기업의 상시 보안관리 체계 연구
A Study for Enterprise Type Realtime Information Security Management System
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
많은 기업에서 핵심 정보자산의 보호를 위해 보안관리 체계 강화 목적으로 ISO27001, 또는 K-ISMS 등 표준 보안관리 체계를 도입하여 일정부분 성과를 얻고 있으나 최근 IT 기술의 발전과 침해수법의 진화 등으로 위협요인이 기하급수적으로 증가하고 있어 기업은 보안관리 측면에서 보다 더 신속하고, 정확한 대응조치가 필요하게 되었다. 이를 위해보안관리 프로세스의 효율화, 핵심적 보안영역을 집중관리 할 수 있는 보안지표의 설정, 침해위험 영역을 사전 인지할수 있는 위험지수의 산출 등을 바탕으로 한 ’기업형 상시 보안관리 체계’를 연구하고, 전문가 집단의 의견을 조사하여AHP(Analytic Hierarchy Process)방법론으로 적절성을 분석하였다. 본 연구를 통해 기업의 보안담당자들은 보안관리 체계의 운영에 있어서 선제대응, 신속조치 등의 효율성을 향상시킬 수 있다.
Abstract
Many businesses have adopted the standard security management structure such as ISO27001 and K-ISMS for strengthening business's security management structure to protect their core information assets and have acquired partial output from such effort. However, many risk factors such as recent advances in Information Technology and evolution of intrusion methods have increased exponentially requiring the businesses to response even more quickly with better accuracy. For such purpose, a study of 'Real Time Security Management Structure for Business' based on security management process optimization, defining a set of security index for managing core security area and calculation of risk indices for precognition of intrusion risk area has been made. Also, a survey on opinions of an expert panel has been conducted. The effectiveness of studied structure was analyzed using AHP method as well. Using this study, security personnels of a company can improve efficiency of the preemptive responsive and quicker measure from the current security management structure.
참고문헌 (35)
- "Sony Sued Over PSN Data Bre ach, Failure to Disclose" (2011)[URL]
- "Have to lead the ‘Creative Security’ against industry" (2011)[URL]
- "ISO/IEC 27001:2013 Framework overview" (2017)[URL]
- "2017 ISMS certification system bri efing session" (2017)[URL]
- "Detail check list of ISMS certification" (2013)[URL]
- Haider Abbas, "Addressing dynamic issues in information security management", Information Management & Computer Security, 19, pp.4~ (2011)
- "Why ISO27001 is not enough?" (2009)[URL]
- 이희명, "기업의 정보보호수준 측정모델 개발에 관한 연구", 정보보호학회논문지, 18(5), pp.161~170 (2008), 한국정보보호학회
- A Study on the Effective Countermeasures for Preventing Computer Security Incident, "Shin-beom Kang", 71~82 (2012)
- Research of Information Security Management Model for Real-Time Security Level Measurement, "Sang-Eun Kwon", KAIST, 2~ (2013)
- A Study on an Improvement of Information Security Management System(ISMS)Scheme-Flexible Application of Control Items, "Yu-Chan Ko", Research Information Sharing Service(RISS), 42~ (2013)
- Kyung-Ho Lee, "Method and Apparatus for Measurement of Information-Security-Controlling Status", Patent No. 10-1616989-0000, 5~6 (2016)
- Internet Security Threat Report, "Symantec", 2~ (2016)
- "1 Billion PCs At Risk As Windo ws Error Reporting Sends Reports In Clea r(Original Title)" (2014)[URL]
- "Possibility of Anonymous FTP attack for Domestic NAS servers" (2013)[URL]
- "Exposure of domestic gas me asurement system information at Shodan" (2016)[URL]
- "The warning of Semiconductor hacking threats. Industries preparing co unteasure" (2014)[URL]
- "'Hacking suspicion' Chine se PC, Withdraw from British intelligenc e agency" (2013)[URL]
- "Documents Reveal Top NSA Hacking Unit" (2013)[URL]
- "The CISO Story of Euns ung Kang" (2014)[URL]
- Eun-Sung Kang, "The Information Security that CxOs have to know", Hanbit Media, ~ (2015)
- "Is the ISMS certification company safe from hacking?" (2013)[URL]
- "Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations" (2011)[URL]
- "The need of Total ISC M strategy for continuous security monit oring" (2016)[URL]
- "New SmartKPIs.com Report Ranks The Top IT Security KPIs of 2011- 2012" (2013)[URL]
- "Give up the unconditional trust about KPI" (2014)[URL]
- A Study on National Information Security Evaluation Indices and their Internationalization, "KISA", ~ (2006)
- Encryption action guide of the Privacy Informations, "KISA", ~ (2017)
- Yun-hyun Kim, "Main Issues and the weakness analysis of Internat Cookies", INTERNET &SECURITY FOCUS, pp.84~85 (2014)
- "Russia<Personal Informa tion Act>Amendment Law Enacted in Sep tember. -Russian personal information h ave to save at the domestic servers" (2015)[URL]
- "Europe approves new data prot ection law-European Parliament gives m assive support to stronger data protectio n rules" (2014)[URL]
- Juniper Networks, "The Economics of Defence", from RAND Corporation's “Defender’s Dilemma: Charting a Course Toward Cybersecurity", 9~ (2015)
- CONCERT, "Security Consumer Report-Information Security Performance Indicator", CONCERT Homepage, 4~6 (2013)
- KISA, "An Analysis of economic effectiveness on ISMS Certification", Internet &Security issue, 30~ (2010)
- 장상수, "정보보호 관리체계 운용이 정보보호 성과에 미치는 영향", 정보과학회논문지 : 정보통신, 40(1), pp.58~69 (2013), 한국정보과학회