주요기반시설 서비스의 안정적 운영을 위한 보안 프레임워크 설계에 관한 연구 = A Study on the Security Framework Design for Stable Operation of Critical Infrastructure Service

다국어 초록 (Multilingual Abstract)

Critical infrastructure has been operating in a closed environment with a completely separate information system and in the private area. However, with the current ICT environment changes due to convergence and open platforms it has increased the threats and risks to critical infrastructure. The importance of cyber security is increasing in the infrastructure control system, such as the outbreak of Ukraine blackout in 2015 by a malicious code called black energy . This thesis aims to recognize the importance and necessity of protecting the critical infrastructure service, designing a security framework reflecting environmental and characteristic changes, and analyzing the management system suitable for a security framework. We also propose a theoretical basis for constructing a new security framework by comparing and analyzing seven international security management system standards, such as NIST 800-82 and IEC 62443-2-1, which are used in the control system. As a result, the environment surrounding critical infrastructure changes with the characteristics of connectivity, openness, and finality was studied, and as a response to this, many scholars and institutions present critical infrastructure security frameworks as cycle enhancement type structures, risk management structures, and management domain expansion structures. In response, the security framework encompassing these structures, CISF (Critical Infrastructure Security Framework), was designed. Additionally, through the security related international standard and criterion analysis, as a newly designed security standard suitable for CISF, IEC 62443-2-1 is reviewed and suggestions are made.

목차 (Table of Contents)

• 1. 서 론
• 2. 주요기반시설 보호의 정의 및 관리 체계의 소개
• 3. 주요기반시설 보호를 위한 프레임 워크 설계
• 4. 주요기반시설 보호를 위한 국제 표준 및 기준 비교 분석
• 5. 결 론
• References

참고문헌 (Reference)

1 임길환, "제어시스템 보안취약점 현황 및 대책에 관한 연구" 고려대학교 정보보호대학원 2011

2 Lee, H.J, "The Study on Security Enhancement of National Control System for Critical Infrastructure : Focusing on Comparison about Policy of Major Countries and Domestice" Sangmyung University 2016

3 Langner, R, "The RIPE Framework : A Process-Driven Approach towards Effective and Sustainable Industrial Control System Security" Langner Communications GmbH 2013

4 Jeimy, J, "The Information Security Function : Current and Emerging Pressures From Information Insecurity" 6 : 2014

5 유지연, "Shadow IT를 고려한 새로운 관리체계 도입에 관한 연구" 한국IT서비스학회 15 (15): 33-50, 2016

6 Nanni, G, "Security Posture for Critical Information Infrastructure Protection(CIIP)" 2015

7 Sodoma, P, "Resiliency Rules : 7 Steps for Critical Infrastructure Protection" Microsoft 2007

8 Alcaraz, C, "Critical Infrastructure Protection : Requirements and Challenges for the 21st Century" 8 : 53-66, 2015

9 Suter, M, "A Generic National Framework For Critical Information Infrastructure Protection(CIIP)"

10 Bahşi, H, "A Conceptual Nationwide Cyber Situational Awareness Framework for Critical Infrastructures" 9417 : 3-10, 2015