This document provides an overview of information security and privacy presented by Nawanan Theera-Ampornpunt. It covers topics such as protecting information privacy and security, user security, software security, cryptography, malware, and security standards. Specific threats to information security in Thailand are discussed such as hackers, viruses, insider threats, and natural disasters. The consequences of security attacks on information, operations, individuals, and organizations are also reviewed.
Seminário 01 Parte II: Noções básicas sobre estrutura, bioquímica e fisiologi...Alexandre H.P. Ferreira
O documento discute a estrutura, bioquímica e fisiologia da pele, incluindo a síntese e função da vitamina D, as glândulas sebáceas e sudoríparas, a estrutura da derme e epiderme, e os tipos de células-tronco encontradas na pele.
This document discusses various aspects of physical security for assets. It covers classifying physical assets, conducting physical vulnerability assessments, choosing secure site locations, securing assets with physical controls like locks and entry systems, implementing physical intrusion detection methods like CCTV, alarms, and mantraps, and the importance of authentication and authorization controls.
Comprehensive plans are in place to improve our institutional cyber securityJasonTrinhNguyenTruo
Comprehensive plans are in place to improve the institution's cyber security through various measures:
1) Up-skilling all staff, students and visitors on cyber defenses and providing 24/7 online training and support.
2) Senior managers and IT staff routinely monitor internal and external cyber security events to inform best practices and risk management is conducted at central and departmental levels.
3) Clear processes define roles and responsibilities for securely handling incidents, with escalation pathways for major events, and feedback is gathered to improve support processes.
A brute force attack is a trial-and-error method to decrypt encrypted data like passwords by exhaustively checking all possible combinations without using any intelligent strategies. It is always successful eventually but can require billions of years for systems with long keys. Tools like Brutus and THC-Hydra are used to perform brute force attacks against network services to guess passwords stored in dictionaries. Session IDs, files/directories, credit card information, and password retrieval questions are also potential targets of brute force attacks. While processing intensive, brute force does not require much setup but can take a very long time.
Complete coverage of CISSP 7th Chapter - Security Operations. I have made sure to cover all topics from three books in this presentation. For corrections, clarifications, please feel free to reach me.
This document provides an overview of information security and privacy presented by Nawanan Theera-Ampornpunt. It covers topics such as protecting information privacy and security, user security, software security, cryptography, malware, and security standards. Specific threats to information security in Thailand are discussed such as hackers, viruses, insider threats, and natural disasters. The consequences of security attacks on information, operations, individuals, and organizations are also reviewed.
Seminário 01 Parte II: Noções básicas sobre estrutura, bioquímica e fisiologi...Alexandre H.P. Ferreira
O documento discute a estrutura, bioquímica e fisiologia da pele, incluindo a síntese e função da vitamina D, as glândulas sebáceas e sudoríparas, a estrutura da derme e epiderme, e os tipos de células-tronco encontradas na pele.
This document discusses various aspects of physical security for assets. It covers classifying physical assets, conducting physical vulnerability assessments, choosing secure site locations, securing assets with physical controls like locks and entry systems, implementing physical intrusion detection methods like CCTV, alarms, and mantraps, and the importance of authentication and authorization controls.
Comprehensive plans are in place to improve our institutional cyber securityJasonTrinhNguyenTruo
Comprehensive plans are in place to improve the institution's cyber security through various measures:
1) Up-skilling all staff, students and visitors on cyber defenses and providing 24/7 online training and support.
2) Senior managers and IT staff routinely monitor internal and external cyber security events to inform best practices and risk management is conducted at central and departmental levels.
3) Clear processes define roles and responsibilities for securely handling incidents, with escalation pathways for major events, and feedback is gathered to improve support processes.
A brute force attack is a trial-and-error method to decrypt encrypted data like passwords by exhaustively checking all possible combinations without using any intelligent strategies. It is always successful eventually but can require billions of years for systems with long keys. Tools like Brutus and THC-Hydra are used to perform brute force attacks against network services to guess passwords stored in dictionaries. Session IDs, files/directories, credit card information, and password retrieval questions are also potential targets of brute force attacks. While processing intensive, brute force does not require much setup but can take a very long time.
Complete coverage of CISSP 7th Chapter - Security Operations. I have made sure to cover all topics from three books in this presentation. For corrections, clarifications, please feel free to reach me.
The document compares the security capabilities of an intrusion prevention system (IPS), intrusion detection system (IDS), and web application firewall (WAF). It finds that a WAF provides more comprehensive protection against web application vulnerabilities and attacks than an IPS or IDS, including protection for common threats like SQL injection, cross-site request forgery, and session hijacking. The document also provides specifications for four WAF appliance models with throughput ranging from 100 Mbps to 2 Gbps and storage from 1TB to 2TB.
Data security in local network using distributed firewall ppt Sabreen Irfana
Distributed firewalls provide data security in LANs by enforcing security policies at network endpoints rather than a single centralized firewall. This overcomes issues with traditional firewalls like single points of failure, restricted topologies, and an assumption that inside users are trusted. A distributed firewall uses a central management system to define security policies which are then enforced by policy agents on endpoints using public key certificates for authentication. This allows filtering of both internal and external traffic according to the security policy.
MSSP – you’ve probably heard the term, but is it just more industry jargon? With small businesses under constant cyber-attack, the time is ripe to beef up your MSSP offerings.
Many MSPs understand the need for a strong information security portfolio. What they don’t realize, however, is that it’s much more than just a stack of vendor security products and services. You need a strategy and a recipe for success.
Register now to join Eric Rockwell, President and CIO of centrexIT, and Ted Hulsy, VP of Marketing at eFolder, as they share what it means to be a true MSSP. Come get the key ingredients for developing a competitive managed security offering.
A firewall risk assessment is a detailed assessment approach of a firewall topology and configuration that has been implemented to protect your information, systems, applications, and overall business operations.
Este documento describe una infraestructura de red implementada con fines de prueba y monitoreo. La red cuenta con servicios como Active Directory y OwnCloud, así como herramientas de seguridad como un firewall Pfsense, un IPS Smoothsec y un correlacionador de eventos OSSIM. Se explica la arquitectura de red, los equipos físicos y virtuales utilizados, así como las características y funciones de los principales componentes y servicios.
The document discusses identity and access management (IAM). IAM is a framework that facilitates managing electronic identities and controlling user access to information. It encompasses identifying individuals, roles, access levels, and protecting sensitive data. Authentication verifies users' identities through factors like passwords, biometrics, or tokens. Authorization controls access through roles or policies based on attributes. IAM tools automate provisioning and access management. Implementing effective IAM brings security, compliance and efficiency benefits.
1) O documento discute a reestruturação do sistema de backup de uma grande empresa para melhorar a segurança e eficiência dos dados.
2) O sistema de backup anterior tinha janelas longas, falhas frequentes e falta de redundância.
3) A reestruturação resultou em menor janela de backup, maior redundância, menos falhas e relatórios gerenciais mais precisos.
This document discusses the top 10 security risks of cloud computing. It begins with an introduction by Ludovic Petit and provides background on cloud security risks. It then lists and describes each of the 10 risks: 1) Accountability and data risk, 2) User identity federation, 3) Legal and regulatory compliance, 4) Business continuity and resiliency, 5) User privacy and secondary usage of data, 6) Service and data integration, 7) Multi-tenancy and physical security, 8) Incidence analysis and forensics, 9) Infrastructure security, and 10) Non-production environment exposure. The document aims to help organizations assess cloud security risks and ensure cloud providers address these top risks.
The document summarizes research into information security governance awareness at the board of director and executive committee levels. It finds that while many organizations have information security practices in place, such as a chief information security officer and security policies, the effectiveness and alignment with business objectives is unclear. Reporting and monitoring have room for improvement, and awareness remains a challenge. Drivers for implementing governance are typically severe security incidents and legal/regulatory compliance pressures rather than proactive alignment with business strategy.
The document discusses the importance of having IT policies for organizations. It provides reasons for developing IT policies such as preventing abuse of resources, protecting ownership and employees, and meeting regulatory requirements. The document also outlines where IT policies fit within an organization's overall governance structure and lists examples of common IT policy topics such as security, network infrastructure, software, and email policies.
O documento apresenta a política de segurança da empresa Datageo Informática, definindo seus componentes, missão, visão, valores, áreas de atuação, setores e regras de segurança. A política estabelece um comitê de segurança, classifica as informações, define proprietários e usuários de dados, e estabelece políticas sobre acesso à internet, uso de email, senhas, dispositivos móveis, backup e softwares maliciosos.
Cracking of wireless networks is the defeating of security devices in Wireless local-area networks. Wireless local-area networks(WLANs) – also called Wi-Fi networks are inherently vulnerable to security lapses that wired networks Cracking is a kind of information network attack that is akin to a direct intrusion. There are two basic types of vulnerabilities associated with WLANs: those caused by poor configuration and those caused by weak encryption.
The document discusses network security policies and regulations. It begins with introducing the presenters and defines the challenges in defining security policies, measuring against policies, reporting and correcting violations, and summarizing compliance. It then covers the foundation, functions, and management of information security. The document outlines the purpose and elements of policies, and a 10-step approach to developing policies which includes risk assessment, creating a review board, developing a security plan, implementing policies and standards, training, compliance monitoring, evaluation, and modification. Minimum HIPAA security requirements and Creighton-specific policies are also summarized.
This document discusses security technologies taught in an Illinois Institute of Technology course. It covers firewalls, intrusion detection systems, dial-up protection, and other topics. The learning objectives are to define types of firewalls, discuss firewall implementation approaches, and understand technologies like encryption and biometrics. Firewalls examined include packet filtering, proxy, stateful inspection, dynamic, and kernel proxy firewalls. Intrusion detection systems can be host-based or network-based, using signatures or anomalies. Remote authentication and terminal access control systems help secure dial-up access.
Este documento fornece um resumo das credenciais e experiência de Vaine Luiz Barreira na área de computação forense e crimes digitais. Ele descreve suas certificações, associações profissionais e experiência em investigação digital e análise forense. O documento também discute brevemente os tipos de crimes digitais, o processo de investigação forense e os desafios emergentes nessa área.
O documento discute as terapias de calor e frio, seus mecanismos fisiológicos e aplicações terapêuticas. O frio é usado para reduzir inflamação, dor e espasmo muscular, enquanto o calor promove relaxamento muscular e aumenta circulação sanguínea. Ambos devem ser aplicados corretamente de acordo com cada caso para obter benefícios e evitar danos.
The document compares the security capabilities of an intrusion prevention system (IPS), intrusion detection system (IDS), and web application firewall (WAF). It finds that a WAF provides more comprehensive protection against web application vulnerabilities and attacks than an IPS or IDS, including protection for common threats like SQL injection, cross-site request forgery, and session hijacking. The document also provides specifications for four WAF appliance models with throughput ranging from 100 Mbps to 2 Gbps and storage from 1TB to 2TB.
Data security in local network using distributed firewall ppt Sabreen Irfana
Distributed firewalls provide data security in LANs by enforcing security policies at network endpoints rather than a single centralized firewall. This overcomes issues with traditional firewalls like single points of failure, restricted topologies, and an assumption that inside users are trusted. A distributed firewall uses a central management system to define security policies which are then enforced by policy agents on endpoints using public key certificates for authentication. This allows filtering of both internal and external traffic according to the security policy.
MSSP – you’ve probably heard the term, but is it just more industry jargon? With small businesses under constant cyber-attack, the time is ripe to beef up your MSSP offerings.
Many MSPs understand the need for a strong information security portfolio. What they don’t realize, however, is that it’s much more than just a stack of vendor security products and services. You need a strategy and a recipe for success.
Register now to join Eric Rockwell, President and CIO of centrexIT, and Ted Hulsy, VP of Marketing at eFolder, as they share what it means to be a true MSSP. Come get the key ingredients for developing a competitive managed security offering.
A firewall risk assessment is a detailed assessment approach of a firewall topology and configuration that has been implemented to protect your information, systems, applications, and overall business operations.
Este documento describe una infraestructura de red implementada con fines de prueba y monitoreo. La red cuenta con servicios como Active Directory y OwnCloud, así como herramientas de seguridad como un firewall Pfsense, un IPS Smoothsec y un correlacionador de eventos OSSIM. Se explica la arquitectura de red, los equipos físicos y virtuales utilizados, así como las características y funciones de los principales componentes y servicios.
The document discusses identity and access management (IAM). IAM is a framework that facilitates managing electronic identities and controlling user access to information. It encompasses identifying individuals, roles, access levels, and protecting sensitive data. Authentication verifies users' identities through factors like passwords, biometrics, or tokens. Authorization controls access through roles or policies based on attributes. IAM tools automate provisioning and access management. Implementing effective IAM brings security, compliance and efficiency benefits.
1) O documento discute a reestruturação do sistema de backup de uma grande empresa para melhorar a segurança e eficiência dos dados.
2) O sistema de backup anterior tinha janelas longas, falhas frequentes e falta de redundância.
3) A reestruturação resultou em menor janela de backup, maior redundância, menos falhas e relatórios gerenciais mais precisos.
This document discusses the top 10 security risks of cloud computing. It begins with an introduction by Ludovic Petit and provides background on cloud security risks. It then lists and describes each of the 10 risks: 1) Accountability and data risk, 2) User identity federation, 3) Legal and regulatory compliance, 4) Business continuity and resiliency, 5) User privacy and secondary usage of data, 6) Service and data integration, 7) Multi-tenancy and physical security, 8) Incidence analysis and forensics, 9) Infrastructure security, and 10) Non-production environment exposure. The document aims to help organizations assess cloud security risks and ensure cloud providers address these top risks.
The document summarizes research into information security governance awareness at the board of director and executive committee levels. It finds that while many organizations have information security practices in place, such as a chief information security officer and security policies, the effectiveness and alignment with business objectives is unclear. Reporting and monitoring have room for improvement, and awareness remains a challenge. Drivers for implementing governance are typically severe security incidents and legal/regulatory compliance pressures rather than proactive alignment with business strategy.
The document discusses the importance of having IT policies for organizations. It provides reasons for developing IT policies such as preventing abuse of resources, protecting ownership and employees, and meeting regulatory requirements. The document also outlines where IT policies fit within an organization's overall governance structure and lists examples of common IT policy topics such as security, network infrastructure, software, and email policies.
O documento apresenta a política de segurança da empresa Datageo Informática, definindo seus componentes, missão, visão, valores, áreas de atuação, setores e regras de segurança. A política estabelece um comitê de segurança, classifica as informações, define proprietários e usuários de dados, e estabelece políticas sobre acesso à internet, uso de email, senhas, dispositivos móveis, backup e softwares maliciosos.
Cracking of wireless networks is the defeating of security devices in Wireless local-area networks. Wireless local-area networks(WLANs) – also called Wi-Fi networks are inherently vulnerable to security lapses that wired networks Cracking is a kind of information network attack that is akin to a direct intrusion. There are two basic types of vulnerabilities associated with WLANs: those caused by poor configuration and those caused by weak encryption.
The document discusses network security policies and regulations. It begins with introducing the presenters and defines the challenges in defining security policies, measuring against policies, reporting and correcting violations, and summarizing compliance. It then covers the foundation, functions, and management of information security. The document outlines the purpose and elements of policies, and a 10-step approach to developing policies which includes risk assessment, creating a review board, developing a security plan, implementing policies and standards, training, compliance monitoring, evaluation, and modification. Minimum HIPAA security requirements and Creighton-specific policies are also summarized.
This document discusses security technologies taught in an Illinois Institute of Technology course. It covers firewalls, intrusion detection systems, dial-up protection, and other topics. The learning objectives are to define types of firewalls, discuss firewall implementation approaches, and understand technologies like encryption and biometrics. Firewalls examined include packet filtering, proxy, stateful inspection, dynamic, and kernel proxy firewalls. Intrusion detection systems can be host-based or network-based, using signatures or anomalies. Remote authentication and terminal access control systems help secure dial-up access.
Este documento fornece um resumo das credenciais e experiência de Vaine Luiz Barreira na área de computação forense e crimes digitais. Ele descreve suas certificações, associações profissionais e experiência em investigação digital e análise forense. O documento também discute brevemente os tipos de crimes digitais, o processo de investigação forense e os desafios emergentes nessa área.
O documento discute as terapias de calor e frio, seus mecanismos fisiológicos e aplicações terapêuticas. O frio é usado para reduzir inflamação, dor e espasmo muscular, enquanto o calor promove relaxamento muscular e aumenta circulação sanguínea. Ambos devem ser aplicados corretamente de acordo com cada caso para obter benefícios e evitar danos.
소프트웨어 특허 관련 이슈(Software patent related issues)Seung-won CHAE
[UPDATE HISTORY]
2017.09. Below contents updated
- US post-alice 101 overcome cases added (Enfish, Bascon, McRo)
- US 101 rejection OA overcoming strategies added
- CN practice revised: computer-readable claim allowed (2017.04. examination guide revised)
- Overseas server related Korean patent dispute case added
- Software patent specifications and claims review point added
2015.10. Limelight v. Akamai case ( CAFC en banc decision update)
[CONTENTS]
소프트웨어 관련 특허에 대한 다양한 법적 이슈들을 소개합니다.
ABSTRACT: SOFTWARE PATENT?
ISSUE 1: 소프트웨어 특허의 eligibility (Alice Corp. v. CLS Bank)
ISSUE 2: BM 특허의 한계 (Mercexchange v. Ebay)
ISSUE 3: 공동침해 관련 문제 ( Limelight v. Akamai )
ISSUE 4: 역외에 위치한 서버에 대한 특허 침해 ( NTP v. RIM )
ISSUE 5: 네트워크를 통해 유통되는 S/W 보호
HOT ISSUE: API의 저작권 인정? (Oracle v. Google)
SUMMARY: 소프트웨어 특허의 CLAIM 작성 전략
This document discusses three key aspects of customizing security that everyone should know. It discusses (1) creating one's own security framework, (2) realizing threats and what is known, and (3) distinguishing between important and unimportant security issues in an increasingly complex IT environment. The document emphasizes the importance of having an accurate concept, broadening one's insights, and defining what is necessary versus optional in one's security approach.
기업보안 및 개인정보보호 동향
1. 기업보안 배경 및 목적
2. 개인정보보호법
3. 위반사례
4. 보안의 범위
5. 보안체계 수립 절차
Ⅱ. 기술적 보안수준 현황 (As-Is)
Ⅲ. 기업보안 및 개인정보보호를 위한 기술적 조치방안 (To-Be)
Ⅳ. 상세솔루션 방안(案) – ( ISMS PIMS )
1.1 UTM (NW 통합보안 시스템)
1.2 DLP(정보유출방지)
1.3 DRM(문서암호화)
1.4 DB암호화
1.5 WIPS (무선침입방지시스템)
1.6 EMM (모바일 보안)
1.7 물리적 보안 (보안스티커, 보안 봉인커버)
Ⅵ. 최종 제언
[2015년 11월 18일]
CISSP korea 협회에서 발표했던 사물인터넷주제로 발표를 진행했었는데요.
관련 자료 이오니 시간되실때 보시면 좋을거 같습니다.
영화를 통한 보안 이야기라고 생각하시고 편안히 보시면 좋을거 같네요.
[2015.11.18]
I was presented at the The CISSP korea chapter in seoul.
the title of name is internet of things with you future.
I hope this helped.
How do you think Internet of Things technology will change in the future?
i lecture special cissp korea chapter for 40 min.
contect title of name is Internet of thing with your future.
have a nice day~~~
조직내 권한 계정에 대한 탐색-온보딩-접근제어-감사-기록
접근제어 및 인증 관리
-통합 인증
(Single Sign-On)
- 비밀번호 사용 없는
MFA적용
- 엔드포인트 접속
-Identity 보안
권한 제어
- 자격증명 정보 관리
-공용 계정 및 접속 계정에
대한 세션 관리
- 적절한 권한으로 적절한 시간에 사용 제어
자격관리(Entitlements)
- 프로비저지닝/디프로비저닝 관리
- 사용 권한에 대한 모니터링 및
관리
"Secret Asset"은 일반적으로 보안 및 비밀 유지를 위해 조직이나 개인이 보유하고 있는 중요한 자산을 지칭하는 용어로 보안 과 관련된 다양한 정보, 자료, 자원, 시스템, 서비스 등으로 암호화키, 패스워드, API 토큰, 인증서, 민감한 데이터, 기밀 문서, 저 작권 소유권 등의 무형 자산과 그 자산을 관리하는 시스템, 서버, 서비스, 소프트웨어 등 유형 자산을 포함합니다. CSAM은 클라우드 환경에서의 이러한 다양한 비밀자산을 관리하는 솔루션입니다.
자산관리 대상에 대한 명확한 기준 정보 관리, 운영관리, 비용관리, 인프라 구축, 초기 데이터 이행, 통계정보 및 사용자 관리의 전 영역을 포함하는
IT통합 자산DB로 구성되어 있으며 Life Cycle 관리를 통하여 불필요한 비용을 절감하고 일원화된 관리 시스템으로 담당자의 업무 부담 감소와 효율성을 향상 시킬 수 있습니다
ESM solution
엔드 포인트 보안관리 솔루션 End-point Security Management
핵심 All In One [정보유출방지,개인정보보호, 화면워터마킹, 매체통제, 온라인보안, 문서관리, 출력물보안, 물리보안]
All In One 통합 보안관리
물리보안, 출력물, 네트워크, 문서 및 개인정보, 보안 검사까지 전반적인 전산 보안 구축 및 운영 시 필요한 모든 기능을 하나의 시스템으로 구현하여 운영 관리의 효율성 극대
K-Defense R8(vKeypad)는 가상 보안키패드로서, 키보드를 사용하지 않고 입력단 정보를 보호는 기능을 제공 합니다. 가상 보안키패드와 키보드보안 솔루션을 병행 운영하여 이용자 환경과 선택에 따라 사용 할 수 있으며, 이는 보다 높은 안정성과 보안성을 제공 됩니다.
키보드 입력 값에 대한 탈취는 정통적이고 지속적으로 발생되는 해킹 기법 중에 하나 하며, 점점 지능화 고도화 되고 있습니다. 그에 대응하여 키보드보안솔루션 영역이 확대되었고, 그 연장선에서 종단간암복화(End-To-End) 기능은 키보드 입력부터 암호화하여 WAS 서버에서 복호화를 수행하는데 패스워드 형태 값은 기밀성, 텍스트 행태 값은 무결성을 보장하게 하여 메모리 참조 및 변조 취약점에 대응하는 보안성 높은 구조를 제공 합니다.
ActiveX 형태에서 제공 되던 인터페이스 함수를 똑 같이 non-ActiveX에서도 지원하여 실 작업자 분들에게 편의성과 호환성을 제공하고 사후 관리에서도 도움 됩니다.
2. 1
Ⅰ. 제안배경
1. 산업기술유출방지법, 정보통신망 이용촉진 및 정보보호 등에 관한 법률
산업기술유출방지법 주요내용
정보통신망 이용촉진 및 정보보호 등에 관한 법률 주요내용
국내 핵심기술 보호 및 산업기술의 부정한 유출을 방지하고, 산업기술을 보호함으로써 국내산업의 경쟁
력을 강화하며, 국가의 안전과 국민경제의 안정을 보장하기 위해 제정된 법률.
• 산업기술과 국가핵심기술을 정의 (법 제2조)
• 산업기술 보호정책 및 보호지침수립 시행 (법 제 5조/제 6조/제 8조)
• 산업기술 유출 행위에 대한 처벌 (법 제 36조~제 37조)
정보통신망 이용을 촉진하고 정보통신 서비스를 이용하는 자의 개인 정보를 보호함과 아울러 정보통신망
을 건전하고 안전하게 이용할 수 있는 환경을 조성하여 국민 생활 향상과 공공복리 증진에 이바지함을 목
적으로 제정된 법률.
• 제4장 개인정보의 보호
• 제1절 개인정보의 수집ㆍ이용 및 제공 등
• 제2절 개인정보의 관리 및 파기 등
• 제6장 정보통신망의 안정성 확보 등
• 제48조(정보통신망 침해행위 등의 금지)
• 제48조의2(침해사고의 대응 등)
• 제51조(중요 정보의 국외유출 제한 등)
3. 2
Ⅰ. 제안배경
2. 개인정보보호법 주요내용
2011.09.30
2008~2011
- 개인정보 보호법 시행
- 행정처분 유예기간 종료(12.03.29)
2011: 본회의 및 국무회의 의결, 공포
2008: 개인정보 보호법 국회제출
개인정보보호 규정
• 인터넷상 주민번호
이외의 회원가입 방법
제공
• 개인정보처리방침 공개
• 개인정보 보호책임자
지정
• 개인정보 안전성
확보조치
개인정보보호 규정
• 개인정보 수집의 제한
(필요최소한의 정보수집 등)
• 민감정보 및 고유식별정보 처리 제한
• 영상정보처리기기 설치 운영
• 개인정보의 제3자 제공, 목적 외 이용제공
금지
• 개인정보 처리위탁, 영업양도 등 개인정보
이전
• 개인정보 파기
관
리
수집
이용
제공
위탁
파기
개인정보처리
개인정보 보호법 제29조, 동법 시행령 제30조 및 개인정보
보호 가이드라인 등에 의하여
“개인정보처리자는 개인정보가 분실·도난·유출·변조 또는 훼
손되지 아니하도록 내부 관리계획 수립, 접근통제, 접근권한
제한, 암호화 기술 적용, 접속기록 보관 등 안전성 확보에 필
요한 기술적·관리적 및 물리적 조치를 하여야 함”
4. 3
Ⅱ. 보안솔루션 Roadmap
개인정보보호법 및 정보통신망법 시행과 IT보안강화를 위하여 최종 보안 단계는 4단계까지 준비되어야 합니다.
분 류
컨설팅
1단계
정보보호컨설팅
2단계 3단계
보안 정보전략계획(ISP)
4단계
데이터 보안
• DB 암호화 솔루션
• DB 접근제어 솔루션
• 내부정보유출방지솔루션(DLP):개인정보보호솔루션포함
• 문서암호화 솔루션(DRM)
• PC백업 및 파일 중앙화 솔루션
• 모바일보안(MDM,Mobile DLP)
네트워크 보안
• 방화벽(FireWall)
• 웹구간 암호화(SSL)
-침입탐지시스템(IDS)통
합보안시스템(UTM)
-침입차단시스넴(IPS)좀비
PC탐지솔루션
네트워크접근통제(NAC)
시스템 보안 바이러스백신(서버) 패치관리시스템(PMS)
보안운영체제(SecureOS)
취약점분석솔루션
서버접근제어솔루션
서버가상화솔루션
어플리케이션 보안
• 웹방화벽/웹서비스개인정보 노출방지솔루션
• 업무시스템 개인정보 접속/조회 로그관리솔루션
• 출력물보안시스템
웹스캐너(취약점분석) 소스코드분석도구
통합보안 관리 통합로그관리
전사적보안관리(ESM)
보안구성관리(SCM)
위험관리시스템(TMS)
위험관리시스템(RMS)
인증 및 접근통제
싱글사인온(SSO)
통합접근관리(EAM)
통합계정관리(EIM)
패스워드통합관리
바이오시스템
PC보안
• Virus/스파이웨어백신
• PC내 개인정보 검색
키보드보안솔루션
-통합PC보안
PC가상화솔루션
: 본 사업에서 검토 범위
5. 4
Ⅲ. 취약점 분석을 통한 솔루션 적용방안
연우가 내부정보 유출방지의 요건에 대한 고려요소는 아래와 같이 이해하고 있습니다.
내부
보안
내부 중요정보 유출방지에 대한 대안은?
어떤 보안솔루션을 도입해야 연우의 요건에 맞는 내부정
보 유출방지 시스템을 구축할수 있는지?
PC에 저장된 개발소스에 대한 Backup 및 보안방안?
외부
협업
보안
외부 협력업체 및 관련기관과의 협업시 보안방안은?
연우의 업무특성상 외부 협력업체 및 외부 유관기관과의
데이터 공유시 보안의 문제점을 해결할 수 있을지?
업무의
연속성
확보
보안 솔루션 도입으로 인한 업무연속성 확보 방안은?
보안솔루션의 특성상 도입이후 예상되어지는 업무의 불
편성을 최소화 할 수 있는 보안솔루션 및 보안정책은 어
떤 것이 적절할 지?
구축 후
운영적인
측면
보안 솔루션 도입 이후 사후 관리의 편리성은?
보안솔루션 도입이후 유지보수의 편리성 및 비용적인 측
면을 고려시 적절한 보안솔루션은?
DRM ?
(Digital Right
Management)
DLP ?
(Data Loss Prevention)
출력보안?
(Secure Print)
PC백업 및 중앙화/모바일
향후 발전방향 고민?
6. 5
본 검토에 대한 연우의 고려요소와 요건을 분석하여 데이타적인 측면과 보안적인 요구사항 및 업무의 연속성을 고민하여 아래와 같이
제안하고자 합니다
Ⅳ. 취약점 분석을 통한 솔루션 적용방안
중요 정보를 다루는 부서 및 개인정보를 다루는 부서에 대하여는 파일 자동암호화를
적용하고, 개발소스에 대한 로컬저장 금지 및 PC백업 등 고려하여 솔루션을 선정 적용할 필요가 있음.
또한 클라우드 및 모바일 업무 확장을 고려하여 검토해야 함
대량의 정보유출 위협인 저장매체(USB,CD,이동식디스크 등) 에 대하여는 DLP의 기능인 매체통제
기술을 적용하여 매체차단 정책 적용하고, 필요시 승인프로세스 적용후 매체사용기능을 제공하고
승인완료 후, 매체로 복사되는 모든 파일에 대한 로그를 수집함
최후의 유출경로인 종이로 유출되는 보안위협에 대하여 출력물보안 기술을 적용하여, 모든 출력물
에 대한 원본을 수집 기능을 적용함
7. 감사합니다
상담(구축) 문의
솔루션사업부 이유신 이사
Tel : 070-4685-2648 (대)
H/P : 010-2700-2648
E-mail : zion@zionsecurity.co.kr
www.zionsecurity.co.kr