기술유출위협의 진화와 정보보호체계의 개선방안 연구: 공급망 보안관리를 중심으로
Improvement of Information Security Management Systems related to the Evolution of Information Leakage Threats: Focusing on Supply Chain Security Management
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
기술 역량의 확보가 국가의 앞날을 좌우하고 국가핵심기술유출의 위협 또한 증가하고 있는 상황에서 공급망을 중심으로 하는 새로운 위협이 증가하고 있다. 이에 따라 자체 보안을 강화하는 것만으로는 새로운 위협에 대응하기 어렵고 협력사 등 공급망 전반의 생태계 관점에서 개별 주체들의 보안을 강화할 수 있어야 하는 상황이다. 그럼에도 기존 정보보호체계와 관련 논의는 개별 기업에 대한 기준이나 사후 처벌을 강화하는 등의 접근에 그치고 있다. 이에 본 연구는 공급망 보안위협의 특징을 고려해 새로운 과제를 식별하고 선진국의 대응 사례를 분석함으로써 국내 환경에 적합한 법제도 및 생태계 내 당사자 중심의 정보보호체계 개선방안을 제안하였다. 국가 차원에서 공급망 전체의 보안을 관리하기도 어렵고 중소기업의 보안관리 문제를 대폭 개선하기도 어렵다는 점에서 시장에서 당사자 간의 합의에 따른 보안관리가 이루어져야 한다. 이를 위해서는 현행 공정거래 규제에 저촉되지 않도록 당사자 간 계약에 따른 보안점검이나 자료 요구, 컨설팅 등을 허용할 필요가 있다.
Abstract
As securing critical technological capabilities determines the future of a nation, new threats centered on the supply chain are on the rise. Therefore, it is necessary to strengthen the security of subjects from the perspective of the entire supply chain based ecosystem, including suppliers. However, the existing information security management system and related discussions are limited to approaches such as strengthening standards for individual companies and punishment. This study identifies new challenges, taking into account the characteristics of supply chain security threats, and analyses the response cases of advanced countries to propose ways to improve the information security management system in terms of legal system and market practices considering the domestic environment driven by large enterprises.
참고문헌 (39)
- "Last year, 23 cases of industrial technology were leaked overseas, ‘the most in five years’…Government strengthens punishment level" (2024)[URL]
- Hyun-Woo You, "A Study on Improvement Plans for Major Industrial Security Laws in the New Normal Era", Korean Journal of Industry Security, 12(1), pp.361~362 (2022)
- Yong-Jin Kim, "Protection of Industrial Technology by way of Access to Communication Records", Journal of Legislation Research, 49, pp.137~138 (2015)
- Jae-Tae Moon, "Discussion on the Direction of Supply Chain Stabilization Act", Korean Law Association, Law Review, 24(3), pp.28~29 (2024)
- Ji-Yeon Yoo, "A Study on the Establishment of a Management System for Reinforcing Supply Chain Security", Journal of The Korea Society of Information Technology Policy & Management, 13(2), pp.2358~ (2021)
- Mijung Kim, "Strategies for Activating ESG Practices in SMEs Based on Win-Win Cooperation between Large and Small-Medium Enterprises", ~ (2024)
- "What’s Behind the Increase in Data Breaches?" (2024)[URL]
- "2023 Unit 42Ransomware and Extortion Report" (2023)[URL]
- "10 Small Business Cyber Security Statistics That You Should Know – And How To Improve Them" (2021)[URL]
- Survey on the status of technology protection levels in SMEs 2023, "Ministry of SMEs and Startups", 344~ (2023)
- "National Intelligence Service urges semiconductor equipment industry to be cautious of North Korean hacking" (2024)[URL]
- CISA, "Defending Against Software Supply Chain Attacks", ~ (2021)
- "CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)" (2017)[URL]
- "2024 Global threat report" (2024)[URL]
- "Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers" (2020)[URL]
- "Government announces SW supply chain security guidelines 1.0" (2024)[URL]
- "Understanding the Okta supply chain attack of 2023:A comprehensive analysis" (2024)[URL]
- 2024 Cyber Threat Trend Report (First Half), "KISA", 5~ (2024)
- "TSMC Blames Data Breach On Attack Against System Integrator" (2023)[URL]
- "Cyberattack on Toyota’s supply chain shuts its 14 factories in Japan for 24 hours" (2022)[URL]
- "Prosecutor: “Nonghyup hacking is North Korean cyber terrorism”" (2011)[URL]
- "11 steps attackers took to crack Target" (2014)[URL]
- Hyungoo Shin, "Introduction of Security Certification System for Shared Growth and Co-prosperity of Small and Medium Businesses", Korea security science association, 61, pp.223~228 (2019)
- Ralf-Christian Härting, "The threat of industrial espionage for SME in the age of digitalization", Procedia Computer Science, 207, pp.2936~ (2022)
- "Launch of integrated technology protection support group for SMB" (2024)[URL]
- Tae Hi Hwang, "A legal analysis on abusing the trade position in MRFTA", Advanced Commercial Legal Research, 81, pp.65~83 (2018)
- Implications of recent ESG-related International lawsuits and Corporate risk management, "Taekyu Lee", KERI, 12~14 (2023)
- "Guidelines for supplier"[URL]
- FTC, "Policy Statement Regarding the Scope of Unfair Methods of Competition Under Section 5 of the Federal Trade Commission Act Commission File No. P221202", ~ (2022)
- FTC, "FTC Safeguards Rule: What Your Business Needs to Know", ~ (2022)
- Towards building partnerships with business partners to improve cybersecurity throughout the supply chain, "Ministry of Economy, Trade and Industry (METI), Japan Fair Trade Commission", 1~5 (2022)
- Ministry of Economy, Trade and Industry (METI), "Cybersecurity Management Guidelines for Japanese Enterprise Executives", ~ (2023)
- EU, "REGULATION (EU) 2019", 881OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, 2019, ~
- "Cybersecurity Certification Framework"[URL]
- European Commission, "Cyber Resilience Act", ~ (2022)
- "About CMMC"[URL]
- Youngin You, "A Study on the Supplementation of the Korea’s National Information Security Manual from the Perspective of Cyber Supply Chain Security", Journal of The Korea Institute of Information Security &Cryptology, 32(2), pp.325~326 (2022)
- Hyungoo Shin, "Introduction of Security Certification System for Shared Growth and Co-prosperity of Small and Medium Businesses", Journal of Korea security science association, 61, pp.223~228 (2019)
- "Election as an excellent H-ISMS company by Hyundai Motor Group" (2023)[URL]