CC(Common Criteria) 기반 보안위험분석 도구 개발 = Development of CC Based Security Risk Analysis Tool

다국어 초록 (Multilingual Abstract)

The importance of the Security Risk Analysis has emerged as security breaches and information leaks has occurred in the companies and organization; threats toward information system and its vulnerabilities has grown up as the dependence on the information-communication systems goes higher as a result of technological advances in IT industry. A Risk Analysis Tool helps to mitigate overall risk of an organization by analysing and evaluating critical information systems and providing security measures against threats to systems and its vulnerabilities as a means to identify the inherent dangers and prevent security intrusion incident. This paper defines risk analysis process by introducing Common Criteria Scheme and suggest a risk analysis tool that can be easily implemented by an information security manager.

참고문헌 (Reference)

1 Hoh Peter In, "Security Risk Analysis Model for Information Systems" 2004

2 SSE-CMM, "Project, Systems Security Engineering Capability Maturity Model(SSE-CMM) - Model Description Document, V.2"

3 OCTAVE, "OCATVE Criteria, Version 2.0" Carnegie Mellon Software Engineering Institute (2001. 12)

4 European Community, "Information Technology Security Evaluation Criteria(ITSEC), Ver. 1.2"

5 Young-Hwan Bang, "Design and Development of a Risk Analysis Automatic Tool" 491-499, 2004

6 DoD, "Department of Defense Trusted Computer System Evaluation Criteria (TCSEC)"

7 CC, "Common Criteria for Information Technology Security Evaluation, Version 2.1, CCIMB- 99-031"

8 British Standards Institution(BSI), "BS-7799"

9 InJung Kim, "A Time-Variant Risk Analysis and Damage Estimation for Large- Scale Network Systems" 2005

10 Injung Kim, "A Study on Security Risk Modeling over Information and Communication Infrastructure" 249-253, 2004

11 CRAMM, "A Practitioner's View of CRAMM"

12 CSE, "A Guide to Security Risk Management for IT Systems" Government of Canada, Communications Security Establishment (CSE) 1996

13 ISO, "3부, “IT 보안관리 지침”" 1998

14 ISO, "1부, “IT보안 개념 및 모델”(1996), 2부 “보안관리 및 계획”(1997)" 1997