본문 바로가기
KERD
논문KCI 등재

공공부문 보안취약점 감사 효율화 방안에 관한 연구

A Study on the Efficiency of Auditing for Security Vulnerabilities in the Public Sector

김현석
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2022.02|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제32권 제1호|pp. 109-122|DOI https://doi.org/10.13089/JKIISC.2022.32.1.109

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

Vulnerability AnalysisSecurity AuditAudit Model
주제분류컴퓨터학

초록

정보보안 활동의 목적은 해킹 등으로 인한 피해가 발생한 이후 그 원인을 찾아 후속 조치하는 것 뿐만 아니라 주기적인 보안 활동을 통해 제어시스템 등 중요 시스템의 해킹 피해 시 우려되는 대규모 물적·인적사고를 줄이는 데에 있다. 이에 각 기관에서는 관련 규정에 따른 보안감사모델을 활용하고 있지만 시간과 인력의 제약으로 인해 전사적 점검활동을 수행하는 것이 쉽지 않다. 본 논문에서는 최근 10년간 공공기관의 주요 취약점에 대해 분석해보고 국내외 보안감사를 위한 모델과 비교하여 효율적인 보안활동을 수행할 수 있는 보안감사모델을 제시하고자 한다

Abstract

The purpose of information security activities is to reduce large-scale material and human accidents that are concerned about hacking damage to important systems, such as control systems, through periodic preventive activities in addition to finding the cause and taking follow-up measures after damage caused by hacking. For this reason, although each institution is using a security work audit model in accordance with the relevant regulations, it is not easy to conduct company-wide inspection activities due to the constraints of manpower and time. Therefore, in this paper, we will analyze the major vulnerabilities of public institutions over the past 10 years and present a security audit model that can perform efficient security activities compared to the models for domestic and foreign security audits.

참고문헌 (43)

  1. GAO, "Federal Information System Controls Audit Manuals(GAO-090232G)", ~ (2009)
  2. INTOSAI WGITA-IDI, "Handbook on IT Audit for Supreme Audit Institution, Appendix VII", 107~115 (2014)
  3. "ISO/IEC 27001"[URL]
  5. Financial Supervisory Service, "IT Audit Manual", 474~497 (2019)
  6. Ministry of Science and ICT, "Detailed Guide to Analysis and Evaluation Methods for Technical Vulnerabilities in Major Information and Communication Infrastructure", ~ (2017)
  7. Board of Audit and Inspection, "Financial Supervision Act, including Financial Consumer Protection", 68~76 (2012)
  8. Actual status of social service e-voucher business selection (National Assembly audit), "Board of Audit and Inspection", 37~42 (2011)
  9. State of Crisis Management of National Core Infrastructure, "Board of Audit and Inspection", 102~105 (2012)
  10. Public Institutions Information Protection and Cyber Safety Management Status, "Board of Audit and Inspection", 26~98 (2012)
  11. Board of Audit and Inspection, "Financial Consumer Protection and Supervision”(local action completed)", ~ (2013)
  12. Board of Audit and Inspection, "Operation of diplomatic missions abroad and the implementation of major projects of the Ministry of Foreign Affairs", 105~109 (2014)
  13. Actual status of financial sector information protection and cyber safety management supervision, "Board of Audit and Inspection", 10~12 (2014)
  14. Financial Execution Management Status, "Board of Audit and Inspection", 46~50 (2014)
  15. Institutional operation audit by the Ministry of Safety and Public Administration, "Board of Audit and Inspection", 31~39 (2014)
  16. Actual Inspection and Supervision of Personal Information Leakage of Financial Companies, "Board of Audit and Inspection", 57~62 (2014)
  17. The status of handling civil complaints in the first half of the year, "Board of Audit and Inspection", 25~28 (2014)
  18. National Police Agency Operation Audit, "Board of Audit and Inspection", 55~58 (2015)
  19. The Current State of Management of Public Institutions that Support Electricity, "Board of Audit and Inspection", 32~34 (2015)
  20. Construction and Operation of the National Integrated Traffic Information System, "Board of Audit and Inspection", 14~19 (2016)
  21. Local Office of Education Financial Management(5)(Ministry of Education, Seoul Office of Education), "Board of Audit and Inspection", 61~65 (2015)
  22. National Cyber Safety Management Status, "Board of Audit and Inspection", 140~146 (2016)
  23. Main informatization business contract business promotion status, "Board of Audit and Inspection", 41~52 (2016)
  24. Public Safety Threat Factor Response Management(Airport Safety and Firearms and Explosives), "Board of Audit and Inspection", 46~47 (2016)
  25. Board of Audit and Inspection, "Checking the capability to respond to cyber breaches of major information and communication infrastructure(Secret)", ~ (2016)
  26. National Tax Information System Utilization and Security Status, "Board of Audit and Inspection", 31~32 (2017)
  27. Board of Audit and Inspection, "Construction and Utilization of National Geospatial Data", 159~ (2017)
  28. Board of Audit and Inspection, "Educational Information System Establishment and Operation Status(local action completed)", ~ (2017)
  29. Board of Audit and Inspection, "Unauthorized reading and leakage of electronic medical records at Seoul National University Hospital", 24~34 (2017)
  30. Construction and Utilization of Information System for Land and Environment, "Board of Audit and Inspection", 58~69 (2017)
  31. Status of National Public Official Personnel Management and Management, "Board of Audit and Inspection", 68~73 (2017)
  32. Board of Audit and Inspection, "Construction and utilization of public data", 158~175 (2018)
  33. Public Teacher Appointment Exam Management Status, "Board of Audit and Inspection", 31~34 (2018)
  34. The Postal Business Management Status, "Board of Audit and Inspection", 53~65 (2018)
  35. Board of Audit and Inspection, "Inspection of allegations related to contract by the Korea Employment Information Service", 15~21 (2018)
  36. Management Status of Agricultural Product Price Stabilization Subsidy Support Project, "Board of Audit and Inspection", 25~28 (2019)
  37. Board of Audit and Inspection, "Regional Indigenous Corruption, etc. Startup Inspection Ⅲ", 32~42 (2019)
  38. Korea Foundation, Overseas Koreans Foundation Institutional Operation Audit, "Board of Audit and Inspection", 49~52 (2019)
  39. Board of Audit and Inspection, "Operation of diplomatic missions abroad and the headquarters of the Ministry of Foreign Affairs", 93~97 (2020)
  40. The Status of Settlement Support for North Korean Refugees, "Board of Audit and Inspection", 43~46 (2020)
  41. Pharmaceutical Safety Management Status, "Board of Audit and Inspection", 31~33 (2020)
  42. Board of Audit and Inspection, "Chungcheongnam-do Institutional Audit", 121~125 (2020)
  43. An Research on Efficient Audit Methodology for Information Security and Cyber Safety, "Board of Audit and Inspection", ~ (2021)

관련 논문AI추천

정보보호 수준평가 적정화 방안 연구김승주, 원동호, 이광우, 전웅렬, 정한재, 조혜숙, 허순행한국정보처리학회 · 정보처리학회논문지C2008 · 제15권 제3호PC보안 강화를 위한 기술적 취약점 진단항목 개선 연구조진근중소기업융합학회 · 융합정보논문지2019 · 제9권 제3호공공분야 정보시스템의 정보유출 위험요인 분석 모델에 관한 실증적 연구김제국한국IT정책경영학회 · 한국IT정책경영학회 논문지2015 · 제7권 제5호금융기관 공개용 홈페이지 취약점 분석평가에 대한 효율적인 대처방안김인석, 박현진한국정보보호학회 · 정보보호학회논문지2017 · 제27권 제4호취약점 데이터베이스 기반 개선된 보안관제 모델의 효과성 연구권태경, 현석우한국정보보호학회 · 정보보호학회논문지2019 · 제29권 제5호정보보호제품 평가 위한 취약점 분류체계 및 적용방안김일곤, 방기석, 이준석, 이지연, 최진영한국지식정보기술학회 · 한국지식정보기술학회 논문지2011 · 제6권 제5호

이 간행물의 다른 논문 (11건)

32-bit RISC-V 상에서의 사전 연산을 활용한 Fixslicing AES-CTR 속도 최적화 구현심민주, 서화정, 김현준, 엄시우, 송경주pp. 1-9Electron App의 메시지 획득 방안에 관한 연구: 협업 툴 잔디, 슬랙, 팀즈 중심으로김성수, 이성진pp. 11-23X-FDS : 게임 결제 로그 기반 XAI적용 이상 거래탐지 모델 연구김휘강, 이영헌pp. 25-38시퀀스 유사도 기반 무인 비행체 이상 탐지 시스템김휘강, 서강욱pp. 39-48감염병 예방을 위한 분산ID 기반 디지털 증명서 시스템박성채, 이주현, 염흥열, 박근덕pp. 49-66
원문 보기