미국 공급망 보안 관리 체계 분석
Analysis of U.S. Supply Chain Security Management System
0
조회
0
다운로드
7
인용
0
참고문헌
키워드
초록
정보통신기술의 비약적인 발전을 통하여 스마트 제조 시대가 도래하고 있다. 이에 따라 많은 기업은 제조공정의 효율적인 업무를 위해 다양한 하드웨어 및 소프트웨어를 활용하기 시작하였다. 이때 사용되는 하드웨어 및 소프트웨어들은 제조․유통 과정을 거쳐 공급되는데, 이러한 공급 과정에서 각종 보안 위협에 노출되고 있다. 최근 공급망 공격사례가 증가함에 따라 국외에서는 공급망 관리 체계를 정립하여 공급망 위험을 관리하고 있다. 이에 반해 국내는 일부 분야에 대한 공급망 위험 관리 연구가 진행되었다. 본 논문에서는 공급망 공격 사례를 통하여 공급망 위험 관리의필요성을 강조하고, 국외 공급망 관리 체계의 동향을 분석하여 국내의 공급망 보안전략 방안의 필요성을 설명한다.
Abstract
An era of smart manufacturing is coming through the rapid development of information and communication technology. As a result, many companies have begun to utilize a variety of hardware and software for the efficient business of themanufacturing process. At this time, the hardware and software used are supplied through manufacturing and distributionprocesses. These supply processes are exposed to a variety of security threats. As the recent cases of supply chain attackshave increased, foreign countries are establishing supply chain management systems and managing supply chain risks. InKorea, on the other hand, there was research on supply chain risk management in some fields. In this paper, we emphasizesthe necessity of supply chain risk management through supply chain attack cases. In addition, we analyze trends of foreignsupply chain management system and explains the necessity of domestic supply chain security strategy.
참고문헌 (29)
- Keun-Hee Han, "Smart Factory based convergence security issue and solution", KISA REPORT, 08, pp.53~61 (2018)
- Cyber-treat Trends Report, "KISA", ~ (2018)
- National Institute of Standards and Technology, "Notional Supply Chain Risk Management Practices for Federal Information Systems", NIST IR 7622, ~ (2012)
- National Institute of Standards and Technology, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations", NIST SP 800-161, ~ (2015)
- National Law Information Center, "Additional Special Conditions for Network Equipment-Building and Operation Projects", Procurement Service Directive No.5538, ~ (2018)
- National Law Information Center, "ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION, ETC", Law No. 16021, ~ (2018)
- Dong-Won Kim, "Automotive-Software & Supply Chain Assurance", Review of KIISC, 25(1), pp.39~46 (2015)
- 김동원, "자동차 공급망 위험관리(A-SCRM) 방안 연구", 정보보호학회논문지, 25(4), pp.793~805 (2015), 한국정보보호학회[DOI]
- Soo-Min Lim, "Trends of Cyber Security Regulation of Digital Asset Supply Chain of International Nuclear Power Plants", Review of KIISC, 26(1), pp.54~60 (2016)
- Cyber-treat Trends Report, "KISA", ~ (2019)
- Internet Security Threat Report, "Symantec", ~ (2018)
- Internet Security Threat Report, "Symantec", ~ (2019)
- Nuclear Regulatory Commission, "Cyber Security Programs for Nuclear Facilities", NRC Regulatory Guide 5.71, ~ (2010)
- Nuclear Regulatory Commission, "Criteria for use of computers in safety systems of nuclear power plants Rev 3", NRC Regulatory Guide 1.152, ~ (2011)
- National Institute of Standards and Technology, "Security and Privacy Controls for Federal Information Systems and Organizations", NIST SP 800.53, ~ (2014)
- International Atomic Energy Agency, "Procurement Engineering and Supply Chain Guidelines in Support of Operation and Maintenance of Nuclear Power Plants", IAEA-TECDOC-919, ~ (1996)
- International Atomic Energy Agency, "Managing Suspect and CounterFeitItems in the Nuclear Industry", IAEA-TECDOC-1169, ~ (2000)
- "Petya malware" (2019)[URL]
- "NotPetya" (2019)[URL]
- "NetSarang" (2019)[URL]
- "ShadowPad" (2019)[URL]
- Smart Factory Security, "Kye-Geun Kim", 27~35, pp.2019 KISA REPORT, vol. 05 (2019)
- National Institute of Standards and Technology, "Standards for Security Categorization of Federal Information and Information Systems", FIPS 199, ~ (2004)
- National Institute of Standards and Technology, "Guide for Conducting Risk Assessments", NIST SP 800-30 Rev.1, ~ (2012)
- National Institute of Standards and Technology, "Guide for Applying the Risk Management Framework to Federal Information Systems", NIST SP 800-37 Rev.1, ~ (2010)
- National Institute of Standards and Technology, "Managing Information Security Risk", NIST SP 800-39, ~ (2011)
- "Supply Chain Risk Management" (2019)[URL]
- "ICT SCRM Task Force" (2019)[URL]
- U.S. Department of Homeland Security, "ICT Supply Chain Risk Management Task Force", ~ (2018)