사례 위주로 본 공급자망을 중심으로 한 IT제품 보안 위험 = Case studies : Security issues of IT products in terms of supply chain

다국어 초록 (Multilingual Abstract)

Before an IT product is used, there is a sequence of the process such as the components supply-demand of the product, their assembly and production, their logistics and delivery, and then finally, the product can be used by a user. During this sequence of the process, there can be many security exposures and risks. In this paper, we show, by examining security cases of various IT products, that there are many security exposures in the process of IT products from their production to their delivery to end users and in their use, and also show how critical the security exposures are. Even though there are various security theories, technologies and security controls, there is still weak link from the production of an IT product to its use, and this weak link can lead to security vulnerabilities and risks. This paper tries to call attention to the importance of the execution of the security control and the control components. We examine the practical cases to find out how the security control is paralyzed, and to show how it is compromised by asymmetric security resources. Lastly, from the cases, we examine and review the possible domestic security issues and their countermeasures.

참고문헌 (Reference)

1 김정은, "정보보호관리체계(ISMS)를 이용한 중소기업 기술보호 개선방안 연구" (사)디지털산업정보학회 12 (12): 33-54, 2016

2 정병호, "기밀정보 유출 경험을 가진 기업들의 정보사고 대응역량 강화에 관한 연구" (사)디지털산업정보학회 12 (12): 73-86, 2016

3 Raul Roldan, "http://www.zdnet.com/article/fbi-counterfeit-cisco-routers-risk-it-subversion/"

4 Michael Lee, "http://www.zdnet.com/article/aldi-sells-hard-drives-with-malware-inside/"

5 성상훈, "http://www.ittoday.co.kr/news/article View.html?idxno=58403"

6 Robert McMillan, "http://www.infoworld.com/article/2650800/security/seagate-ships-virus-la den-hard-drives.html"

7 Darren Pauli, "http://www.crn.com.au/news/aldi-recalls-conficker-infected-hard-drives-265264"

8 Swati Khandelwal, "http://thehackernews.com/2016/09/xiaomi-android-backdoor.html"

9 Robert Charette, "http://spectrum.ieee.org/riskfactor/computing/it/thumb_drive_security _peril_at"

10 "http://blog.irreverence.co.uk/?p=509"

11 "Zeriva Anti-Counterfeit Process"

12 "Virus Bulletin"

13 "ISO 28000"

14 "HP 고객지원센터"

15 "Dept. of Homeland Security" US Government

16 "Associated Press"

17 "Andover Test for Real/Fake Cisco"