Enterprise Security Management Research Articles

빅데이터 플랫폼을 이용한 보안로그 분석 시스템 구현 모델 연구

보안 장비에서 발생하는 로그는 그동안 ESM(Enterprise Security Management) 기반으로 통합적으로 데이터를 분석하였으나 데이터 저장 용량의 한계와 ESM자체의 데이터 처리 성능의 한계로 빅데이터 처리에 부적합하기 때문에 빅데이터 플랫폼을 이용한 보안로그 분석 기술이 필요하다. 빅데이터 플랫폼은 Hadoop Echosystem을 이용하여 대용량의 데이터 수집, 저장, 처리, 검색, 분석, 시각화 기능을 구현할 수 있다. 현재 ESM기술은 SIEM(Security Information & Event Management)방식으로 기술이 발전하고 있으며 SIEM방식의 보안기술을 구현하기 위해서는 현재 보안장비에서 발생하는 방대한 로그 데이터를 처리할 수 있는 빅데이터 플랫폼 기술이 필수적이다. 본 논문은 Hadoop Echosystem 이 가지고 있는 빅데이터 플랫폼 기술을 활용하여 보안로그를 분석하기 위한 시스템을 어떻게 구현할 수 있는지에 대한 모델을 연구하였다. The log data generated by security equipment have been synthetically analyzed on the ESM(Enterprise Security Management) base so far, but due to its limitations of the capacity and processing performance, it is not suited for big data processing. Therefore the another way of technology on the big data platform is necessary. Big Data platform can achieve a large amount of data collection, storage, processing, retrieval, analysis, and visualization by using Hadoop Ecosystem. Currently ESM technology has developed in the way of SIEM (Security Information & Event Management) technology, and to implement security technology in SIEM way, Big Data platform technology is essential that can handle large log data which occurs in the current security devices. In this paper, we have a big data platform Hadoop Ecosystem technology for analyzing the security log for sure how to implement the system model is studied.

Research on Enterprise Security Management Mode Based on Animation Technology

In view of the disadvantages of traditional enterprise security management and the advantages of animation system such as vivid imagined and well-accepted，the author in this article studies enterprise security management model based on the system，including the following five aspects：Representation of the safe production scene in enterprise；Simulation of the accident process；Simulation of the emergency rescue；Education and training programs of safety knowledge and the simulation of product safe performance. Animation technology will bring a new thought to enterprise security management. It will not only help enterprises to solve many security problems，but also take great significant changes in safety production and safety education.

A Derivation of Evaluation Item about Enterprise Security Management

The Enterprise Security Management system is a centralized control system based on predefined security policies by organizations. In Korea, there is a Common Criteria security certification according to the strict standards for various features. As the needs of information security product are increasing, the ESM system should be evaluated with quality characteristics. In this paper, we propose evaluation items for functionality and performance of Enterprise Security Management system, and the best practices for evaluation.

기업보안관리(ESM) 제품의 보안성 평가모델 및 시험방법론 개발

국내에선 ESM(Enterprise Security Management)이 보안관리를 대표하고 있고, 이를 더욱 고도화해야 한다는 요구가 증가하고 있다. 본 논문에서는 기업보안관리(ESM) 제품의 질적인 면을 평가하고 품질 수준을 파악하여 개선방향을 도출함으로써 품질향상을 지원할 수 있는 보안성 평가모델과 시험 방법론에 대해서 개발하였다. 그리고 제품의 보안성 품질을 측정하고 그 결과를 적절한 기준에 따라 판정하는 방법에 대해 연구를 수행하고자 성능시험사례를 제시하여 평가방법을 제시하였다. 도출된 품질평가 모델은 침입방지 시스템의 품질을 평가하고 향상시키는데 중요한 역할을 하게 될 것으로 기대한다. ESM(Enterprise Security Management) is representing domestic security management, and there is requirement to enhance it. This paper will evaluate quality of ESM products, understand its quality level, and derive method to improvement so as to develop security evaluation model and test methodology which can support quality enhancement. In addition, it presented the performance test cases and evaluation method to measure product's security quality, and to perform research on the judgement method for the results based on appropriate criteria. Developed quality evaluation model is expected perform important role in evaluating and enhancing the quality of intrusion prevention system.

Special section: Grid/distributed computing systems security

We are delighted to present to you the special section of Future Generation Computer Systems (FGCS) on grid/distributed computing systems security. This special section contains five technical papers dealing with cutting-edge research and technology related to the design,modeling, and implementation of architectures, algorithms and protocols of computer systems or environments. In the paper ‘‘Secure verifiable non-interactive oblivious transfer protocol using RSA and bit commitment in a distributed environment’’, Soongohn Kim et al. analyze the basic concept of an OT (Oblivious Transfer) protocol for exchanging secret information fairly, survey the basic idea of an interactive and secure noninteractive OT protocol, and present a new non-interactive type of OTprotocolwhich is verifiable. The amount of traffic of transferring information of the suggested method is less than or equal to that of the conventional interactive method. The paper ‘‘Structure design and test of an enterprise security management system with advanced internal security’’ by Seoksoo Kim et al., analyzes existing enterprise security management systems and, on the basis of the results, proposes and tests an enterprise security management system with reinforced internal security. For the test, the authors used a firewall through log analysis and designed Intranet work using a virtual IP system. J. H. Abawajy proposes a new two-level adaptive space-sharing scheduling policy for non-dedicated heterogeneous commodity-

Enemy at the water cooler: real-life stories of insider threats and Enterprise Security Management countermeasures

Enemy at the water cooler: real-life stories of insider threats and Enterprise Security Management countermeasures

Structure design and test of enterprise security management system with advanced internal security

A security system for a company network is progressing as a ESM (Enterprise Security Management) in an existing security solution foundation. The establishment of the security policy is occupying a very important area in ESM of the security system. We tried to analyze the existing ESM system for this and designed a security solution structure for enhancing the internal security. We applied implementing directly IDS system and tested it. This study examined the structure of security solutions in order to build an enterprise security management system. For this purpose, we analyzed existing enterprise security management systems and, based on the results, proposed a enterprise security management system with reinforced internal security and tested the system. For the test, we used a firewall through log analysis and designed an intra-network using virtual IP system.

네트워크 취약점 검색공격 탐지 시스템을 위한 안전한 통신 프레임워크 설계

본 논문에서는 취약점 검색공격 탐지시스템 DS-NVSA(Detection System of Network Vulnerability Scan Attacks)에서 서버와 에이전트들 사이의 상호연동을 위한 안전한 통신 프레임워크를 제안한다. 기존 시스템과의 상호연동을 위하여 제안 프레임워크는 IETF의 IDWG에서 제안한 IDMEF와 IAP를 확장 적용하였다. 또한 공개키 기반의 환경을 지원하지 못하는 네트워크 시스템을 위해 대칭키 기반의 암호화 통신 프로토콜 SKTLS(Symmetric Key based Transport Layer Security Protocol)를 제시하였다. 제안된 프레임워크는 DS-NVSA 이외에도 기존의 이기종 침입탐지 시스템의 제사용과 탐지 영역의 확대를 제공하며, 또한 기업내 통합 보안환경시스템 ESM(Enterprise Security Management) 시스템에도 적용될 수 있다. In this paper, we propose a secure communication framework for interaction and information sharing between a server and agents in DS-NVSA(Detection System of Network Vulnerability Scan Attacks) proposed in〔1〕. For the scalability and interoperability with other detection systems, we design the proposed IDMEF and IAP that have been drafted by IDWG. We adapt IDMEF and IAP to the proposed framework and provide SKTLS(Symmetric Key based Transport Layer Security Protocol) for the network environment that cannot afford to support public-key infrastructure. Our framework provides the reusability of heterogeneous intrusion detection systems and enables the scope of intrusion detection to be extended. Also it can be used as a framework for ESM(Enterprise Security Management) system.

통합보안관리시스템을 위한 보안정책 일반화에 관한 연구

Enterprise security management system proposed to properly manage heterogeneous security products is the security management infrastructure designed to avoid needless duplications of management tasks and inter-operate those security products effectively. In this paper, we propose the model of generalized security policies. It is designed to help security management build invulnerable security policies that can unify various existing management infrastructures of security policies. Its goal is not only to improve security strength and increase the management efficiency and convenience but also to make it possible to include different security management infrastructures while building security policies. In the generalization process of security policies. we first diagnose the security status of monitored networks by analyzing security goals, requirements, and security-related information that security agents collect. Next, we decide the security mechanisms and objects for security policies, and then evaluate the properness of them on the basis of security goals, requirements and a policy list. With the generalization process, it is possible to integrate heterogeneous security policies and guarantee the integrity of them by avoiding conflicts or duplications among security policies. And further, it provides convenience to manage many security products existing in large networks.

통합보안관리시스템의 방화벽정책 분배를 위한 알고리즘 : FALCON

Recently, Networks are required to adopt the security system and security consulting because of security threats and vulnerabilities of systems. Enterprise Security Management (ESM) is a system which establishes the security zone composed of security systems and Firewalls and applies the security policy to each security system. A relevant ESM is based on the effective policy and the proper security system. Particularly, multiple firewalls in ESM are concerned with the security policy about each traffic. In this paper, we describe the problems that can be occurred when we select the firewalls to apply security policy of access control in ESM composed of multiple firewalls and propose the FALCON algorithm, which is able to select the firewalis to apply the policy. We expect that FALCON algorithm offers stability, scalability and compactness for selecting firewall set.

Enterprise Security Management: Managing Complexity

Information Security is a key component in modern enterprise planning and management given the integral role of information technology (IT) in today's enterprise. This entrenchment of security is also driven by the increasing growth of electronic transactions, fueled partly by the Internet as electronic commerce proliferates with the growth of networks. As enterprise boundaries become blurred, security at the enterprise level becomes more challenging.