ICT 공급망 보안기준 및 프레임워크 비교 분석
Comparative Analysis on ICT Supply Chain Security Standards and Framework
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
최근 ICT 기업은 제품과 서비스들을 직접 설계, 개발, 생산, 운용, 유지 보수, 폐기 등을 직접 수행하지 않고 이를 외부에 위탁하거나, 외주업체가 담당하는 경우가 많아지고 있다. 위탁과 재위탁되는 과정에서 제품 및 서비스에대한 취약점 관리 어려움 등으로 이로 인해 발생하는 공격 또한 증가하는 추세이다. 이에 대응하기 위해 해외에서는ICT 공급망 보안 위험관리를 위한 기준과 제도를 만들어 운영 중이며, 다양한 사례 연구를 진행하고 있다. 또한,SBOM(Software Bill of Materials)등 기술적으로 공급망 보안 문제를 해결하려는 연구도 진행하고 있다. ISO등 국제표준화기구에서도 ICT 공급망 보안을 위한 기준과 프레임워크도 만들어졌다. 본 논문에서는 미국, EU 등주요 국가와 국제표준으로 개발된 ICT 공급망 보안기준과 제도를 비교 분석하여 국내 실정에 적합한 ICT 공급망보안 관리 항목을 제시하고 ICT 공급망 보안제도 수립을 위한 사이버 보안 프레임워크의 필요성을 설명한다.
Abstract
Recently, ICT companies do not directly design, develop, produce, operate, maintain, and dispose of products and services, but are outsourced or outsourced companies are increasingly in charge. Attacks arising from this are also increasing due to difficulties in managing vulnerabilities for products and services in the process of consignment and re-consignment. In order to respond to this, standards and systems for security risk management of ICT supply chain are being established and operated overseas, and various case studies are being conducted. In addition, research is being conducted to solve supply chain security problems such as Software Bill of Materials (SBOM). International standardization organizations such as ISO have also established standards and frameworks for security of ICT supply chain. In this paper, we presents ICT supply chain security management items suitable for domestic situation by comparing and analyzing ICT supply chain security standards and systems developed as international standards with major countries such as the United States and EU, and explains the necessity of cyber security framework for establishing ICT supply chain security system.
참고문헌 (28)
- Cyber Threat Trend Report, "KISA", ~ (2018)
- 손효현, "미국 공급망 보안 관리 체계 분석", 정보보호학회논문지, 29(5), pp.1089~1097 (2019), 한국정보보호학회[DOI]
- 이응규, "ICT 공급망 공격 사례 연구", 정보화연구, 16(4), pp.383~396 (2019), 한국엔터프라이즈아키텍처학회[DOI]
- Supply Chain Attack Framew ork and Attack Patterns, "MITRE", ~ (2013)
- Supply Chain Attack Pattern :Framework and Catalog, "Office of the Under Secretary of Defense for Acquisition & Sustainment", ~ (2014)
- Supply Chain Attacks and Resiliency Mitigations, "MITRE", ~ (2017)
- Framework for Improving Critical Infrastructure Cybersecurity. version 1.0, "National Institute of Standards and Technology", ~ (2014)
- Framework for Improving Critical Infrastructure Cybersecurity. version 1.1, "National Institute of Standards and Technology", ~ (2018)
- National Institute of Standards and Technology, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations" (2015)
- Notional Supply Chain Risk Management Practices for Federal Information Systems, "National Institute of Standards and Technology", ~, pp.IR 7622 (2012)
- National Institute of Standards and Technology, "Managing Information Security Risk Organization, Mission, and Information System View" (2011)
- National Institute of Standards and Technology, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" (2020)
- National Institute of Standards and Technology, "Minimum Security Requirements for Federal Information and Information Systems" (2006)
- National Institute of Standards and Technology, "Security and Privacy Controls for Federal Information Systems and Organizations" (2013)
- National Institute of Standards and Technology, "Assessing Security Requirements for Controlled Unclassified Information" (2018)
- Overview of existing Cybersecurity standards and certification schemes v2, "European Cyber Security Organisation", ~ (2017)
- "International Standard, — Information security for supplier relationships —Part 1: Overview and concepts", ISO, 2014
- "International Standard, — Information security for supplier relationships —Part 2: Requirements", ISO, 2014
- "International Standard, — Information security for supplier relationships —Part 3: Guidelines for information and communication technology supply chain security", ISO, 2013
- "International Standard, — Information security for supplier relationships —Part 4: Guidelines for security of cloud services", ISO, 2016
- International Standard, "Information technology — (O-TTPS) — Mitigating maliciously tainted and counterfeit products — Part 1: Requirements and recommendations", ISO, 2018
- International Standard, "Information technology — Mitigating maliciously tainted and counterfeit products —Part 2: Assessment procedures for the O-TTPS and ISO", IEC 20243-1:2018, IEC 20243-2, pp.2018, ~
- DFA RS 252.204-7012 Defense Industrial Ba se Compliance Information, "Office of the Under Secretary of Defens e for Acquisition & Sustainment", ~ (2011)
- European Cyber Security Certification A Meta-Scheme Approach v1.0, "European Cyber Security Organisation", ~ (2017)
- National Institute of Standards and Technology, "Workshop Brief on Cyber SCRM Standards Mapping", ~
- National Institute of Standards and Technology, Workshop Brief on Cyber SCRM Standards Mapping(Draft), "National Institute of Standards and Technology", ~, pp.IR 8276 (2020)
- UK Cabinet Office, "Supplier Assurance Framework: Good Practice Guide", ~ (2018)