Abstract: Recent widespread use of information and
communication technology has greatly changed information security
risks that businesses and institutions encounter. Along with this
situation, in order to ensure security and have confidence in electronic
trading, it has become important for organizations to take competent
information security measures to provide international confidence that
sensitive information is secure. Against this backdrop, the approach to
information security checking has come to an important issue, which
is believed to be common to all countries. The purpose of this paper is
to introduce the new system of information security checking program
in Korea and to propose synthetic information security
countermeasures under domestic circumstances in order to protect
physical equipment, security management and technology, and the
operation of security check for securing services on ISP(Internet
Service Provider), IDC(Internet Data Center), and
e-commerce(shopping malls, etc.)
Abstract: Information and communication service providers
(ICSP) that are significant in size and provide Internet-based services
take administrative, technical, and physical protection measures via
the information security check service (ISCS). These protection
measures are the minimum action necessary to secure the stability and
continuity of the information and communication services (ICS) that
they provide. Thus, information assets are essential to providing ICS,
and deciding the relative importance of target assets for protection is a
critical procedure. The risk analysis model designed to decide the
relative importance of information assets, which is described in this
study, evaluates information assets from many angles, in order to
choose which ones should be given priority when it comes to
protection. Many-sided risk analysis (MSRS) grades the importance of
information assets, based on evaluation of major security check items,
evaluation of the dependency on the information and communication
facility (ICF) and influence on potential incidents, and evaluation of
major items according to their service classification, in order to
identify the ISCS target. MSRS could be an efficient risk analysis
model to help ICSPs to identify their core information assets and take
information protection measures first, so that stability of the ICS can
be ensured.