국내 금융권 클라우드 보안 위협 및 보안 요구사항에 관한 연구
A Study on Cloud Security Threats and Security Requirementsin the Domestic Financial Sector
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
국내 금융권은 데이터 보안성을 강화하고 시스템 성능을 유지하며, 특정 클라우드 서비스 제공자(CSP)에 대한 종속을 방지하기 위해 하이브리드 멀티클라우드 전략을 채택하고 있다. 동시에, 애플리케이션의 현대화를 통해 서비스 제공의 신속성을 향상시키고, 빅테크 및 핀테크 기업과의 경쟁에서 우위를 점하기 위해 클라우드 네이티브화를 빠르게 추진하고 있다. 본 논문에서는 금융권의 클라우드 네이티브 하이브리드 멀티클라우드 환경을 대상으로 가능한 모든 보안 위협을 식별 및 분석하여 위협별 보안 요구사항을 도출한다. 이를 위해 먼저 주요 클라우드 보안 사고사례를 귀납적으로 분석하여 클라우드 사이버 공격 분류 모델을 구성하고, 해당 환경에 연관된 보안 위협을 식별하였다. 또한, STRIDE 위협 모델링 기법을 통해 예측 가능한 환경 전반의 위협을 식별하고, 공격 트리(Attack tree)를 구축하여 위협별 보안 요구사항을 도출하였다.
Abstract
The cloud usage environment in the domestic financial sector strategically operates hybrid multi-cloud to increase data security and secure system performance while preventing specific CSP lock-in. In addition, it is rapidly pushing for cloud nativization to increase the speed of service delivery and preoccupy market competition with Big Tech and FinTech as application modernization progresses. This article looks at the cloud-native hybrid multi-cloud environment in the financial sector, identifies and analyzes all possible threats and derives threat-specific security requirements. First of all, major cloud security accident cases were inductively analyzed for security threat analysis, and a cloud cyber attack classification model was established to identify security threats related to the environment. STRIDE threat modeling also identified threats across the most predictable possible environment and constructed an Attack Tree to derive threat-specific security requirements.
참고문헌 (20)
- Financial Services Commission approves amendment to the “Electronic Financial Supervision Regulations”to streamline cloud usage procedures and ease network separation regulations - Related to improvement measures for cloud and network separation regulations (`22.4.), , 2022
- D. Shin, "Trends and security of domestic financial sector cloud conversion", Review of KIISC, 33(5), pp.57~68 (2023)
- Microsoft, "Architecting cloud native .net apps for azure", ~ (2022)
- Cloud Service Incident Case Study Investigation Analysis Report, "Financial Security Institute", ~ (2022)
- 2022 IBM Security X-Force Cloud Threat Report, "IBM", ~ (2022)
- Young-hoon Lee, "7 Threats Aiming at Cloud Environments", AhnLab ISF SQUARE 2021 (2021)
- Top Threats to Cloud Computing – Pandemic Eleven, "Cloud Security Alliance", ~ (2022)
- “Cloud Down: Impacts on the US economy”, Emerging Risk Report 2018, "Lloydes", ~ (2018)
- Cloud Security : A Primer for Policymakers, "Tim Maurer", Carnegie Endowment for international peace, ~ (2020)
- Enisa Threat Landscape 2022, "ENISA", ~ (2022)
- Review of additional regulatory sandbox conditions when using SaaS on internal networks, "Financial Security Institute", ~ (2023)
- Mitigating Cloud Vulnerabilities, "National Security Agency", ~, pp.U (2020), OO[DOI]
- Song-i Hwang, "Cloud Migration Strategy and Cloud Security through CSPM", Electronic Finance and Financial Security, 30, pp.107~119 (2022), Financial Security Institute
- Song-i Hwang, "Cloud Container Security Risks and Implications", Electronic Finance and Financial Security, 31, pp.88~107 (2023), Financial Security Institute
- Market Guide for Cloud-Native Application Protection Platforms, "Gartner", ~ (2023)
- Security framework for cloud computing, "I TU-T", ~, pp.X.1601 (2015)
- Security requirements and guidelines for virtualization containers in cloud computing environments, "ITU-T", ~, pp.X.1643 (2022)
- Security as code : The best(and maybe only)path to securing cloud applications and systems, "C. Adtani", Mckinsey, ~ (2021)
- Trusted Cloud:Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS)Environments, "M. Bartock", NIST, ~, pp.SP 1800-19 (2022)
- Kubernetes Hardening Guide, "NSA", ~, pp.U (2022), OO[DOI]