$\require{mediawiki-texvc}$

연합인증

연합인증 가입 기관의 연구자들은 소속기관의 인증정보(ID와 암호)를 이용해 다른 대학, 연구기관, 서비스 공급자의 다양한 온라인 자원과 연구 데이터를 이용할 수 있습니다.

이는 여행자가 자국에서 발행 받은 여권으로 세계 각국을 자유롭게 여행할 수 있는 것과 같습니다.

연합인증으로 이용이 가능한 서비스는 NTIS, DataON, Edison, Kafe, Webinar 등이 있습니다.

한번의 인증절차만으로 연합인증 가입 서비스에 추가 로그인 없이 이용이 가능합니다.

다만, 연합인증을 위해서는 최초 1회만 인증 절차가 필요합니다. (회원이 아닐 경우 회원 가입이 필요합니다.)

연합인증 절차는 다음과 같습니다.

최초이용시에는
ScienceON에 로그인 → 연합인증 서비스 접속 → 로그인 (본인 확인 또는 회원가입) → 서비스 이용

그 이후에는
ScienceON 로그인 → 연합인증 서비스 접속 → 서비스 이용

연합인증을 활용하시면 KISTI가 제공하는 다양한 서비스를 편리하게 이용하실 수 있습니다.

[국내논문] 무기체계 개발을 위한 RMF A&A의 실증에 관한 연구
A Study on Proving RMF A&A in Real World for Weapon System Development 원문보기

情報保護學會論文誌 = Journal of the Korea Institute of Information Security and Cryptology, v.31 no.4, 2021년, pp.817 - 839  

조광수 (고려대학교 정보보호대학원) ,  김승주 (고려대학교 정보보호대학원)

초록
AI-Helper 아이콘AI-Helper

소프트웨어를 안전하게 관리하기 위해 군은 RMF A&A(Risk Management Framework Assessment & Authorization) 표준에 따라 제품을 구매하고 관리한다. 해당 표준은 무기체계를 비롯한 군 IT 제품의 획득 체계에 관한 표준으로 제품에 대한 요구사항, 평가를 통한 구매, 유지보수를 다룬다. 해당 표준에 따르면 제품 개발활동에는 군에서 제시한 임무의 위험도가 반영되어야 한다. 즉, 개발사는 보안 내재화 및 공급망 보안을 통해 제시된 위험도를 완화하였고, RMF A&A의 보안 요구사항을 제대로 준수하였음을 입증하는 자료를 제출해야하고, 군에서는 개발사로부터 제출된 증거자료에 대한 평가를 통해 최종 획득 여부를 결정한다. 기존에 RMF A&A 실증 연구가 수행된 사례가 있다. 하지만, 해당 연구는 RMF A&A의 전체 단계가 아닌 일부분에 대해서만 다루고 있고, 해당 연구의 실증 사례가 대외비인 관계로 상세한 정보가 공개되지 않아 실제 산업 환경에 적용하는데 어려움이 있다. 이에 본 논문에서는 군의 위험도 측정 및 RMF A&A 관련 표준들을 분석하고, 이를 바탕으로 군 RMF A&A의 요구사항을 만족시킬 수 있는 증거자료 작성방안에 대해 제시한다. 또한, 제시한 방안을 실제 드론 시스템에 적용하여 작성된 평가 제출물이 RMF A&A의 요구사항에 부합한지 검증을 수행한다.

Abstract ▼ AI-Helper 아이콘AI-Helper

To manage software safely, the military acquires and manages products in accordance with the RMF A&A. RMF A&A is standard for acquiring IT products used in the military. And it covers the requirements, acquisition through evaluation and maintenance of products. According to the RMF A&A, product deve...

주제어

#Risk Management   #Risk Assessment   #RMF A&A   #Security by Design   #Supply Chain Security  

표/그림 (12)

AI 본문요약
AI-Helper 아이콘 AI-Helper

문제 정의

  • 본 연구에선 개발 업체가 RMF A&A 평가 제출물을 실제로 작성하는데 어려움이 없도록 기존 RMF A&A 관련 연구의 문제점을 파악하고 RMF A&A 평가 요구사항을 모두 만족할 수 있는 평가 제출물 및 증거자료 작성방안에 대해 제안하고자 한다.
  • 위와 같은 연구들을 수행하는 것으로 본 연구에서는 개발 업체가 용이하게 평가 제출물 및 증거자료를 작성하고 RMF A&A를 만족할 수 있도록 각 평가 제출물 및 증거자료 템플릿 내 항목을 작성할 때 참조할 수 있는 문서 목록을 제시한다.
본문요약 정보가 도움이 되었나요?

참고문헌 (79)

  1. DoD, "Risk Management Framework (RMF) for DoD Information Technology (IT)", DoDI 8510.01, 2014. 

  2. Hyunsuk Cho, Sungyong Cha and Seungjoo Kim, "A Case Study on the Application of RMF to Domestic Weapon System", Journal of The Korea Institute of Information Security & Cryptology, 29(6), pp. 1463-1475, Dec. 2019. 

    원문보기 상세보기 crossref

  3. Jiseop Lee, et al, "Research for construction Cybersecurity Test and Evaluation of Weapon System", Journal of The Korea Institute of Information Security & Cryptology, 28(3), pp. 765-774, Jun. 2018. 

    원문보기 상세보기 crossref

  4. M. Bendel, "An Introduction to Department of Defense IA Certification and Accreditation Process(DIACAP)", 2006. 

  5. NIST, "Standards for Security Categorization of Federal Information and Information Systems", FIPS 199, 2004. 

  6. NIST, "Guide for Conducting Risk Assessments", NIST SP 800-30, 2012. 

  7. M. A. Amutio, J. Candau, and J. A. Manas, "MAGERIT-version 3.0 Methodology for Information Systems Risk Analysis and Management, Ministry of Finance and Public Administration", Jul. 2014. 

  8. J. Wynn, et al, "Threat Assessment & Remediation Analysis (TARA)", MITRE, Oct. 2011. 

  9. B. Naqvi and A. Seffah, "A methodology for aligning usability and security in systems and services", 2018 3rd International Conference on Information Systems Engineering (ICISE), pp. 61-66, May 2018. 

  10. A. Sanchez-Gomez, J. Diaz and D. Arroyo, "Combining usability and privacy protection in free-access public cloud storage servers: review of the main threats and challenges", arXiv preprint arXiv:1610.08727, 2016. 

  11. V. K. Mishra, "Blockchain for Cybersecurity-Standards & Implications", Cybernomics, vol.1, no.5, pp. 11-15, Dec. 2019. 

  12. E. Venson, et al, "Costing secure software development: A systematic mapping study", Proceedings of the 14th International Conference on Availability, Reliability and Security, pp. 1-11, Aug. 2019. 

  13. J. Jaskolka, "Recommendations for Effective Security Assurance of Software-Dependent Systems", Science and Information Conference, pp. 511-531, Jul. 2020. 

  14. J. Nguyen and M. Dupuis, "Closing the Feedback Loop Between UX Design, Software Development, Security Engineering, and Operations", Proceedings of the 20th Annual SIG Conference on Information Technology Education, pp. 93-98, Sep. 2019. 

  15. E. Venson, et al, "The Impact of Software Security Practices on Development Effort: An Initial Survey", 2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), pp. 1-12, Sep. 2019. 

  16. E. Venson, "The effects of required security on software development effort", Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Companion Proceedings, pp. 166-169, Jun. 2020. 

  17. S. Harrison, et al, "A security evaluation framework for UK e-goverment services agile software development", arXiv preprint arXiv:1604.02368, Apr. 2016. 

    crossref

  18. R. Kumar and R. Goyal, "Assurance of data security and privacy in the cloud: A three-dimensional perspective", Software Quality Professional, vol. 21, no.2, pp. 7-26, Mar. 2019. 

  19. A. Jurcut, et al, "Security Considerations for Internet of Things: A Survey", SN Computer Science, vol.1, no.193, pp. 1-19, Jun. 2020. 

  20. M. Zarour, M. Alenezi and K. Alsarayrah, "Software Security Specifications and Design: How Software Engineers and Practitioners Are Mixing Things up", Proceedings of the Evaluation and Assessment in Software Engineering, pp. 451-456, Apr. 2020. 

  21. S. Evangelou and C. Akasiadis, "Security Assessment in IoT Ecosystems", 2020. 

  22. S. A. Ehikioya, E. Guillemot, "A critical assessment of the design issues in e-commerce systems development", Engineering Reports, vol.2, no.4, Mar. 2020. 

  23. A. Kott, J. Ludwig and M. Lange, "Assessing mission impact of cyberattacks: toward a model-driven paradigm", IEEE Security & Privacy, vol.15, no.5, pp. 65-74, Oct. 2017. 

    상세보기 crossref

  24. M. M. Jakeri and M. F. Hassan, "A Review of Factors Influencing the Implementation of Secure Framework for in-House Web Application Development in Malaysian Public Sector", 2018 IEEE Conference on Application, Information and Network Security (AINS), pp. 99-104, Nov. 2018. 

  25. H. F. Atlam, et al, "Internet of Things Forensics: A Review", Internet of Things, vol.11, May 2020. 

    상세보기

  26. J. Heilmann, "Application Security Review Criteria for DevSecOps Processes", MS Thesis, Lulea University of Technology, Jun. 2020. 

  27. E. A. Wanniarachchi, "Program security evaluation using dynamic disassembly of machine instructions in virtualized environments", PhD Thesis, 2016. 

  28. Sungyong Cha, et al, "Security evaluation framework for military iot devices", Security and Communication Networks, vol. 2018, pp. 1-12, May 2018. 

    상세보기

  29. R. Egan, et al, "Cyber operational risk scenarios for insurance companies", British Actuarial Journal, vol. 24, Feb. 2019. 

    상세보기

  30. M. Kern, et al, "A Cybersecurity Risk Assessment Process for Model Based Industry 4.0 Development", 23th World Multi-Conferebce on Systemics, Cybernetics and Informatics (WMSCI), 2019. 

  31. M. W. Meersman, "Developing a Cloud Computing Risk Assessment Instrument for Small to Medium Sized Enterprises: A Qualitative Case Study Using a Delphi Technique", PhD Thesis, Northcentral University, May 2019. 

  32. T. Pavleska, et al, "Cybersecurity Evaluation of Enterprise Architectures: The e-SENS Case", IFIP Working Conference on The Practice of Enterprise Modeling, pp. 226-241, Nov. 2019. 

  33. A. Hudic, et al. "Towards a unified secure cloud service development and deployment life-cycle", 2016 11th International Conference on Availability, Reliability and Security (ARES), pp. 428-436, Aug. 2016. 

  34. C. J. D'Orazio, et al, "A Markov adversary model to detect vulnerable iOS devices and vulnerabilities in iOS apps", Applied Mathematics and Computation, vol. 293, pp. 523-544, Jan. 2017. 

    상세보기

  35. H. Rygge and A. Josang, "Threat poker: solving security and privacy threats in agile software development", Nordic Conference on Secure IT Systems, pp. 468-483, Nov. 2018. 

  36. L. Sion, et al, "Solution-aware data flow diagrams for security threat modeling", Proceedings of the 33rd Annual ACM Symposium on Applied Computing. pp. 1425-1432, Apr. 2018. 

  37. P. Frijns, R. Bierwolf and T. Zijderhand, "Reframing security in contemporary software development life cycle", 2018 IEEE International Conference on Technology Management, Operations and Decisions (ICTMOD), pp. 230-236, Nov. 2018. 

  38. H. Aranha, et al, "Securing Mobile e-Health Environments by Design: A Holistic Architectural Approach", 2019 International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob), pp. 1-6, Oct. 2019. 

  39. K. M. Kaariainen, "Improving security in software development process: Case Tieto AS", MS Thesis, South-Eastern Finland University of Applied Sciences, May 2019. 

  40. M. T. Baldassarre, et al, "Privacy oriented software development", International Conference on the Quality of Information and Communications Technology, pp. 18-32, Aug. 2019. 

  41. P. Siddhanti, P. M. Asprion and B. Schneider, "Cybersecurity by Design for Smart Home Environments", Proceedings of the 21st International Conference on Enterprise Information Systems (ICEIS), pp. 587-595, 2019. 

  42. P. De Cremer, et al, "Sensei: Enforcing secure coding guidelines in the integrated development environment", Software: Practice and Experience, vol.50, no.9, pp. 1682-1718, Jun. 2020. 

    상세보기 crossref

  43. S. Ramalingan, et al, "A Holistic Systems Security Approach Featuring Thin Secure Elements for Resilient IoT Deployments", Sensors, vol.20, no.18, pp. 5252, Sep. 2020. 

    상세보기 crossref

  44. S. Evangelou, "Auditing and extending security features of IoT platforms", Diploma Thesis, University of Thessaly, Jul. 2020. 

  45. M. Howard and S. Lipner, "The Security Development Lifecycle - SDL: A Process for Developing Demonstrably More Secure Software", Microsoft Press, May 2006. 

  46. T. M. MIR, et al, "Threat analysis and modeling during a software development lifecycle of a software application", U.S. Patent No 8,091,065, 2012. 

  47. E. Chen, et al, "Designing security into software during the development lifecycle", U.S. Patent Application No 13/619,581, 2013. 

  48. W. Douglas and R. Simon. "Applying Secure Software Engineering (SSE) Practices to Critical Space System Infrastructure Development", In: 14th International Conference on Space Operations, pp. 2392, 2016. 

  49. B. J. Greer, "Cybersecurity For Healthcare Medical Devices", PhD Thesis, Utica College, May 2018. 

  50. A. Sanchez-Gomez, et al, "Review of the main security threats and challenges in free-access public cloud storage servers", Computer and Network Security Essentials. Springer, pp. 263-281, Aug. 2018. 

  51. N. Alhirabi, O. Rana and C. Perera, "Designing Security and Privacy Requirements in Internet of Things: A Survey", arXiv preprint arXiv:1910.09911, Oct. 2019. 

  52. K. Chermana, H. Pemmaiah, "Cleansing Legacy Data for GDPR Compliance: A Case Study", PhD Thesis, Auckland University of Technology, 2019. 

  53. W. Hassan, et al, "Latest trends, challenges and solutions in security in the era of cloud computing and software defined networks", Int J Inf & Commun Technol ISSN, vol.2252, no.8776, 2019. 

  54. Jin-Keun Hong, "Component Analysis of DevOps and DevSecOps", Journal of the Korea Convergence Society, 10(9), pp. 47-53, Sep. 2019. 

    원문보기 상세보기 crossref

  55. J. Geismann and E. Bodden, "A systematic literature review of model-driven security engineering for cyber-physical systems", Journal of Systems and Software, vol. 169, Nov. 2020. 

    상세보기

  56. M. Alenezi and S. Almuairfi, "Essential activities for Secure Software Development", International Journal of Software Engineering & Applications (IJSEA), vol. 11, no. 2, Mar 2020. 

    상세보기

  57. F. Y. Akeel, "Secure data integration systems", PhD Thesis, University of Southampton, Oct. 2017. 

  58. S. Lipke, "Building a secure software supply chain using docker", MS Thesis, Hochschule der Medien, 2017. 

  59. A. Schaad and T. Reski, "Open Weakness and Vulnerability Modeler(OVVL)-An Updated Approach to Threat Modeling", Proceedings of the 16th International Joint Conference on e-Business and Telecommunications, pp. 417-424, Jan. 2019. 

  60. F. Nabi, J. Yong and X. TAO, "Classification of logical vulnerability based on group attacking method", Journal of Ubiquitous Systems & Pervasive Networks, vol.14, no.1, pp. 19-26, 2021. 

  61. Sooyoung Kang and Seungjoo Kim, "CIA-Level Driven Secure SDLC Framework for Integrating Security into SDLC Process", Journal of The Korea Institute of Information Security & Cryptology, 30(5), pp. 909-928, Aug. 2020. 

    원문보기 상세보기 crossref

  62. Sungyong Cha, Seungsoo Baek and Seungjoo Kim, "Blockchain Based Sensitive Data Management by Using Key Escrow Encryption System From the Perspective of Supply Chain", IEEE Access, vol.8, pp. 154269-154280, Aug. 2020. 

    상세보기

  63. T. Pavleska, et al, "Drafting a Cybersecurity Framework Profile for Smart Grids in EU: A Goal Based Methodology", European Dependable Computing Conference, pp. 143-155, Aug. 2020. 

  64. V. Casola, et al, "A novel Security-by-Design methodology: Modeling and assessing security by SLAs with a quantitative approach", Journal of Systems and Software, vol.163, May 2020. 

    상세보기

  65. L. David, "DREADful", Microsoft, Aug. 2007. 

  66. E. Zheng, J. Kao and B. He, "Automated secure software development management, risk assessment, and risk remediation", U.S. Patent No 10,740,469, 2020. 

  67. A. Van den Berghe, et al, "Design notations for secure software: a systematic literature review", Software & Systems Modeling, vol.16, no.3, pp. 809-831, Aug. 2017. 

    상세보기

  68. R. Buijtenen and T. Rangnau, "Continuous Security Testing: A Case Study on the Challenges of Integrating Dynamic Security Testing Tools in CI/CD", 17th SC@ RUG, 2019. 

  69. A. Johannsen, D. Kant and R. Creutzburg, "Measuring IT security, compliance and data governance within small and medium-sized IT enterprises", Electronic Imaging, vol. 252, pp. 1-11, 2020. 

  70. ISO, "Evaluation criteria for IT security(CC)", ISO/IEC 15408, 2009. 

  71. CNSS, "Security Categorization and Control Selection for National Security Systems", CNSSI 1253, 2009. 

  72. NIST, "Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories", NIST SP 800-60, 2008. 

  73. NIST, "Security and Privacy Controls for Information Systems and Organizations", NIST SP 800-53, 2020. 

  74. DoD, "DoD Program Manager's Guidebook for Integrating the Cyb-ersecurity Risk Management Framework into the System Acquisition Lifecycle", 2015. 

  75. Microsoft, "Security Development Lifecycle - SDL Process Guidance Version 5.2", 2012. 

  76. V. John and M. Gary, "Building Secure Software: How to Avoid Security Problems the Right Way", Addison-Wesley, Aug. 2001. 

  77. NIST, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy", NIST SP 800-37, 2018. 

  78. NIST, "Security Considerations in the System Development Life Cycle", NIST SP 800-64 Revision 2, 2019. 

  79. L. J. Moukahal, M. A. Elsayed and M. Zulkernine, "Vehicle Software Engineering (VSE): Research and Practice," IEEE Internet of Things Journal, vol. 7, no. 10, pp. 10137-10149, Jun. 2020. 

    상세보기 crossref

관련 콘텐츠

오픈액세스(OA) 유형

FREE

Free Access. 출판사/학술단체 등이 허락한 무료 공개 사이트를 통해 자유로운 이용이 가능한 논문

저작권 관리 안내
섹션별 컨텐츠 바로가기

AI-Helper ※ AI-Helper는 오픈소스 모델을 사용합니다.

AI-Helper 아이콘
AI-Helper
안녕하세요, AI-Helper입니다. 좌측 "선택된 텍스트"에서 텍스트를 선택하여 요약, 번역, 용어설명을 실행하세요.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.

선택된 텍스트

맨위로