• Journal of the Korea Safety Management & Science
• /
• v.14 no.3
• /
• pp.119-126
• /
• 2012

Recently, the breakdown of online banking servers and the leakage of customer information give rise to much concern about the security of information systems in financial and banking companies in Korea. The enforcement of security for information system becomes much more important issue than earlier. However, the security reinforcement of information system is restricted by a budget. In addition, the activities' cost to secure information system from threatening are under uncertain circumstances and should be established by a human decision maker who is basically uncertain and vague. Thus, making the budget for information system is exposed to any extent of the risk for these reasons. First, we introduce brief fuzzy set theory and fuzzy AHP (Analytic Hierarchy Process) methodology. Then, the cost elements that comprise yearly budget are presented and the priorities among the cost elements are calculated by fuzzy AHP. The cost elements that are exposed to risk are evaluated from the both perspectives of the risk impact and risk occurrence possibility which are expressed as linguistic terms. To get information on the risk profiles-pessimistic, most likely, and optimistic-for each cost element, the evaluation is accomplished and the result is presented. At last, the budget ranges-minimum, mode, maximum-for each cost element are estimated with the consideration of the risk profiles.

• The KIPS Transactions:PartC
• /
• v.14C no.2
• /
• pp.115-122
• /
• 2007

US is strengthening the information security by managing federal agency's information and information system systematically. For this purpose. US government put the Federal Information Security Management Act into the E Government Act of 2002. According to the FISMA, it is required to have information securitv management plan for all federal agencies. In addition that, OMB Circular A II requires all federal agencies to identity the ratio of information security investment. That is the basis of strengthening the information security of federal agency, This paper will compare the budget status and information security mechanism of Korea and US.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2008.06a
• /
• pp.69-77
• /
• 2008

정보보호를 효율적이고 효과적으로 실천하는 방법으로 정보자산을 기준으로 위험관리를 수행하는 GMITS(ISO 13335)과 정보보호 관리체계 수립을 위한 ISMS(ISO 27001), 정보보호 능력성숙도 모델을 제시하는 SSE-CMM 등의 국제 표준이 존재한다. 그러나 각 표준은 위험관리를 위한 절차를 제시하거나 관리체계 수립방안, 그리고 능력성숙 수준을 제시하는 등 관리, 기술, 운영의 종합적인 보안방안을 제시하지는 못하고 있다. 또한 현 보안문제를 최고 관리자 수준에서 판단할 수 있는 종합적인 방안을 제시하지 못하고 있다. 본 논문에서는 정보시스템 보안평가를 통해 보안 기술, 관리, 운영측면의 문제점을 종합하여 위험관리가 가능하도록 하는 방안을 제안하고, 또한 제안한 위험관리를 통해 도출된 문제점을 최고관리자 수준에서 직관적으로 판단 할 수 있는 방안을 제시하여 정보보호 예산과 연계할 수 있는 방법을 제안한다.

• Journal of the Korea Safety Management & Science
• /
• v.19 no.2
• /
• pp.41-50
• /
• 2017

Disaster and safety budget can be characterized as a large-scale public asset on which the government has a significant role. It is of a crucial importance to properly allocate the limited national budget to various areas as necessary. Higher investment efficiency of the budget related to disaster and safety management requires distribution criteria based on relevance and efficiency. Currently, the budget related to disaster and safety management is orchestrated through the prior consultation system. However, there is still no clear framework for reviewing the investment direction and setting the priority investment areas by prior consultation. This study analyzes the status and characteristics of disaster and safety management projects by damage type and proposes a structured system for prioritization. This framework can be useful in selecting the areas that need priority investments by damage type of disaster and safety management projects, thereby contributing to improving investment efficiency.

• Journal of Information Processing Systems
• /
• v.16 no.1
• /
• pp.61-82
• /
• 2020

The security risk management used by some service providers is not appropriate for effective security enhancement. The reason is that the security risk management methods did not take into account the opinions of security experts, types of service, and security vulnerability-based risk assessment. Moreover, the security risk assessment method, which has a great influence on the risk treatment method in an information security risk assessment model, should be security risk assessment for fine-grained risk assessment, considering security vulnerability rather than security threat. Therefore, we proposed an improved information security risk management model and methods that consider vulnerability-based risk assessment and mitigation to enhance security controls considering limited security budget. Moreover, we can evaluate the security cost allocation strategies based on security vulnerability measurement that consider the security weight.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.20 no.1
• /
• pp.119-131
• /
• 2024

The purpose of this study is to examine the operational performances by the investment level of information security in companies. The theoretical background summarized the meaning of information security, management information security, and network security. The research process was carried out in four stages. As a result of the analysis, the level of information security was classified into four groups, and the difference in operational performance was confirmed. According to the categorical regression analysis of the three dependent variables, independent variables such as network threats, non-network threats, executive information security awareness, industry, organizational size, and information security education all affected information security regulations, in-house information security checks, and information security budget investments. The theoretical implications of this study have contributed to updating the latest information security theory. Practical implications are that rational investments should be made on the level of information security of companies.

• Journal of Information Technology Services
• /
• v.21 no.1
• /
• pp.81-102
• /
• 2022

Although more than 99% of all Korean companies are small and medium-sized enterprises (SMEs), which accounts for a large part of the national economy, they are having difficulties in securing information protection capabilities due to problems such as budget and manpower. On the other hand, as 97% of cyber incidents are concentrated in SMEs, it is urgent to strengthen the information protection management and response capabilities of SMEs. Although the government is promoting company-wide information security consulting for SMEs, the need for supplementing it's procedures and consulting items is being raised. Based on the results of information security consulting supported by the government in 2020, this study attempted to derive improvement plans by interviewing SME workers, information security consultants, and system operators. Through the research results, it is expected to create a basis for SMEs to autonomously check the information security management system and contribute to the reference of related policies.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.6
• /
• pp.1271-1284
• /
• 2014

This paper classifies technical, administrative and physical areas of defects and advices made by an external audit (ISO27001) and internal audit (performed by a security team) in a company which has the management system of information security. With the classified data it finds the correlation between the budget and investment of information security, and analyze the correlation. As a result of the analysis, it has been found that as time goes on there is a consistent correlation between a administrative area and technical area of security. Specially, it has been confirmed that the relation between the scale of the budget which is not executed and the number of the defects and advices made by the audit is in direct proportion. Therefore, in this paper, so as to provide a model that can be used for validating the effectiveness of the protective investment information by statistically calculating the similarity based on the results of correlation analysis. This research is intended to help that a company makes a precise decision when it establishes a policy of information security and systematic methodology of the investment in information security.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.19 no.2
• /
• pp.89-102
• /
• 2023

The purpose of this study is to examine what are the important variables for information security compliance and whether the information security investment by the industry is different. To comply with the information security policies, the organization must establish measures to prevent or resolve information security incidents. This research process consists of four stages, and the analysis method was conducted with the categorical regression analysis and the correspondence analysis. The first analysis analyzed the independent variables that affect security regulations compliance. The rest of the analysis was conducted by industry in the order of security compliance regulations, manpower investment, and budget investment. As a result of the first analysis, this had positive effects on an organization and personal information protection awareness, joint operation organization of information protection, manpower and budget investment, corporate size, and industry. The correspondence analysis was conducted from the second analysis to the fourth analysis and it analyzed the differences in information security investment by industry. The second analysis showed that the construction industry, science and technology industry, and finance industry have higher compliance with security regulations than other industries. The third analysis showed that the financial industry and the science and technology industry were higher than other industries. The last analysis showed that the financial industry was higher than other industries. The theoretical contribution of this study provided the basis for updating the information security theory. The practical contribution of this study requires government support to reduce information security deviations by industry.

• Journal of Industrial Technology
• /
• v.31 no.A
• /
• pp.113-118
• /
• 2011

Federal Information Security Management Act emphasizes the importance of information security to the economic and national security interests of the United States. This paper provides a brief review on FISMA which is a United States federal law enacted in 2002 as Title III of the E-Government Act of 2002, and predicts the possible problems which might be caused from domestic introduction of FISMA. The domestic introduction of FISMA could improve the average level of information security of government agencies. Whereas, the government agencies and the government officials might face with many problems such as the increased government budget, lack of social awareness and security professionals, and the effectiveness of penalty on non-compliance.