL]
  72. "nProtect SecuLogMaster of INCA In tern et" (2015)[URL]
  73. "Real IP of KTB Solution" (2015)[URL]
  74. "Microsoft Cryptographic Service Providers" (2016)[URL]
  75. "RSA Laboratories, PKCS #11:Cryptographic Token Interface Standard" (2016)[URL]
  76. "PC/SC Workgroup Specifications Overview" (2016)[URL]
  77. "The time is for Transaction Singing OTP in July" (2016)[URL]
  78. "Use the force Luuuk" (2014)[URL]
  79. "android.Bankosy: All ears on voice call-based 2FA" (2016)[URL]
  80. McAfee, "McAfee Labs Threat Advisory -PWS-Zbot", ~ (2014)
  81. "Virtual keyboard is bypassed RCS in 31 of 35 financial corporations" (2015)[URL]
  82. "The attacker stole 26million won from victim’s account by applying call forwarding" (2015)[URL]
  83. "SMS authorization code is abused in smishing" (2014)[URL]
  84. "Bank’s public certification must be stored in HSM" (2015)[URL]
  85. Y. G. Jung, "Recent trend and improvement of OTP authorization technology", Payment and Information Technology, 61, pp.30~69 (2015)
  86. A. Rosenan, "Protecting our keystrokes", THE ISSA(Information Systems Security Association) JOURNAL (2006)
  87. M. Seese, "Beating a keystroke logger on a public PC", THE ISSA(Information Systems Security Association)JOURNAL (2008)
  88. "AhnLab, White paper - AhnLab online security white paper ver. 1.0.1", ~ (2008)
  89. "The finishing up of pharming technique for stealing financial information" (2015)[URL]
  90. "Kind and price of SSL Certification" (2016)[URL]
  91. "FIDO Alliance" (2016)[URL]
  92. "Combination public certification based PKI and biometric" (2015)[URL]
  93. "Financial Services Commission, Regular press conference related financial reform", ~ (2015)
  94. G. Lindsey., "Willingness to pay for urban greenway projects", Journal of the American Planning Association, 65(3), pp.297~313 (1999)
  95. "Online Banking Security from Bank of America" (2016)[URL]
  96. "Easy version of privacy policy" (2016)[URL]
  97. "Infographic of privacy policy" (2016)[URL]
  98. Frontier Economics, "Reducing violence and aggression in A&E: Through a better experience", ~ (2013)
  99. "BNP PARIBAS Global Markets" (2016)[URL]
  100. "Markit Hub" (2016)[URL]
  101. "Shinhan Bank’s Digital Kiosk" (2016)[URL]
  102. "Industrial Bank of Korea’s Security Center Weekly Hot News" (2016)[URL]
  103. "Introduction to Institution of Smart OTP and Fingerprint Authorization Service" (2016)[URL]
  104. "Chip Guard OTP Display Card" (2016)[URL]
  105. "Woori Bank’s one touch remote control" (2016)[URL]
  106. "Digital Hyundai Card" (2016)[URL]

관련 논문AI추천

인터넷은행을 위한 개선된 본인확인 구조이경호, 홍기석한국정보보호학회 · 정보보호학회논문지2015 · 제25권 제6호전자금융기반시설 정보보호 수준강화 방안 (정보보호 관리수준 분석을 통한)박근덕, 염흥열한국정보보호학회 · 정보보호학회논문지2016 · 제26권 제6호전자금융사기 위험 분석과 대응방안에 관한 연구김기범, 이상진, 정대용한국정보보호학회 · 정보보호학회논문지2017 · 제27권 제1호OTP를 이용한 인터넷뱅킹 시스템의 다중 채널 인증 기법박재표, 윤승구(사)디지털산업정보학회 · (사)디지털산업정보학회 논문지2010 · 제6권 제4호이용 PC 지정에 대한 보안위협 및 보안 요구사항 분석이경률, 이선영, 임강빈한국컴퓨터정보학회 · 한국컴퓨터정보학회논문지2017 · 제22권 제5호인터넷뱅킹에서의 상호인증에 관한 연구안정희, 이영교(사)디지털산업정보학회 · (사)디지털산업정보학회 논문지2014 · 제10권 제3호

이 간행물의 다른 논문 (10건)

Anti-Metal RFID 태그를 이용한 상수도 시설물 모니터링 시스템에 관한 연구홍인식, 강병모, 전병찬pp. 73-85자성유전체 시트를 이용한 휴대폰 안테나 방사 성능 개선김용진pp. 87-93스마트폰과 RTP를 활용한 유아 교육 및 감정 교감 서비스조영일, 이광연, 이상정, 전병찬pp. 95-106클라우드 기반의 전국 지방의료원 원격진료 클러스터 구축에 대비한 보안 모델 설계안창호, 박재흥, 백현철, 김상복pp. 107-118포괄적 마지막 수준 캐시를 위한 바이패싱 기법조영일, 이상정pp. 155-162
원문 보기