國防 情報通信基盤體系의 保安管理를 위한 效率的인 危險分析 모델에 관한 硏究 = (A) study on efficient risk analysis model for security management of national defense information communication infrastructure

다국어 초록 (Multilingual Abstract)

Recently, the administrative machinery of a state increased in use information system to work and offer service for a nation as established an information-oriented society rapidly. Like that with it, the information communication infrastructure was evaluated as the important property of the administrative machinery of state, and tried to strengthen security policy. The national defense information communication infrastructure needs special security policy for information systems related to the national defense information communication infrastructure because it is used to exchange information related to the national security such as the national/military secret.
It should be assessed a risk level of the information communication infrastructure to draw up a systematical security policy and guide exactly. In this paper, we will propose the ND-RAM, the efficient risk analysis model, reflecting the national defense information communication's characteristics. The ND-RAM's the advanced risk analysis was used to Matrix Scaling applied to an investment cost, an utilization and an inadequacy of security measures to understand information systems's structure of the National defense information communication infrastructure exactly. The baseline approach can be set up a minimum security measures as assessed whether it is performed or not military security control list. The detailed risk analysis can be assessed as analyzed asset, vulnerability, threat and safeguard. Specially, the asset value was able to calculate the actual asset value considered the national defense information communication infrastructure's characteristics. The vulnerability, threat and safeguard analysis set an each assessment standard concretely and they improved the accuracy of assessment. The risk assessment contained a safeguard element to the risk level calculation formula to improve it's efficiency. The cost-effective analysis to calculate a profit rate and an investment return rate and it can be selected safeguard where the expense of smallest holds.
The ND-RAM which is a risk analysis model for the national defense information communication infrastructure improved the systematization of analysis process, the concreteness of analysis method and the accuracy of risk level assessment. It contains a process complication in the other side which improves the efficiency of risk analysis. This is subject to research before embodying risk analysis model continuously in the future.

목차 (Table of Contents)

• 목차
• 1. 서론 = 1
• 2. 관련 연구 = 3
• 2.1 일반적인 위험분석 방법론 = 3
• 2.1.1 정보시스템의 보안 관리 = 3
• 2.1.2 정보시스템의 위험 관리 = 6
• 2.1.3 정보시스템의 위험 분석 = 7
• 2.2 기존의 위험분석 방법론 분석 = 16
• 2.2.1 기존의 위험분석 방법론 = 16
• 2.2.2 기존의 위험분석 방법론의 비교 분석 = 29
• 3. 국방 정보통신기반체계 = 36
• 3.1 국방 정보통신기반체계의 구조 = 36
• 3.1.1 국방 정보통신망의 체계 = 36
• 3.1.2 국방 정보통신기반체계의 정보시스템 구성 = 37
• 3.2 위험분석 모델 개발시 고려사항 = 38
• 4. ND-RAM = 41
• 4.1 ND-RAM 개요 = 41
• 4.2 ND-RAM 프레임워크 = 43
• 4.2.1 준비 및 정보수집 = 44
• 4.2.2 사전 위험분석 = 45
• 4.2.3 기본통제 방법 = 49
• 4.2.4 상세 위험분석 = 50
• 4.2.5 대응책 수립 = 64
• 4.2.6 비용효과 분석 = 66
• 4.2.7 위험수용 평가 = 68
• 4.2.8 종합평가 = 69
• 5. 결론 및 향후계획 = 70
• 6. 참고문헌 = 72