[논문]안전한 가상자산 서비스를 위한 ISMS 인증항목 개선에 관한 연구: CCSS 인증제도 비교를 중심으로

김은지; 구자환; 김응모

doi:10.3745/ktccs.2022.11.8.249

안전한 가상자산 서비스를 위한 ISMS 인증항목 개선에 관한 연구: CCSS 인증제도 비교를 중심으로
Improvement of ISMS Certification Components for Virtual Asset Services: Focusing on CCSS Certification Comparison 원문보기

정보처리학회논문지. KIPS transactions on computer and communication systems 컴퓨터 및 통신 시스템, v.11 no.8, 2022년, pp.249 - 258

김은지 (성균관대학교 정보보안학과) , 구자환 (성균관대학교 소프트웨어융합대학) , 김응모 (성균관대학교 소프트웨어융합대학)

초록
AI-Helper

비트코인이 등장한 이후, 다양한 가상자산이 가상자산 거래소의 가상자산 서비스를 통해 활발하게 거래되고 있다. 최근 가상자산거래소에 대한 보안사고가 자주 발생하고 있어 정부는 가상자산 거래소의 정보보호 강화를 위해 Information Security Management System (ISMS) 인증획득을 의무화하고 있으며, 이를 위한 56개 특화항목을 추가로 제정하였다. 본 논문에서는 ISMS와 암호화폐를 이용하는 모든 정보시스템에 대한 요구사항을 담고있는 CryptoCurrency Security Standard (CCSS)의 도메인 중요도를 비교하고 상호매핑을 한 후 그 결과를 분석하여 각 인증제도의 특성을 통찰하였으며, 도출된 개선항목의 중요도 평가를 통해 개선항목에 대한 우선순위를 High, Medium, Low 등 3단계로 분류하여 High Level 4가지 항목에 대한 개선사항들을 도출하였다. 이러한 결과는 가상자산 및 정보시스템 보안에 대한 우선순위를 제공하고 인증항목 개선에 대한 방법 및 체계적인 의사결정을 지원할 수 있을 뿐만 아니라 가상자산서비스에 대한 신뢰성 및 안전성을 제고하여 가상자산 거래 활성화에 기여할 수 있을 것으로 보인다.

Abstract ▼ AI-Helper

Since the advent of Bitcoin, various virtual assets have been actively traded through virtual asset services of virtual asset exchanges. Recently, security accidents have frequently occurred in virtual asset exchanges, so the government is obligated to obtain information security management system (ISMS) certification to strengthen information protection of virtual asset exchanges, and 56 additional specialized items have been established. In this paper, we compared the domain importance of ISMS and CryptoCurrency Security Standard (CCSS) which is a set of requirements for all information systems that make use of cryptocurrencies, and analyzed the results after mapping them to gain insight into the characteristics of each certification system. Improvements for 4 items of High Level were derived by classifying the priorities for improvement items into 3 stages: High, Medium, and Low. These results can provide priority for virtual asset and information system security, support method and systematic decision-making on improvement of certified items, and contribute to vitalization of virtual asset transactions by enhancing the reliability and safety of virtual asset services.

주제어

표/그림 (7)

표 Table 1. ISMS-P Certification Components
그림 Fig. 1. Components Ratio by Domain; (A) Virtual Asset Business Checklist Ratio by ISMS, (B) Components Ratio by CCSS
그림 Fig. 2. Results of ISMS and CCSS Components Mapping
그림 Fig. 3. Mapping Rate by Domain; (A) Mapping Rate by ISMS Domain, (B) Mapping Rate by CCSS DomainISMS
표 Table 2. Component Materiality Rating Factors and Ratings
표 Table 3. Importance Evaluation Result of Nonapplied Components
표 Table 4. ISMS Improvement Components

참고문헌 (34)

S. Nakamoto, "A peer-to-peer electronic cash system," Decentralized Business Review, pp.21260, 2008.
Y. S. Chung and J. S. Cha, "The security risk and countermeasures of blockchain based virtual currency trading," The Journal of Korea Institute of Information, Electronics, and Communication Technology, Vol.11, No.1, pp.100-106, 2018.

원문보기 상세보기
Hedgewithcrypto, Cryptocurrency Exchange Hacks (Up-dated 2022 List) [Internet], https://www.hedgewithcrypto.com/cryptocurrency-exchange-hacks/.
Strategy and Finance Committee, "Analysis of government audit issues," National Policy Committee, Vol.4, 2020.
K. Grobys, "When the blockchain does not block: On hackings and uncertainty in the cryptocurrency market," Quantitative Finance, Vol.21, Iss.8, pp.1267-1279, 2021.

상세보기
L. Konig, S. Unger, P. Kieseberg, and S. Tjoa, "The risks of the blockchain a review on current vulnerabilities and attacks," Journal of Internet Services and Information Security, Vol.10, Iss.3, pp.110-127, 2020.
Y. Maleh, M. Shojafar, M. Alazab, and I. Romdhani, "Blockchain for cybersecurity and privacy: Architectures, challenges, and applications," Eds., CRC Press, 2020.
J. H. Lee, "Systematic approach to analyzing security and vulnerabilities of blockchain systems," Massachusetts Institute of Technology, Diss, 2019.
B. Y. Kim, "Positions and responses of major countries on cryptocurrency," in Capital Market Focus, Korea Capital Market Institute, Vol.25, 2017.
R. Zhang, R. Xue, and L. Liu, "Security and privacy on blockchain," ACM Computing Surveys (CSUR), Vol.52, Iss.3, pp.1-34, 2019.
N. Amiet, "Blockchain vulnerabilities in practice," Digital Threats: Research and Practice, Vol.2, Iss.2, pp.1-7, 2021.

상세보기
A. Mense and M. Flatscher, "Security vulnerabilities in ethereum smart contracts," Proceedings of the 20th International Conference on Information Integration and Web-based Applications & Services, pp.375-380, 2018.
H. Poston, "Mapping the OWASP top ten to blockchain," Procedia Computer Science, Vol.177, pp.613-617, 2020.

상세보기
M. Al. Ketbi, K. Shuaib, E. Barka, and M. Gergely, "Es-tablishing a security control framework for blockchain technology," Interdisciplinary Journal of Information, Knowledge, and Management, Vol.16, pp.307, 2021.

상세보기
J. Bucko, D. Palova, and M. Vejacka, "Security and trust in cryptocurrencies," Central European Conference in Finance and Economics, pp.14-24, 2015.
G. Bello and A. J. Perez, "Adapting financial technology standards to blockchain platforms," Proceedings of the 2019 ACM Southeast Conference, pp.109-116, 2019.
T. Hardjono, A. Lipton, and A. Pentland, "A contract service provider model for virtual assets," The Journal of FinTech, Vol.1, No.2, Iss.2150004, 2022.
V. Tumas, R. Norvill, D. Magoni, and R. State, "VaVite: Verifiable information exchange for virtual asset service providers," 2020 Principles, Systems and Applications of IP Telecommunications (IPTComm), pp.1-8, 2020.
T. Hardjono, A. Lipton, and A. Pentland, "Privacy-preserving claims exchange networks for virtual asset service providers," 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.1-8, 2020.
T. Hardjono, A. Lipton, and A. Pentland, "Toward a public-key management framework for virtual assets and virtual asset service providers," The Journal of FinTech, Vol.1, No.1, Iss.2050001, 2021.

상세보기
T. Hardjono, "Future directions for regulated private wallets and VASP trust infrastructures," 2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.1-3, 2021.
T. Hardjono, "Attestation infrastructures for private wallets," arXiv preprint arXiv:2102.12473, 2021.
G. Soana, "Regulating cryptocurrencies checkpoints: Fighting a trench war with cavalry?," Economic Notes, Vol.51, No.1, 2022.

상세보기
CoinMarketCap, All Cryptocurrencies [Internet], https://coinmarketcap.com/all/views/all/.
CoinMarketCap, Bitcoin [Internet], https://coinmarket-cap.com/currencies/bitcoin/.
C. Decker and R. Wattenhofer, "Bitcoin transaction malle-ability and MtGox," In European Symposium on Research in Computer Security, Springer, Cham, pp.313-326, 2014.
Y. Tsuchiya and N. Hiramoto, "How cryptocurrency is laundered: Case study of Coincheck hacking incident," Forensic Science International: Reports, Vol.4, Iss.100241, 2021.
CoinMarketCap, Top Cryptocurrency Spot Exchanges [Internet], https://coinmarketcap.com/rankings/exchanges/
I. S. Choi, "A study on the regulation of risks associated with the use of virtual currencies," Ph.D. dissertation, Yonsei University Law School, Seoul, Republic of Korea, 2019.
Korea Internet & Security Agency, Introduction of the certification system [Internet], https://isms.kisa.or.kr/main/isms/intro/.
Korea Ministry of Government Legislation, Act on Promotion of Information and Communications Network Utilization and Information Protection, [Internet], https://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EC%A0%95%EB%B3%B4%ED%86%B5%EC%8B%A0%EB%A7%9D%EC%9D%B4%EC%9A%A9%EC%B4%89%EC%A7%84%EB%B0%8F%EC%A0%95%EB%B3%B4%EB%B3%B4%ED%98%B8%EB%93%B1%EC%97%90%EA%B4%80%ED%95%9C%EB%B2%95%EB%A5%A0/(20211209,18201,20210608)/%EC%A0%9C47%EC%A1%B0.
Korea Internet & Security Agency, Announcement of detailed inspection items for ISMS for virtual asset business [Internet], https://isms.kisa.or.kr/main/ispims/notice/?boardIdbbs_0000000000000014&modeview&cntId12.
CryptoCurrencyCertificationConsortium, Crpto Currency Security Standard [Internet], https://cryptoconsortium.github.io/CCSS/.
ISO, ISO 31000:2018(en) Risk management - Guidelines, https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-2:v1:en.

저자의 다른 논문 :

표제어: PCR

동의어: Packet Collision Rate

용어 설명 출처 목록 (6)

용어 설명: PCR은 세균 특이성이 있는 primer를 이용하여 적은 수의 세균이 있을지라도 쉽게 검출할 수 있는 유용한 방법이며, 이를 이용하여 구강 내 치면세균막이나 타액에서 직접 세균을 검출할 수 있게 되었다[8].

내보내기 구분	파일저장 인쇄 메일전송
구성항목	기본정보 상세정보 관리번호, 논문명, 저널/프로시딩명, 저자 , 발행년, 권, 호, 시작페이지, 끝페이지, 발행기관 관리번호, 논문명, 대등논문명, 저자 , 저널/프로시딩명, 발행기관, 발행년, 발행언어, 권, 호, 시작페이지, 끝페이지, ISBN, ISSN, 주제분야, 키워드, 초록(한글), 초록(영문), 저자(소속기관)
저장형식	Text(ASCII format) Excel format RefWorks Direct Export RIS format (for Reference Manager, ProCite, EndNote), Scholar's Aids, Mendeley
메일정보	받는사람 (필수) @ 보내는사람 (선택) @ 제목 내용 KISTI 검색결과 이메일 서비스
안내	총 건의 자료가 검색되었습니다. 다운받으실 자료의 인덱스를 입력하세요. (1-10,000) 검색결과의 순서대로 최대 10,000건 까지 다운로드가 가능합니다. 데이타가 많을 경우 속도가 느려질 수 있습니다.(최대 2~3분 소요) 다운로드 파일은 UTF-8 형태로 저장됩니다. 파일의 내용이 제대로 보이지 않을실 때는 웹브라우저 상단의 보기 -> 인코딩 -> 자동선택 여부를 확인하십시오. ~ Text(ASCII format) Excel format

연합인증