무기체계 개발을 위한 한국형 국방 RMF 구축 방안 연구
A Study on Constructing a RMF Optimized for Korean National Defense for Weapon System Development
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
외부와 연결되지 않고 독립적으로 운용되던 무기체계에 최근 네트워크 통신, 센서와 같은 다양한 정보기술이 접목되기 시작하였다. 이는 무기체계 운용자 및 지휘관의 신속하고 정확한 결심과 효과적인 무기체계 운용을 가능하게 한다. 하지만, 무기체계의 사이버 영역 활용이 증가함에 따라 사이버 공격에 의한 피해도 증가할 것으로 예상된다. 안전한 무기체계를 개발하기 위해서는 소프트웨어 개발 단계 중 요구사항 도출 단계에서부터 보안적 요소를 고려하는 보안 내재화를 구현하는 것이 필요하다. 미 DoD는 ‘사이버보안(cybersecurity)’ 개념의 도입과 함께 무기체계 평가 및 획득 프로세스인 RMF A&A를 시행하고 있으며, 우리나라도 K-RMF 제도 시행을 위한 노력을 지속하고 있다. 하지만, 아직까지 개발 단계에서부터 K-RMF를 적용한 사례는 존재하지 않을뿐더러 미국의 국방 RMF 관련한 자료는 기밀 사항이기에 대부분 공개되지 않는다. 본 연구에서는 RMF와 관련하여 공개된 자료와 체계적인 위협 분석 방법을 바탕으로 우리나라의 국방용 RMF인 K-RMF를 예측하여 무기체계의 보안 통제항목을 구축하는 방안에 대해 제안하고, 함정 전투체계에 적용함으로써 그 효용성을 입증한다.
Abstract
Recently, various information technologies such as network communication and sensors have begun to be integrated into weapon systems that were previously operated in stand-alone. This helps the operators of the weapon system to make quick and accurate decisions, thereby allowing for effective operation of the weapon system. However, as the involvement of the cyber domain in weapon systems increases, it is expected that the potential for damage from cyber attacks will also increase. To develop a secure weapon system, it is necessary to implement built-in security, which helps considering security from the requirement stage of the software development process. The U.S. Department of Defense is implementing the Risk Management Framework Assessment and Authorization (RMF A&A) process, along with the introduction of the concept of cybersecurity, for the evaluation and acquisition of weapon systems. Similarly, South Korea is also continuously making efforts to implement the Korea Risk Management Framework (K-RMF). However, so far, there are no cases where K-RMF has been applied from the development stage, and most of the data and documents related to the U.S. RMF A&A are not disclosed for confidentiality reasons. In this study, we propose the method for inferring the composition of the K-RMF based on systematic threat analysis method and the publicly released documents and data related to RMF. Furthermore, we demonstrate the effectiveness of our inferring method by applying it to the naval battleship system.
참고문헌 (29)
- 이지섭, "무기체계의 사이버보안 시험평가체계 구축방안 연구", 정보보호학회논문지, 28(3), pp.765~774 (2018), 한국정보보호학회[DOI]
- Sung-yong Cha, "Study on methods to strengthen cybersecurity in the acquisition and operation of advanced weapon systems", 박사, pp.2019
- 권혁진, "상호운용성을 고려한 RMF 기반의 위험관리체계 적용 방향", 인터넷정보학회논문지, 22(6), pp.83~89 (2021), 한국인터넷정보학회
- DCSA, "Defense counterintelligence and security agency assessment and authorization process manual" (2020), DCSA
- The DoD, "The DoD cyber strategy" (2015), The Department of Defense
- 양우성, "국방획득체계 적용 한국형 보안위험관리 프레임워크", 정보보호학회논문지, 32(6), pp.1183~1192 (2022), 한국정보보호학회[DOI]
- Sung-yong Cha, "Security evaluation framework for military IoT devices", Security and communication networks, 2018 (2018)
- "ROK MND·JCS, Developing cybersecurity joint guidance with the USFK", Boan News, ~ (2023)
- Dawn Beyer, "Lockheed Martin Cyber Resiliency Level(CRL)Framework V3. 0 for Weapon, Mission, and Training Systems", Lockheed Martin Corporation (2020)
- Northrop Grumman, "Developing a framework to improve critical infrastructure cybersecurity" (2013), Northrop Grumman
- BAE Systems, "Epiphany datasheet" (2019), BAE systems, Inc.
- The boeing company, "Security Monitoring Infrastructure System Product Card" (2023), The boeing company
- MND, "Policy research information service&management" (2016)
- MND, "Policy research information service&management" (2017)
- 이승목, "국내 무기체계의 RMF 적용방안 연구: 무기체계 & 보안시스템 통합", 선진국방연구, 4(3), pp.191~208 (2021), 방위사업연구소[DOI]
- 조현석, "국내 무기체계에 대한 RMF 적용 실 사례 연구", 정보보호학회논문지, 29(6), pp.1463~1475 (2019), 한국정보보호학회[DOI]
- DAPA, "2022~2026 Defense industry technology protection masterplan" (2021), DAPA
- NIST, "Risk Management Framework for Information Systems and Organizations", NIST SP 800-37 Rev. 1, ~ (2014)
- DoD, "DoD program manager’s guidebook for integrating the cybersecurity management framework(RMF)into the system acquisition lifecycle", pp.70~71 (2015), Department of Defense
- Jaewon Seo, "Formally Verified Software Update Management System in Automotive", VehicleSec, 2023 (2023)
- Mina Deng, "A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements", Requirements Engineering Journal, 16(1), pp.3~32 (2011)
- Nataliya Shevchenko, "Threat modeling : a summary of available methods" (2018), Carnegie Mellon University Software Engineering Institute
- Adam Shostack, "Threat Modeling : Designing for Security", pp.624~ (2014), John Wiley & Sons
- Adam Shostack, "Experiences Threat Modeling at Microsoft", MODSEC@ MoDELS 2008, ~ (2008)
- NIST, "Risk Management Framework for Information Systems and Organizations", NIST SP 800-37 Rev. 2, ~ (2018)
- "DoD STIGs" (2023)[URL]
- KISA, "Guide on software development security" (2021), KISA
- KISA, "Guide on software vulnerability diagnosis" (2021), KISA
- KISA, "Detailed guide on analysis and assessment of technical vulnerability of major information and communication infrastructure" (2021), KISA