스팸메일 모의훈련 현장실험을 통한 기업의 인적 취약요인 연구
A Study on Human Vulnerability Factors of Companies : Through Spam Mail Simulation Training Experiments
0
조회
0
다운로드
8
인용
0
참고문헌
키워드
초록
최근 랜섬웨어, 스피어 피싱, APT공격 등 전자메일을 통한 다양한 수법의 사이버 위협이 커지고 있다. 이러한 공격의 특징은 과거 패턴기반탐지 등의 기술적 대책을 우회하기 때문에 개인의 보안인식 개선을 통한 관리적 대응이 중요하다는 점이다. 본 연구는 현장실험을 통해 이러한 스팸메일 공격에 취약한 임직원들의 인적요인을 연구하고 향후개선방안을 수립하고자 하였다. 한 기업의 임직원을 대상으로 7차례에 걸쳐 훈련용 스팸메일을 발송하고 열람정보를분석한 결과 훈련의 횟수와 수신자의 성별, 나이, 근무지 등의 인적요인이 열람율과 관계가 있음을 확인하였다. 이러한 분석 결과를 바탕으로 훈련개선 방안을 도출하여, 향후 각 기관의 실효성 있는 모의훈련 수행과 인식개선을 통한대응능력 향상에 도움이 되고자 한다.
Abstract
Recently, various cyber threats such as Ransomware and APT attack are increasing by e-mail. The characteristic of suchan attack is that it is important to take administrative measures by improving personal perception of security because itbypasses technological measures such as past pattern-based detection The purpose of this study is to investigate the humanfactors of employees who are vulnerable to spam mail attacks through field experiments and to establish future improvementplans. As a result of sending 7times spam mails to employees of a company and analyzing training report, It was confirmedthat factors such as the number of training and the recipient 's gender, age, and workplace were related to the reading rate. Based on the results of this analysis, we suggest ways to improve the training and to improve the ability of eachorganization to carry out effective simulation training and improve the ability to respond to spam mail by awarenessimprovement.
참고문헌 (19)
- NIS, government, "National Information security white paper" (2018)
- Cyber Security Issue Report 1Q, "KISA", ~ (2019)
- Korea Communications Commission, "Information Networking Guide for Anti-Spam Protection", ~ (2015)
- Lee doyeon, "The Effect of Punishment and Training on Information Security Policy Compliance Behavior: The Empirical Analysis through Field Experiments", master, pp.2017
- "understanding email fraud" (2018)[URL]
- "How to avoid persistent spear phishing!" (2013)[URL]
- "The beginning of APT attack Knowing Spear Phishing" (2013)[URL]
- NIS, "National Information Security Basic Guidelines", ~ (2018)
- Moon gunwoong, "Relationship between information security activities of enterprise and infringe : the center of effects of information security awareness", master, pp.2017
- Burcu Bulgurcu, "Information security policy compliance : an empirical study of rationality-based beliefs and information security awareness", MIS Quarterly, 34(3), pp.523~548 (2010)
- Lim chaeho, "Effective information protection awareness plan", Journal of Information Security, 16(2), pp.30~36 (2006)
- 손유승, "스피어 피싱 대응을 위한 관리적 보안대책에 의한 접근", 한국정보통신학회논문지, 17(12), pp.2753~2762 (2013), 한국정보통신학회[DOI]
- 윤덕상, "지속적 실전형 모의훈련을 통한 피싱공격 대응역량 및 행동변화에 관한 연구", 정보보호학회논문지, 27(2), pp.267~279 (2017), 한국정보보호학회[DOI]
- Phishing in an Academic Community: A Study of User Susceptibility and Behavior, "Alejandra Diaz", cornel univ, ~ (2018)
- S. Sheng, "Who Falls for Phish? A Demographic Analysis of Phishing Susceptibility and Effectiveness of Interventions", Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp.373~382 (2010)
- Jamshaid G. Mohebzada, "Phishing in a university community: Two large scale phishing experiments", 2012 International Conference on Innovations in Information Technology (IIT) (2012)
- Arun Vishwanath, "Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model", Decision Support Systems archive, 51(3), pp.576~586 (2011)
- Tom N. Jagatic, "social phishing", Communications of the ACM, 50(10), pp.94~100 (2007)
- Jingguo Wang, "Phishing Susceptibility: An Investigation Into the Processing of a Targeted Spear Phishing Email", IEEE Transactions on Professional Communication, 55(4), pp.345~362 (2012)