안전한 전자금융거래를 위한 보안등급 기준마련 및 사례연구
Establishing Security Level Standards and Case Studies for Safe Electronic Financial Transactions
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
2015년 6월 24일 금융위원회에서는 보안성심의를 전면 폐지하고, 자체 보안성심의로 보안 수준 점검 의무를 갈음한다고 하였다. 금융기관의 보안담당자는 안전한 전자금융거래를 위해 보안성 검토를 할 경우에 CIA 보안등급을기반으로 보안성심의를 수행하고 있다. 그러나 최근 인터넷,모바일 전자금융거래의 보안성 검토는 좀 더 깊이가 필요한 경우, 별도의 프로세스를 점검하거나 신기술, 보안 관련 자료를 참고하여 보안성심의를 수행하고 있다. 본 논문은 CIA 기반의 보안등급에 인증과 개인정보보호 지표를 추가한 CIAAP 보안등급을 제안하며 특히, 전자금융거래의 보안성 검토를 진행할 때 본 CIAAP 보안등급을 참고하여 개인정보보호 영역의 검토가 누락되지 않고,강화된 인증 관련 지표의 추가를 통한 보안성 검토가 필요함을 제안한다.
Abstract
On June 24, 2015, the Financial Services Commission (Financial Services Commission) completely abolished the securityreview process, and said that it would substitute self-security review obligations with self-security reviews. Security officials at financial institutions conduct security reviews based on CIA security grade when they conduct securityreviews for secure electronic financial transactions. However, the recent security review for Internet and mobile electronicfinancial transactions has carried out a security review, either by checking separate processes or by referring to newtechnologies and data related to security. This paper proposes the CIAAP security gradesl with the addition of certification and privacy protection indicators to theCIA based security grades, especially through the security review of electronic financial transactions.
참고문헌 (22)
- Korea Communications Commission, "Safety guidelines for electronic financial transaction authentication methods" (2010)
- Bank of Korea, "2017 Year the third quarter Domestic Internet banking service use status" (2017)
- Energy economy newspaper, "Card information theft crime rate is a three-fold increase in three years ... why?" (2015)
- Lim Yoon Hwa, "Status of fraudulent use of cards by type and future security challenges and responses" (2015)
- Financial Services Commission, "IT- Financial Fusion Support Plan", ~ (2015)
- "Certified certificate preferred"[URL]
- [URL]
- Financial Security Institute, "A Study on the New Technology for Certification of Electronic Finance" (2011)
- Chang-Jin Lee, "A study on security requirements for privacy in a home cloud environment", pp.2017
- Tae-Kyu Jung, "Security Requirements Analysis and Guidelines for Using Electronic Authentication", pp.2017
- "TTAK.KO-12.0244, Authentication Service Guideline for The Layered Risk Level in Online Transaction", TTA(Telecommunications Technology Association), 1~2 (2014)
- "TTAK.KO-12.0247, Requirements for E-authentication Method of Assurance Level", TTA(Telecommunications Technology Association), 1~13 (2014)
- "TTAK.KO-12.0248, Suitable Framewo rk for Entity Authentication Assurance in The Local Environment", TTA(Telecommunications Technology Association), 1~16 (2014)
- "TTAK.KO-12.0313, Authentication Assurance Levels Based on Trust Elevation Applicable to Financial Services", TTA(Telecommunications Technology Association), 7~9 (2017)
- "ITU-T X.1254, Entity authentication assurance framework", ~ (2013)
- Jae-Sik Lee, "A Design of Service Provider Model and Authentication Scheme for Secure Internet Banking", pp.2013
- 유한나, "인터넷 뱅킹 환경에서 사용자 인증 보안을 위한 Two-Channel 인증 방식", 한국통신학회논문지B, 36(8), pp.939~946 (2011), 한국통신학회
- "Financial Commission Notice, 2015-18", ~ (2015)
- Financial Security Agency, "Financial Company Self-Security Review Guide" (2016)
- 추연수, "온라인 서비스를 위한 보안성 평가 지표 모델", 한국통신학회논문지C, 39(4), pp.326~333 (2014), 한국통신학회
- Soo-Ho Lee, "Researching information system security survey", pp.2012
- "KISA Online Privacy Portal"[URL]