사이버보안 기술적 대응 직무 역량 프레임워크 제안 및 적용 모델 구현 사례
A Proposal of Cybersecurity Technical Response Job Competency Framework and its Applicable Model Implementation
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
해킹, 말웨어, 자료 유출 및 도난 등의 사이버 위협은 생활 및 경제, 국가 안보의 중요한 문제가 될 정도로 일상과 밀접한 상황에 직면하고 있다. 국가ㆍ산업 차원의 안보 및 경제적 관점에서 사이버 위협 대응은 필수적인 방어책으로 인식하고 있으나, 사이버보안 분야에서의 산ㆍ학 기술격차 및 전문인력 부족 문제는 매우 심각한 상황이다. 본논문에서는 이를 극복하는 방법으로 사이버보안 인력의 직무 역량 개념을 도입하여 사이버보안 기술적 대응 직무 역량(CtrJC) 프레임워크를 제안하고, 국가 및 조직 차원에서 시급히 요구되는 실시간 사이버 위협 대응 기술적 직무역량(CtrJC-R) 모델을 구현하여 그 타당성을 확인한다.
Abstract
We are facing the situation where cyber threats such as hacking, malware, data leakage, and theft, become an important issue in the perspective of personal daily life, business, and national security. Although various efforts are being made to response to the cyber threats in the national and industrial sectors, the problems such as the industry-academia skill-gap,shortage of cybersecurity professionals are still serious. Thus, in order to overcome the skill-gap and shortage problems, we propose a Cybersecurity technical response Job Competency(CtrJC) framework by adopting the concept of cybersecurity personnel's job competency. As a sample use-case study, we implement the CtrJC against to personals who are charged in realtime cybersecurity response, which is an important job at the national and organization level, and verify the our framework’s effects. We implement a sample model, which is a CtrJC against to realtime cyber threats (We call it asCtrJC-R), and study the verification and validation of the implemented model.
참고문헌 (27)
- "Strategies for building and growing strong cyber security teams:(ISC)2 Cybersecurity Workforce Study" (2019)[URL]
- National Initiative for Cybersecurity Education (NICE)Cybersecurity Workforce Framework, "NIST", ~, pp.SP 800-181 (2017)
- "cyberseek" (2020)[URL]
- Cybersecurity Skills Development in the EU, "ENISA", ~ (2019)
- 홍순좌, "미국 ATE 정책 기반의 신규 사이버보안 인력양성 정책 비교 프레임워크 연구", 정보보호학회논문지, 28(1), pp.249~267 (2018), 한국정보보호학회[DOI]
- Survey on Information Security, "Korea Information Security Industry Association", ~ (2020)
- Survey for Information Security Industry in Korea: Year 2019, "Korea Information Security Industry Association", ~ (2019)
- Risto Hansen, "Cyber security capability assessment", Master, pp.2016
- Beyond Cyber Threats: Europe’s First Information Risk Maturity Index, "PwC & Iron Mountain", ~ (2012)
- "Risk and responsibility in a hyperconnected world" (2014)[URL]
- "Cybersecurity Capacity Maturity Model for Nations (CMM) Revised Edition" (2016)[URL]
- Rafael Dean Brown J.D., "Towards a Qatar Cybersecurity Capability Maturity Model with a Legislative Framework", International Review of Law, 2018(4) (2019), Qatar University[DOI]
- "Cybersecurity Capability Maturity Model (C2M2) Program"[URL]
- "Cybersecurity Framework Version 1.1"[URL]
- Framework for Improving Critical Infrastructure Cybersecurity Version 1.1, "NIST", ~ (2018)
- H. S Venter, "A taxonomy for information security technologies", Computers & Security, 22(4), pp.299~307 (2003)
- "Cybersecurity Taxonomy"[URL]
- David Klaper, "A taxonomy and a knowledge portal for cybersecurity", Proceedings of the 15th Annual International Conference on Digital Government Research, pp.79~85 (2014)
- "Taxonomy of Security Products, Systems and Services, Deliverable 1.2 CRISP project" (2014)[URL]
- "A Proposal for a European Cybersecurity Taxonomy" (2019)[URL]
- Kyoo-wang Kyeong, "A Study on the Performance-based job Analysis Method based on NCS", Doctor, pp.2018
- Lee, Min Kyung, "A Study on Improvement of Project Competency for Small IT Companise through SWOT-AHP Analysis", Master, pp.2018
- Mansour Javidan, "Core competence: What does it mean in practice?", Long Range Planning, 31(1), pp.60~71 (1998), Elsevier BV[DOI]
- 최영한, "사이버위기 경보 기반 사이버 방어 훈련장 설계 및 구축 연구", 정보보호학회논문지, 30(5), pp.805~821 (2020), 한국정보보호학회[DOI]
- "Locked Shields"[URL]