제로 트러스트(Zero-Trust) 기반의 스마트시티 공급망 보안 모델 연구
A Study on a Smart City Supply Chain Security Model Based on Zero-Trust
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
최근 다양한 도시문제로 세계적으로 국가와 기업에서 스마트시티 개념을 도입한 문제 해결 연구가 진행 중이다. 스마트시티는 도시의 ICT를 융합하고 도시의 모든 구성요소를 네트워크로 연결하여 데이터를 수집·전달하며, 다양한 IoT 제품이나 서비스로 구성된 공급망으로 이뤄져 있다. 스마트시티의 여러 사이버 보안 위협 및 공급망(Supply-Chain) 위협 증가는 불가피하며, 이에 대응하기 위해 공급망 보안 정책 등 프레임워크 수립과 더불어, 제로 트러스트(Zero-Trust) 관점에서 데이터 연계에 따른 각 데이터 제공자·서비스 등의 인증과 적절한 접속통제가 필요하다. 이를 위해 국내에서도 스마트시티 보안 위협을 위한 스마트시티 보안모델이 개발되었으나, 공급망 보안과 제로 트러스트와 관련된 보안 요구사항은 부족한 실정이다. 본 논문에서는 해외 스마트시티 보안 동향을 살펴보고, 정보보호 및 개인정보보호 관리체계(ISMS-P)와 국제표준으로 등록된 ICT 공급망 보안에 대한 보안 요구사항을 비롯해, Zero-Trust 관련 기술을 국내 스마트시티 보안모델에 적용하기 위한 보안 요구사항을 제시하고자 한다.
Abstract
Recently, research on solving problems that have introduced the concept of smart city in countries and companies around the world is in progress due to various urban problems. A smart city converges the city's ICT, connects all the city's components with a network, collects and delivers data, and consists of a supply chain composed of various IoT products and services. The increase in various cyber security threats and supply chain threats in smart cities is inevitable, in addition to establishing a framework such as supply chain security policy, authentication of each data provider and service according to data linkage and appropriate access control are required in a Zero-Trust point of view. To this end, a smart city security model has been developed for smart city security threats in Korea, but security requirements related to supply chain security and zero trust are insufficient. This paper examines overseas smart city security trends, presents international standard security requirements related to ISMS-P and supply chain security, as well as security requirements for applying zero trust related technologies to domestic smart city security models.
참고문헌 (17)
- National Institute of Standards and Technology, "GCTC SC3 Cybersecurity and Privacy Advisory Committee Guidebook", ~ (2019)
- Japan cabinet office, "SIP Second Phase, Smart City Architecture White Paper" (2020)
- Ministry of Internal Affairs and Communications, "Smart City Security Guideline 2. 0", ~ (2021)
- "nscs supply chain security"[URL]
- National Institute of Standards and Technology, "“ Supply Chain Risk Management Practices for Federal Information Systems and Organizations” Special Publication 800-161", ~ (2015)
- International Standard, "Information security for supplier relationships —Part 1: Overview and concepts, ISO", IEC 27036-1, 2014
- International Standard, "Information security for supplier relationships —Part 2: Requirements, ISO", IEC 27036-2, 2014
- International Standard, "Information security for supplier relationships —Part 3: Guidelines for information and communication technology supply chain security, ISO", IEC 27036-3, 2013
- International Standard, "Information security for supplier relationships —Part 4: Guidelines for security of cloud services, ISO", IEC 27036-4, 2016
- International Standard, "Information technology — (O-TTPS) — Mitigating maliciously tainted and counterfeit products — Part 1: Requirements and recommendations, ISO", IEC 20243-1, 2016
- International Standard, "Information technology — Mitigating maliciously tainted and counterfeit products —Part 2: Assessment procedures for the O-TTPS and ISO", IEC 20243-1:2018, ISO, pp.2018, ~
- Smart City Security Model, "KISA", ~ (2020)
- European Cyber Security Organisation, "Overview of existing Cybersecurity standards and certification schemes v2", ~ (2017)
- National Institute of Standards and Technology, "Zero Trust Architecture, Special Publication 800-207", ~ (2020)
- International Standars, "Information Security Management, ISO", IEC 27001, 2013
- KISA, "ISMS-P Certification Guideline", ~ (2021)
- 민성현, "ICT 공급망 보안기준 및 프레임워크 비교 분석", 정보보호학회논문지, 30(6), pp.1189~1206 (2020), 한국정보보호학회[DOI]