국내 무기체계에 대한 RMF 적용 실 사례 연구
A Case Study on the Application of RMF to Domestic Weapon System
0
조회
0
다운로드
15
인용
0
참고문헌
키워드
초록
현대의 첨단 무기 체계는 과거와 달리 복잡하고 많은 구성품들이 결합되어 하나의 무기체계를 형성한다. 또한, 하드웨어가 주 구성이었던 과거와 달리 소프트웨어 비중이 매년 증가하고 있어 무기체계의 보안 보증 활동이 과거보다더 어려워지고 있다. 미국은 1960년대부터 자신들이 개발하는 무기체계의 보안을 보증하기 위해 연구를 진행해왔다. 이 연구 결과는 미국 내부 표준으로 만들어졌고 정기적으로 업데이트 되었으며 현재는 RMF로 적용되고 있다. 국내에서는 미국의 RMF를 기반으로 2010년경부터 연구 활동을 해왔다. 그러나 미국 내 RMF 적용 실 사례는 기밀로분류해 얻을 수 없고, 국내에서도 공식적인 적용사례는 없다. 본 논문에서는 지금까지 연구된 한국형 RMF 연구를활용하여 최근 개발된 실제 무기체계에 적용해 본다. 그리하여 RMF를 적용할 수 있는 상세 가이드라인을 제시한다.
Abstract
Unlike the past, modern high-tech weapons systems are complex and many components are combined to form a weaponssystem. In addition, unlike the past, where hardware was the main component, the proportion of software is increasing everyyear, making the security assurance activities of weapon systems more difficult than in the past. The United States has beenworking to ensure the security of the weapons systems they develop since the 1960s. The findings were made to USinternal standards, updated regularly, and are now being applied as RMF. In Korea, research activities have been conductedsince 2010 based on the RMF of the United States. However, actual RMF application cases in the United States cannot beclassified and obtained, and there are no official cases in Korea. In this paper, we apply Korean RMF research that hasbeen studied so far to apply to the recently developed real weapon system. Thus, detailed guidelines for applying the RMFare presented.
참고문헌 (22)
- "Ira n–U.S. RQ-170" (2019)[URL]
- "Network Hacking Cas es in Korea" (2019)[URL]
- "verified the weapon system S W security" (2019)[URL]
- Sungyong Cha, "Security Evaluation Framework for Military IoT Devices", Security and Communication Networks, 2018, pp.12~ (2018)
- "Risk Management Framework (RMF)for DoD Information Technology (IT)", DoDI 8510.01, ~ (2014)
- "Guide for Applying the Risk Managem ent Framework to Federal Information Systems", NIST SP 800-37 Rev.1, ~ (2010)
- "Weapon System Development and Ma nagement Manual", DAPA(Defense Acq uisition Program Administration), ~ (2018)
- Heejin Jang, "Security Weakness Identification Methodology for Weapon System Software", The Korean Institute of Information Scientists and Engineers, 2017(12), pp.149~151 (2017)
- Yongjun Lee, "Research on Improving Security of Software Coding Rule Guide, SCR-G", The Korean Institute of Information Scientists and Engineers, 2018(12), pp.462~464 (2018)
- "National Defense Work Instruction", Ministry of National Defense, No.2040, ~ (2017)
- "National Defense Cyber Security Instr uction", Ministry of National Defense No.1862, ~ (2015)
- Woncheol Lee, "A Study of Software Security of Embedded Weapon Software Development Lifecycle", The Korean Institute of Information Scientists and Engineers, 2016(12), pp.92~94 (2016)
- Yeonoh Jeong, "A Study about Develop ment Methodology for Ensure the Soft ware Security of Weapon System", The Korean Institute of Information Scienti sts and Engineers, 2018(6), pp.77~79 (2018)
- 이지섭, "무기체계의 사이버보안 시험평가체계 구축방안 연구", 정보보호학회논문지, 28(3), pp.765~774 (2018), 한국정보보호학회[DOI]
- "Guide for Mapping Types of Informati on and Information Systems to Securit y Categories", NIST SP 800-60 Rev.1, ~ (2008)
- "Security & Privacy Controls for Feder al Information Systems and Organizati ons", NIST SP 800-53 Rev.4, ~ (2013)
- "Security Categorization and Control S election For National Security Systems", CNSSI No. 1253, ~ (2014)
- "Cybersecurity Test and Evaluation Gu idebook", DoD, ~ (2018)
- "submarines look so slo w when sailing" (2019)[URL]
- "China develops underwater sub marine detection technology" (2019)[URL]
- "GPS jamming" (2019)[URL]
- "Hacking UK Trident" (2019)[URL]