웹 취약점 스코어링 기법의 advanced 모델 연구
A Study On Advanced Model of Web Vulnerability Scoring Technique
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
웹 취약점 분석은 기업이 웹 애플리케이션의 보안 문제점을 파악하고 개선하는데 도움을 주며 미래창조과학부는취약점 분석·평가 기준을 배포하여 이를 지원하고 있다. 그러나 기준에서 제시하는 방법으로는 취약 항목에 대한 구분은 가능하지만 취약점 항목의 위험을 분석하기에는 부족하여 효과적인 대응이 어렵다는 문제점이 있다. 본 연구에서는 국내외 취약점 스코어링 기법에 대해 분석하고 올바른 웹 취약점 분석 평가를 위한 스코어링 방법을 제시하고자 한다.
Abstract
Web application security problems are addressed by the web vulnerability analysis which in turn supports companies to understand those problems and to establish their own solutions. Ministry of Science, ICT and Future Planning (MSIP) has released its guidelines for analysis and assessment of the web vulnerability. Although it is possible to distinguish vulnerability items in a manner suggested in the MSIP’s guidelines, MSIP’s factors and criteria proposed in the guidelines are neither sufficient nor efficient in analyzing specific vulnerability entries’ risks. This study discusses analysis of the domestic and international Vulnerability Scoring system and proposes an appropriate evaluating method for web vulnerability analysis.
참고문헌 (15)
- Young-Tek Jo, "Study on Improving the information protection level by Integrated Evaluation Items(IEI)", The Korea Institute information and communications university, pp.54~ (2011)
- "Government hacked, 750000 of i-pin illegal issued by system hacking" (2015)[URL]
- Jin-Young Lee, "Taxonomy Comparison of CWE and 7PK vulnerabilities", Proceedings of KISS, 36, pp.26~ (2009)
- Dong-Jin Kim, "An Anaysis of Domestic and Foreign Security Vulnerability Management Systems based on a National Vulnerability Database", Internet and Information Security, 1(2), pp.140~145 (2010)
- 이재현, "OWASP 및 WASC 중심의 웹 애플리케이션 보안에 관한 고찰", 한국항행학회논문지, 15(3), pp.372~377 (2011), 한국항행학회
- 문재찬, "안전한 웹 애플리케이션 개발을 위한 취약점 분석 및 위협 완화", 한국컴퓨터정보학회논문지, 17(2), pp.127~137 (2012), 한국컴퓨터정보학회
- Jae-Chan Moon, "Selection and Ranking of Common Attack Patterns for Developing Secure Web Applications", Proceedings of KIISE, 39, pp.226~228 (2012)
- Sooho Lee, "Researching Information System Security Survey", pp.2013
- 안준선, "소프트웨어 보안약점의 중요도에 대한 정량 평가 기준 연구", 정보보호학회논문지, 22(6), pp.1407~1417 (2012), 한국정보보호학회
- Hee-gwan Noh, "A Study on the Improvement of the Vulnerability Management System in the Information and Communications Infrastructure(Vulnerability analysis and evaluation for Major Information and Communications Infrastructure)", Department of Information Security, pp.2012
- Vulnerability analysis and evaluation criteria for Major Information and Communications Infrastructure(Vulnerability analysis and evaluation calculation), "Ministry of Science, ICT and Future Planning", 1~5 (2013)
- "OWASP Risk Rating Methodology" (2015)[URL]
- Peter Mell, "A Complete Guide to the Common Vulnerability Scoring System Version 2. 0", CVSS, pp.2~23 (2007)
- "Common Weakness Scoring System" (2014)[URL]
- Kyoung-Ki Kim, "Research of improved CVSS vulnerability management in Financial ISAC", Department of Information Security, pp.2008