사이버 레질리언트 ICT 공급망 대책 개발에 관한 연구
A Study on Developing Cyber Resilient ICT Supply Chain Controls
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
산업, 행정 등 국가 전반의 디지털화로 ICT 공급망은 복잡해지고 있으며 이에 대한 의존도도 높아지고 있다. 그러나 ICT 공급망에 대한 제한된 가시성, 통제권으로 인해 기존의 정보보호의 관점으로는 ICT 공급망 위험을 관리하기 어려운 실정이다. 이를 타개하기 위해 최근 사이버 레질리언스가 ICT 공급망 위험관리를 위해 중요한 개념으로 부각되고 있으며, 사이버 레질리언스 관점에서 ICT 공급망 위험을 관리할 수 있는 대책을 마련하는 것은 중요하다. 그럼에도 불구하고, 현재 사이버 레질리언스 관점에서의 ICT 공급망 위험 관리에 대한 연구는 미흡한 실정이다. 따라서 본 연구에서는 사이버 레질리언스와 ICT 공급망 위험에 대한 이론적 고찰과 전문가 토의를 통해 총 20개의 사이버 레질리언스 관점의 ICT 공급망 대책을 개발하였다. 포커스 그룹 인터뷰를 통해 개발된 대책의 중요성과 실현 가능성을 평가하였다. 본 연구는 사이버 레질리언스 관점에서 ICT 공급망 위험을 관리함에 있어 유의미하고 유용한 대책을 도출하였다. 향후 사이버 레질리언스와 ICT 공급망 위험관리 관련 연구에 활용될 것으로 기대되며, 향후 객관화를 위한 정량적 분석과 구체적인 대책 구현 방안에 대한 연구를 제안한다.
Abstract
Due to the digital transformation, ICT supply chain is becoming more complex and dependent on it. Limited visibility and control over ICT Supply Chain make it difficult to manage ICT supply chain risk from the perspective of information security. In order to overcome this, Cyber Resilience has recently emerged as an important concept for ICT supply chain risk management, and it is important to come up with controls to manage ICT supply chain risk from the perspective of Cyber Resilience. Nevertheless, the current research on ICT supply chain risk management from a Cyber Resilience perspective is insufficient. In this study, the 20 controls for Cyber Resilient ICT Supply Chain were initially developed by the literature review and discussions with security specialists. Developed controls are reviewed with Focus Group Interview method to assess of materiality and feasibility. This study derived meaningful and useful controls to manage ICT supply chain risks from the perspective of Cyber Resilience. It is expected to be used for future Cyber Resilience and ICT supply chain risk management research. In order to objectify the results of this study, quantitative analysis is necessary in the future. In addition, future researches on specific measures to implement Cyber Resilient ICT Supply Chain controls is required.
참고문헌 (41)
- 김정환, "정보기술(ICT) 경쟁우위가 공급사슬통합에 미치는 영향", 한국항만경제학회지, 32(1), pp.151~163 (2016), 한국항만경제학회
- 국가 사이버안보 기본계획, "대한민국 정부", ~ (2019)
- 배재권, "인공지능과 빅데이터 분석 기반 통합보안관제시스템 구축방안에 관한 연구", 로고스경영연구, 18(1), pp.151~165 (2020), 한국로고스경영학회[DOI]
- 차인환, "정보보안에서의 인원보안 관리지표 개발을 위한 실증적 연구", 박사, 경영정보학, pp.2009
- Azad, M., "Towards a conceptual framework for resilience engineering", Systems Journal, 1(3), pp.181~191 (2009), IEEE
- Bank for International Settlements and International Organization of Securities Commission, "Guidance on cyber resilience for financial market infrastructures", ~ (2016)
- Björck, F., "Advances in intelligent systems and computing", pp.311~317 (2015), Springer
- "BS65000, Guidance on organizational resilience", ~ (2014)
- Cabrera, D., "What is the crisis? Defining and prioritizing the world's most pressing problems", Frontiers in Ecology and the Environment, 6(9), pp.469~475 (2008)
- Carnegie Mellon University, "CERT resilience management model. 1.2", ~ (2016)
- Department of Defense, "Cyber resilience and response", ~ (2018)
- ENISA, "Secure ICT procurement for secure electronic communications", ~ (2014)
- ENISA, "Supply chain integrity: An overview of the ICT supply chain risks and challenges, and vision for the way around", ~ (2015)
- Gartner, "Use six principles of resilience to address digital business risk and security", ~ (2015)
- Gartner, "Bimodal IT is having an impact on security governance", ~ (2017)
- Gartner, "Market guide for user and entity behavior analytics", ~ (2018)
- Glaser, J., "Experteninterviews und qualitative inhalts analyse: Als instrumente rekonstruierender untersuchungen" (2012), VS Verlag für Sozialwissenschaften
- GSA, "GSA IT Capital Planning and Investment Control(CPIC) policy guide", ~ (2007)
- Internet security threat report, "IBM", ~ (2019)
- "ISO", IEC 15288, Systems and software engineering-systems life cycle processes, 2008
- "ISO", IEC 22316, Security and resilience-organizational resilience-Principles and attributes, 2017
- "ISO", IEC 27036-1, Information technology-security techniques, information security for supplier relationships-Part 1: Overview and concepts, 2014
- "ISO", IEC 27036-2, Information technology-security techniques-information security in supplier relationships-Part2: Requirements, 2014
- "ISO", IEC 28001, Security management systems for the supply chain-best practices for implementing supply chain security, assessments and plans-requirements and guidance, 2007
- KPMG, "COVID-19: A guide to maintaining enterprise resilience", ~ (2020)
- 2019 global risk perception survey, "Marsh", ~ (2019)
- MITRE, "Supply chain attack framework and attack patterns", ~ (2013)
- MITRE, "Cyber resiliency design principles", ~ (2017)
- "NIST SP 800-161, Supply chain risk management practices for federal information systems and organizations", ~ (2015)
- "NIST SP 800-53, Security and privacy controls for federal information systems and organizations", ~ (2013)
- "NISTIR 7622, Notional supply chain risk management practices for federal information systems", ~ (2012)
- "NISTIR 8272, Impact analysis tool for interdependent cyber supply chain risks", ~ (2020)
- O-TTPS, "Mitigating maliciously tainted and counterfeit products", ~ (2018)
- Polit, D. F., "Nursing research: Generating and assessing evidence for nursing practice", pp.2012, Wolters Kluwer Health
- Sheffi, Y., "The power of resilience: How the best companies manage the unexpected" (2015), The MIT Press
- The White House, "Presidential policy directive-critical infrastructure security and resilience", ~ (2013)
- World Economic Forum, "Advancing cyber resilience principles tool", ~ (2017)
- "Information and Communications Technology(ICT) Supply Chain Risk Management(SCRM) task force" (2019)[URL]
- "Have you made it safe to fail?" (2020)[URL]
- "Supply chain security guidance" (2018)[URL]
- "Post-pandemic supply chain seek 'resilience', report says" (2020)[URL]