Cybersecurity and Challenges to Democracy
South Korea’s democracy can only be described as… developing. In the late 1970s, after the assassination of Military Dictator Park Chung-hee (who Koreans often refer to as ‘President Park’), slow but relatively steady progress in terms of democracy was made in South Korea. This despite the fact that the North Korean threat, and communism in general, was a topic constantly abused to allow the government to gain more power.
Recent incidents, however, have prompted a vie for power within the South Korean government that will have serious consequences for South Korea’s democracy going forward. In the recent weeks North Korea has been saber rattling per usual, to which South Koreans are generally unaffected. One issue with this situation, however, is that the recent cyber attacks on South Korean banking and broadcasting systems are also being attributed to North Korea without, at the time of this writing, any verifiable proof that North Korea carried out the attacks. South Korea currently has IP addresses tracing back to various countries, and attack patterns that are “similar” to those used by North Korea in the past. At best, the evidence is unsubstantial. However, the South Korean National Intelligence Service (NIS) (think C.I.A. on steroids) has formally released a statement claiming North Korean involvement, which, of course, no one can confirm or deny.
This statement comes days after the exceedingly toned-down proposal of the South Korean “National Cyber Terror Prevention Act”. This act, in essence, gives the NIS, or NIS-controlled groups, full power to create, vote on and enforce anti-cyber terror policies through the creation of an NIS-lead “cyber control tower”. Ironically, the act itself was proposed by the very members of Congress who are responsible for keeping the NIS in check. The most interesting aspect of the act, however, is the definition of cyber terror. Cyber terror, according to the act, can potentially be almost anything.
Consider that the NIS was created during the time of a military dictatorship with the express intention of fighting communism. Because of that, the NIS effectively reports to no authority save for the president. The NIS has, in the past, attempted to push anti-terrorism acts that would allow them even more power with little checks on how that power is used and abused. However, when discussing physical terrorism, many experts can, and have, resisted such a push. Cyber terrorism, however, is extremely vague. So much so that even experts in the field do not agree on its definition and how it should be handled. This is a problem most countries are currently facing that is related to the lack definition of terms like cyber crime, cyber war and cyber terrorism. Because of the lack of definition, government agencies all over the world are attempting to create jurisdiction around whatever term they choose, generally focusing on which term will bring the most power and budget benefits rather than which term correctly describes the situation.
South Korea is an extreme example of how agencies can combine fear with vague terms to expand their power. Of course, this is all made possible because the South Korean people allow it to happen, normally through complacency and cultural restrictions. However, regardless of culture, similar situations are happening in most countries right now. While a centralized all-knowing government ‘cyber control tower’ may have some benefits, it simply won’t stop cyber crime/terror/war. Further, what benefit such an over-powered group could contribute to a democratic society is completely undermined that group’s ability to abuse such power.
The reality is, cyber crime/terrorism/war is largely made possible by the public, and just like ‘traditional crime’ will never be completely stopped. The general public (globally) appear to have little interest in securing themselves, and they are about to give up what little freedom they have so their governments can ineffectively protect the people from themselves. Anyone who chooses to use technology should take responsibility for themselves, get informed and start implementing basic cyber security practices. If the people start securing themselves, the majority of digital crimes can be drastically reduced, and it won’t cost anyone hard-earned freedoms to do it.
[PDF]
South Korean National Cyber Terrorism Prevention Act (English)
| An unofficial English translation of the proposed South Korean National Cyber Terrorism Prevention Act. The recently proposed South Korean National Cyber Terrorism Prevention Act: [Korean PDF] |
[English PDF] <div style="text-align: center;">National Anti-Cyberterrorism Act (Legislative Bill)</div>(April 9, 2013) Rationale The cyberspace, which is a virtual space connecting computers and other information technology devices through networks, now has not only become a common space for the daily lives of all citizens, but also transcends borders among states and public/private sector. Due to its uniqueness, both public and private sectors cannot unilaterally block all cyber-attacks that occur beyond space and time. Furthermore, unlike disorder in the physical world, a single person can potentially cause national crisis by launching a cyber terror attack. Cyber crisis can have enormous influence on the whole society. Attacks on national major information communications network as shown in the case of 1.25 Internet crisis(Slammer Worm), and organized cyber terrorism from overseas that can lead to leakage of national secrets and technology, is increasing everyday, and is more likely to occur in the future. However, Korea has yet to establish a systematic national anti-cyberterrorism plan or policies and specific procedures to manage such crises. In case of a cyber crisis, this situation may lead to severe danger and serious damage to national security and national interest. Therefore this bill proposes the establishment of a national comprehensive response system involving the government and the private sector, hence detect cyber terror attacks in advance to prevent national cyber crisis and concentrate national capacity in times of crisis to take prompt action. Executive Summary A. The Director of the National Intelligence Service (hearafter NIS) may organize and operate a public-private consultative body in order to efficiently manage cyber crisis and mutually share information related to cyber-attacks (Article 5). B. The Director of the NIS should establish the master plan of national cyber terror prevention and crisis management and construct an implementation plan to distribute to the Heads of responsible agencies (Article 7). C. Establishment of the National Cyber Security Center under the Director of the NIS for a comprehensive and systematic national response to cyber terrorism and management of cyber crisis (Article 9). D. Heads of responsible organizations should either establish and operate a Security Management Centre capable of detecting and analyzing cyber-attack information and promptly response to such 1threats, or depute the task to a Security Management Centre established and operated by other institutions (Article 12). E. Heads of central administrative agencies should immediately carry out investigations when damage occurs due to a cyber terror attack, and should notify the Heads of related administrative agencies and the Director of the NIS in cases of critical damage (Article 13). F. The Director of the NIS can issue the Cyber Crisis Alert in the interest of systematic response to cyber terrorism, and the Heads of responsible organizations should take appropriate measures to minimize or restore damage (Article 15). G. The government may organize and operate Cyber Crisis Response Headquarters consisting of related institutions and professionals for analysis, investigation, immediate response, and damage restoration when a Cyber Crisis Alert higher than Alert state is issued (Article 16). H. The government may carry forward policy measures necessary for cyber crisis management, such as technology development, international cooperation, industry development, and human resource development (Article 19, 20, and 21). I. The government may give monetary reward to those who provide information on cyber terror attempts or report cyber terrorists (Article 24). J. Those who divulge official secrets are sentenced to maximum five years in prison or fined to maximum 30 million won. Those who have not established a Security Management Centre may be charged with maximum 20 million won for negligence (Article 25 and 26). *Legislative Bill for National Anti-Cyberterrorism Act Chapter 1 General Provisions Article 1 (Purpose) The purpose of this Act is to contribute to national security and national interest by stipulating the fundamental situations of national cyber terror prevention in order to prevent cyber terror which threatens national security and enable prompt response by concentrating national capacity in cases of cyber crises. Article 2 (Definitions) 1) The definition of the terms used in this Act is as follows. 1. “Cyber Terrorism” refers to all offensive actions that intrude, disturb, paralyze, or destroy information telecommunication infrastructure, or actions related to information theft, damage and 2dissemination of distorted information by electronic means such as hacking, computer virus, denial of service, and electromagnetic wave. 2. “Cyber Security” refers to measures and responses through administrative, physical, technological means in order to protect information telecommunication infrastructure and information from cyber terrorism, and includes cyber crisis management. 3. “Cyber Crisis” refers to a situation in which a cyber terror attack causes serious disruption to the function of the state and society or could potentially spread damage nationwide. 4. “Cyber Terror information” refers to information of certain actions determined by information systems and information security system (including software) as cyber terrorism, and includes IP addresses and MAC addresses used to identify the source of the cyber attack. 5. “Cyber Crisis Alert” refers to alerts issued in order to provide cyber threat information when a cyber crisis is expected to occur, thereby enabling related organizations to take appropriate measures according to the threat level. 6. “Cyber Crisis Management” refers to all national level measures and actions pertaining to cyber terror detection, response, investigation, restoration of damage, mock exercise, issuance of warning and cooperation among agencies in order to prevent cyber crisis and systematically take prompt action in case of cyber crisis. 7. “Agencies Responsible of Cyber Terror Prevention and Crisis Management (“Responsible Agencies”)” refers to the following agencies performing tasks related to cyber terror prevention and crisis management. a. <Constitution (대한민국헌법)>, <Government Organization Act (정부조직법)>, other national agencies and local autonomous entities established by other legislation, and public institutions according to Article 3, paragraph 10 of <Framework Act on National Informatization (국가정보화 기본법)> b. Agencies in charge of managing major information and communications infrastructure according to Article 5, paragraph 1 of <Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법)> c. Business operator of clustered information and communications facilities according to Article 46, paragraph 1, and major providers of information and communications services according to Article 47-3, paragraph 2 of <Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.(정보통신망 이용촉진 및 정보보호 등에 관한 법률)> 3d. Corporations or research institutes which hold National Core Technology according to Article 9 of <Act on Prevention of Diligence and Protection of Industrial Technology (산업기술의 유출방지 및 보호에 관한 법률)> e. Defense contractors according to Article 3, paragraph 9, and specialized research institutes according to Article 3, paragraph 10 of <Defense Acquisition Program Act (방위사업법)> 8. “Support Institution for Anti-Cyberterrorism and Crisis Management (“Support Institution”)” refers to the following institutions or corporations which support prompt detection, response, investigation, and damage restoration of cyber terror. a. Electronics and Telecommunications Research Institute (ETRI) Affiliated research institute according to Article 8 of<Act for the Establishment, Management and Promotion of Government-supported Research Institutes in the Science and Technology Sector (과학기술분야 정부출연연구기관 등의 설립 운영 및 육성에 관한 법률)> b. Korea Internet Security Agency (KISA) according to Article 52 of <Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (정보통신망 이용촉진 및 정보보호 등에 관한 법률)> c. Software business operators who produce or sell antivirus software according to Article 24 of <Software Industry Promotion Act (소프트웨어산업 진흥법)> d. Producers or importers of information protection system according to Article 3, paragraph 9 of <Framework Act on National Informatization (국가정보화 기본법)> e. Designated consulting companies specialized in knowledge and information security according to Article 9 of <Act on the Promotion of Information and Communications Infrastructure (정보통신기반보호법)> f. Companies specialized in security management designated by the Head of related administrative agencies 2) Apart from the terms defined above, other terms used in this Act accords to <Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법)>, <Act on Promotion of Information and Communications Network Utilization and Information Protection, etc (정보통신망 이용촉진 및 정보보호 등에 관한 법률)>, <Framework Act on National Informatization (국가정보화 기본법)>, <Telecommunications Business Act (전기통신사업법)>. Article 3 (Relations to other legislations) 4This Act shall be applied with the exception of clauses of other legislations that regulate the prevention of cyber terror and crisis management. However, if a cyber crisis occurs, this Act shall supercede other legislations in application. Article 4 (Obligation of Responsible Agencies) Chief of Responsible Agencies are responsible for maintaining safety of information communications facilities within their jurisdiction in order to prevent cyber terror. Accordingly, they should devise measures to secure professional workforce dedicated to and budget necessary for the prevention of cyber terrorism and crisis management. Article 5 (Public-Private Cooperation) 1) The government may organize joint consultative bodies with private institutes according to the Presidential decree in order to efficiently manage cyber crisis and cooperate to prevent cyber terror and take appropriate countermeasures. 2) Other considerations necessary for paragraph 1 shall be prescribed by Presidential Decree. Chapter 2 National Cyber Terror Prevention and Crisis Management System Article 6 (National Cyber Security Strategy Council) 1) The National Cyber Security Strategy Council (hereinafter refer to as“Strategy Council”) shall be established under the Director of the NIS to deliberate important matters regarding national anti- cyberterrorism and crisis management. 2) The Director of the NIS chairs the Strategy Council. 3) The Strategy Council shall have vice-minister class officials of central administrative agencies and those appointed by the Chairman of the Strategy Council (= Director of the NIS). 4) The Strategy Council shall deliberate the following. 1. Establishment and improvement of cyber terror prevention and crisis management strategies, policies, and institutions 2. Problems pertaining to role adjustment among agencies related to cyber terror prevention and crisis management 3. Problems pertaining to sharing and protecting cyber threat information according to Article 12, paragraph 2 4. Other problems presented by the Chairman of the Strategy Council (= Director of the NIS) or submitted by council members 55) The Strategy Council may set up a National Cyber Security Countermeasure Council (hereinafter refer to as “Countermeasure Council”) in order to efficiently operate the Strategy Council. 6) Other specific matters pertaining to the organization and operation of the Strategy Council or the Countermeasure Council shall be prescribed by Presidential Decree. Article 7 (Establishment of a Master Plan for National Anti-cyberterrorism and Crisis Management) 1) The Government should establish and implement National Anti-cyberterrorism and Crisis Management Master Plan (hereinafter refer to as “Master Plan”) in order to efficiently and systematically push forward measures for cyber terror prevention and crisis management. 2) The Master Plan shall be outlined by the deliberation of the Strategy Council and discussion among the Director of the NIS and Heads of related central administrative agencies according to Presidential Decree. 3) The Head of central administrative agency should devise and disseminate National Anti- cyberterrorism and Crisis Management Implementation Plan (hereinafter refer to as “Implementation Plan”) to Heads of sub-agencies in order to enable them to utilize the Master Plan according to paragraph 1. Article 8 (Confirmation of Compliance to the Implementation Plan and Report to the National Assembly) 1) The Head of central administrative agency should annually confirm the compliance of its sub- agencies to the Implementation Plan. 2) The Director of the NIS gather the confirmation results of paragraph 1 and conduct an inspection of the actual condition of national cyber terror prevention and crisis management, and report the results to the National Assembly. However, inspection and assessment of the National Assembly, Court, Constitutional Court, National Election Commission shall be conducted only when requested by each entity. 3) Procedures and means necessary for paragraph 1 and 2 shall be prescribed by Presidential Decree. Article 9 (Establishment of National Cyber Security Center) 1) For a comprehensive and systematic state- level prevention of and response to cyber terrorism and cyber crisis management, National Cyber Security Center (hereinafter refer to as “Security Center”) shall be established under the Director of the NIS. 2) The Security Center shall undertake the following duties. 1. Establishment of national anti-cyberterrorism and crisis management policies 62. Support for the Strategy Council and the operation of the Countermeasure Council 3. Collect, analyze and disseminate information related to cyber terror 4. Secure the safety of national information communications network 5. Devise and disseminate national cyber terror prevention and crisis management manual 6. Investigate cyber terror cases and support recovery from damage 7. Cooperation with other countries in sharing cyber attack information 3) The Director of the NIS may set up and operate a Private-Public-Military Joint Response Team (hereinafter refer to as “Joint Response Team”) in order to support comprehensive judgment, situation management, threat causation analysis, investigation, etc. according to paragraph 1 when necessary. 4) The Director of the NIS may request the Head of central administrative agency or other support agencies to dispatch workforce and provide equipment necessary for the establishment and operation of the Joint Support Team when needed. Chapter 3. Anti-cyberterrorism and Cyber Crisis management ac Article 10. (Establishment and Operation of Anti-Cyberterrorism policy) 1) To secure the safety and reliability of information and its network, heads of Responsible Agencies shall establish Anti-cyberterrorism policy. 2) The Director of the NIS may prepare and deliver a necessary guideline for establishment of Anti- cyberterrorism prevention policy. In this case, The Director of NIS shall consult with a head of central administrative agencies concerned in advance. 3) In the case of paragraph 2) applied to central administrative agencies of the National Assembly, court, constitutional court and national election commission, it is applied only in a case that the head of concerning agency or institution considers it necessary. Article 11 (Precluding spread of malicious program) 1) If the Government becomes aware of websites or software including malicious program, it shall provide related information to operators so that they can take measures for security necessary to preclude spread of malicious program. 2) The Government may, if it judges the compromised websites or software is highly likely to be misused and potentially dangerous despite measures under paragraph 1), delete or block them by using anti-virus program. 3) Specific details necessary measures pursuant to paragraph 10 or paragraph 2) shall be prescribed by the Presidential Decree. 7Article 12 (Establishment of Security Control Center etc) 1) Head of a Responsible Agency shall establish and manage an organization which is able to detect and analyze cyberterrorism information, and immediately response, or entrust the work to a security control center which agencies, following subparagraph, establish and manage. Provided, Information Sharing & Analysis Center, in accordance with Article 16 of Act on the Protection of Information and Communications Infrastructure, is deemed as a security control center 1. Relevant Central Administrative Agencies 2. National Intelligence Service 3. Specialized Security Control Corporation in accordance to Article 2-Paragraph 1) - Subparagraph f 2) Head of Responsible agencies shall share cyberterrorism information, and vulnerability of information networks or software etc, in accordance with Paragraph 1) (hereinafter refer to as “Cyber Threat information”), with heads of relevant agencies and the Director of the NIS 3) For efficient management and operation of Cyber Threat information, in accordance with Paragraph 2, The Director of the NIS may establish and manage Cyber Threat information integration system with heads of relevant agencies. 4) Any person shall fairly use and manage the information shared in accordance with paragraph 2, , only within the scope of Cyber Crisis management. 5) Security Control Center, in accordance with paragraph 1, establishment and management of Cyber Threat information integration system’s establishment and management, and matters concerning information management, in accordance with paragraph 3, scope, process and method of Cyber Terror information sharing, in accordance with paragraph 2, shall be prescribed by the Presidential decree. Article 13 (Incident investigation) 1) In the case when damages made to the jurisdiction of a central administration agency, the head of the central administration agency shall conduct incident investigation swiftly on the cause and damages, and in the case of severe damages or concerns over the possibility of expansion of damages, he/she shall immediately notify the results to the head of related central administration agency and the Director of the NIS. 2) Despite the paragraph 1), when the case is deemed to cause severe impacts on national security and interest, the Director of the NIS can consult the related central administration agency and conduct the investigation on its own. 83) In the case when swift actions are deemed to be necessary for restoration and prevention of further damages according to the notification of the investigation result regarding paragraph 1) or the NIS’s own investigation regarding paragraph 2), the Director of the NIS may request necessary measures to heads of responsible agencies. The responsible agency’s heads must abide by the request if there is no substantial reason not to. 4) No person shall delete/damage/modify data related to cyber terror before the incident investigation regarding paragraph 1) and 2) Article 14 (Response Training) 1) The Government shall execute training programs to prevent cyber terror from happening and respond systematically and efficiently. 2) Trainings regarding paragraph 1) may either be executed regularly every year or be conducted as occasion demands, and regular training may be executed together with Emergency Preparedness Training regarding Article 14 of <Emergency Preparedness Resources Management Act (비상대비자원관리법)> 3) The necessary issues including the execution method and procedure of the training regarding paragraph 1) etc. shall be prescribed in the Presidential Decree. Article 15 (Announcement of Cyber Crisis Alert) 1) To systematically prepare and respond to cyber terror, the Director of the NIS may announce four-stage Cyber Crisis Alert (moderate/substantial/secure/critical), based either on the request of the head of a responsible agency or on the complement/ judgment of intelligence gathered regarding Article 12 paragraph 2). 2) In the case when a cyber terror is deemed to cause serious damage to national security, the Director of the NIS may consult the Senior Secretary to the President for National Crisis Control in the National Security Department to announce critical-level alert, and in the case of the announcement of a critical-level Alert, it shall inform the reason of the announcement to the National Assembly. 3) The Director of the NIS shall consult the level of Cyber Crisis Alert prior to the announcement. 4) The head of responsible agencies should take measures to minimize occurring damages and to foster restoration immediately after the announcement of Cyber Crisis Alert regarding paragraph 1). 5) The necessary issues regarding the procedure, criteria, measures by heads of responsible agencies, etc. shall be prescribed in the Presidential Decree. Article 16 (Organizing Cyber Crisis Response Headquarters) 91) In the case of a Cyber Crisis Alert above the “Caution-level”, the Government may organize and operate Cyber Crisis Response Headquarters (hereinafter refer to as “Response HQ”), in which experts from private sectors, the Government and the Military participate to concentrate national capacity, for swift responding measures such as analysis of causes, investigation, emergency response, recovery of damages, and etc. 2) The head of Response HQ (hereinafter refer to as “Head”) shall be the Director of the NIS, and the necessary issues regarding the organization and operation of Response HQ shall be determined after the Director of the NIS consults with related central administrative agencies’ heads. 3) The Head may request needed workforce and equipment from responsible agencies and supporting agency heads in order to organize/operate the Response HQ stated in paragraph 1). The responsible agencies and supporting agencies’ heads must abide by the request if there is no substantial reason not to. 4) The Head may provide occurred expenses to the head of agencies that dispatched workforces and equipments to the Response HQ. Article 17 (Technical Assistance) 1) In the case the head of a responsible agency need support to operate on duties regarding Article 12 paragraph 1) and Article 15 paragraph 4), he/she may request support from the head of the related central administrative agency or the Director of the NIS. 2) The head of related central administrative agency or the Director of the NIS shall provide necessary measures including technical assistance when it received the request regarding paragraph 1), so to insure swift responses. 3) Regarding the support in paragraph 2), the head of related central administrative agency or the Director of the NIS may request support of the requesting agency, and shall provide the content and period of support beforehand. 4) The head of related central administrative agency or the Director of the NIS may provide incurred expenses to the head of agencies for the support regarding paragraph 3). Chapter 4. R&D, Support etc Article 18(Provision for Responsible Agency) The Government may provide the Responsible agencies necessary technical assistance, equipments and other needed support in order to protect information & communications network. 10Article 19(R&D) 1) The Government may promote the following policies for technology development and improvement necessary for the prevention of a Cyber Terror and Cyber Crisis management; 1. Establishment and operation of national research and development plan for Cyber Terror prevention and Cyber Crisis management 2. Survey on the needs of Cyber Terror prevention and Cyber Crisis management technology / project about trend analysis 3. Cyber Terror prevention and Cyber Crisis management technology’s development, supply and distribution project 4. And so forth, necessary matters concerning Cyber Terror prevention and Cyber Crisis management technology’s development and improvement 2) In accordance the paragraph 1, the Director of NIS may establish research institute or designate agency established by other act as a specialized agency. 3) The Director of the NIS may settle detailed matters concerning process and method of Cyber Terror prevention and Cyber Crisis management technology Article 20(Industry Promotion) 1) For industry promotion support on Cyber Terror prevention and Cyber Crisis management technology, Government shall establish and operate policies as follow, and find necessary finance securing method. 1. Support for policy establishment about Cyber Terror prevention and Cyber Crisis management industry 2. Support of market invigoration for Cyber Terror prevention and Cyber Crisis management technology development 3. Establishment of industry-academic cooperation for Cyber Terror prevention and Cyber Crisis management industry promotion 4. Support for International exchange and cooperation, and overseas expansion of Cyber Terror prevention and Cyber Crisis management industry 2) Government may let a research institute or a specialized agency, stated in Paragraph 2) of Article 19, operate a necessary task for industry promotion, stated in paragraph 1). Article 21(Education, Training and Public Awareness) For base-establishment of Cyber Terror prevention and Cyber Crisis management, and improvement of public awareness about Cyber Crisis, Government shall devise measures as follow; 111. Manpower training about Cyber Terror prevention and Cyber Crisis management 2. Publicity and education about Cyber Terror prevention and Cyber Crisis management 3. And so forth, necessary matters concerning education, training and public awareness about Cyber Terror prevention and Cyber Crisis management Article 22 (International Cooperation) The Government may execute the following matters to strengthen cooperation with international organizations, agencies and foreign countries in the case of Anti-cyberterrorism and Cyber Crisis management. 1. Construct mutual cooperation system for prevention of cyber terror and Cyber Crisis management 2. Sharing of Information and response coordination in technologies regarding Anti- cyberterrorism and Cyber Crisis management 3. Secondment/training of personnel-in-charge for Anci-cyberterrorism and Cyber Crisis management Article 23 (Confidentiality) Any person who engages or engaged in a job related to the prevention of cyber terror and Cyber Crisis management affairs shall not divulge to another person any secret that he/she has learned while performing his/her duties, nor use it for any purpose other than performance of his/her duties. Article 24 (Reward, etc.) 1) Regarding the prevention of cyber terror and Cyber Crisis management, the Director of the NIS may award a prize to a person that suits the followings, and may provide rewards within the boundary permitted by its budget. 1. Person who provided information on the attempt of a cyber terror 2. Person who reported on the actor(s) of cyber terror 3. Person who provided an outstanding service in detecting, responding to, and recovering from a cyber terror 2)The criteria, manner and procedure, concrete amount of the money paid, and other necessary issues in awarding a prize and reward will be determined by the Director of the NIS. Chapter 5. Penal Provisions 12Article 25 (Penal Provisions) 1) Any person falling under any of the following subparagraphs shall be punished by imprisonment with prison labor for at most five years or by fine not exceeding 30 million won; 1. Any person in violation of Article 12 paragraph 2) and Article 12 paragraph 4) 2. Any person in violation of Article 13 paragraph 4) 3. Any person in violation of Article 23 2) Any person falling under any of the subparagraph 1. due to negligence in the conduct of business shall be punished by imprisonment with prison labor for at most two years or by fine not exceeding 10 million won. Article 26 (Penalty) 1) Any person falling under any of the following subparagraphs shall be charged not exceeding 20 million won for penalty; 1. Any person in violation of Article 13 paragraph 1) 2. Any person in violation of Article 16 paragraph 3) 2) Any person in violation of Article 13 paragraph 3) shall be charged not exceeding 10 million won for penalty. 3) Penalty being charged due to paragraphs 1) and 2) shall be imposed and collected by related National Administration Agency as prescribed in the Presidential Decree. This unofficial translation is made for academic researches and reviews. Any comments and/or suggestion will be very helpful for the improvement of cyber-security of Korea and the World. Please leave a comment, or email me. |
South Korean National Cyber Terrorism Prevention Act (Korean)
| The recently proposed South Korean National Cyber Terrorism Prevention Act: [Korean PDF] | [English PDF] êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??ë²•ë¥ ??br />(?œìƒê¸°ì˜???€?œë°œ?? ????br />ë²???br />4459 ë°œì˜?°ì›”??: 2013. 4. 9. ë°?br />??br />??: ?œìƒê¸?조명ì²??¤ìž¬??br />ê°•ì????¤ìƒ???•ë¬¸??br />민병ì£??¬í•™ë´??´ì² ??br />ê¹€?¥ì‹¤.? ê²½ë¦?ê¹€?¬ê²½ ?¡ì˜ê·??˜ì›(13?? ?œì•ˆ?´ìœ ?¬ì´ë²„공간ì? ?•ë³´?µì‹ ê¸°ìˆ ??비약?ì¸ ë°œì „ê³??”불???•ë³´ê¸°ê¸°?€ 컴퓨??그리ê³??¸í„°???±ì˜ ?¤íŠ¸?Œí¬ë¡??°ê²°??ê°€?ì˜ ê³µê°„?¼ë¡œ ?´ë? êµ?? ?활??보편?ì¸ ?ì—?¼ë¡œ ?리매ê??˜ì?ê³? êµ?²½??초월?˜ì—¬ ë²?br />지구ì ?´ë©´???•ë??€ ë¯¼ê°„ë¶€ë¶„ì´ ?호 ë°€?‘히 ?°ê³„?˜ì–´ ?ˆìŒ. ?´ëŸ¬???¹ìˆ˜?±ìœ¼ë¡?ë§ë??”ì•„ 복잡.ê³ ë„?”ë˜ë©? ?œê³µê°„ì˜ ?œì•½??ë²?br />?´ë‚˜ ë°œìƒ?˜ëŠ” ëª¨ë“ ?¬ì´ë²„ê³µê²©ì„ ?•ë??€ 민간 ?´ëŠ ?˜ë‚˜???¨ë…?¼ë¡œ 차단?˜ê¸°?는 분명???œê³„ê°€ ?ˆìŒ. 게다가 ?¬ì´ë²„í…Œ?¬ë¡œ 초래?˜ëŠ” ?¬ì´ 버ìƒ???„기???„실?¸ê³„??물리??질서?¼ë?ê³??¬ë¦¬ ?¹ì •ê°œì¸???€??br />것ì¼ì§€?¼ë„ êµ???„ì²´???„기ë¡??•ë??????ˆìŒ. - 1 – 2 - 그리ê³?과거 1.25 ?¸í„°???€?€ê³?ê°™ì? ?„êµ?ì¸ ê·œëª¨??êµ?? 주요 ?•ë³´?µì‹ ë§?마비?¬íƒœ ë°œìƒê³??´ì™¸ë¡œë???ì¡°ì§?ì¸ ?¬ì´ë²„í…Œ?¬ë¡œ êµ?? 기ë? ë°?ì²¨ë‹¨ê¸°ìˆ ??? 출 ??êµ??.?¬íšŒ ?„ë°˜??중ë????í–¥??ë¯¸ì¹ ???ˆëŠ” ?¬ì´ë²„위ê¸?ë°œìƒ ê°€?¥ì„±??? ë¡œ ì¦ë??˜ê³ ?ˆìŒ. 그러???°ë¦¬?˜ë¼???„ì§ êµ??ì°¨ì›?ì„œ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?br />?…무ë¥?체계?으ë¡??˜í–‰?????ˆëŠ” ?œë„?€ 구체??방법.?ˆì°¨ê°€ ?•ë¦½ ?˜ì–´ ?ˆì? ?Šì•„ ?¬ì´ë²„위ê¸?ë°œìƒ ??êµ???ˆë³´?€ êµ?µ??중ë????„í—˜ê³?br />막ë????í•´ë¥??¼ì¹ ?°ë ¤ê°€ ?ˆìŒ. ?°ë¼????법ì—?œëŠ” ?•ë??€ 민간??참여??êµ??ì°¨ì›??종합?ì¸ ?€??br />체계ë¥?구축?˜ë„ë¡??˜ê³ , ?´ë? ?µí•˜???¬ì´ë²„í…Œ?¬ë? ?¬ì „???ì??˜ì—¬ ?¬ì´ë²„위ê¸?ë°œìƒ ê°€?¥ì„±??조기??차단?˜ë©°, ?„기 ë°œìƒ ??êµ??????Ÿ‰??br />결집?˜ì—¬ ? ì†???€?‘í• ???ˆë„ë¡??˜ê³ ???? 주요?´ìš© ê°€. êµ???•ë³´?장?€ ?¬ì´ë²„위기ë? ?¨ìœ¨?으ë¡?관리하ê³??¬ì´ë²„ê³µê²?br />ê´€?¨ì •ë³´ë? ?호 ê³µìœ ?˜ê¸° ?„하??ë¯?ê´€ ?‘ì˜ì²´ë? 구성.?´ì˜??br />???ˆìŒ(????ì¡?. ?? êµ???•ë³´?장?€ êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관??기본계íš??br />?˜ë¦½?˜ê³ ?´ì— ?°ë¼ ?œí–‰ê³„íš???‘성?˜ì—¬ 책임기ê????¥ì—ê²?ë°?br />?¬í•˜?¬ì•¼ ??????ì¡?.?? ?¬ì´ë²„í…Œ?¬ì— ?€??êµ??ì°¨ì›??종합?ì´ê³?체계?ì¸ ?€?‘ê³¼ ??br />?´ë²„?„기관리ë? ?„하??êµ???•ë³´?장 ?Œì†?¼ë¡œ êµ???¬ì´ë²„안?„센 ?°ë? ??????ì¡?. ?? 책임기ê????¥ì? ?¬ì´ë²„ê³µê²??•ë³´ë¥??ì?.분ì„?˜ì—¬ 즉시 ?€??br />?????ˆëŠ” 보안관?œì„¼?°ë? 구축.?´ì˜?˜ê±°???¤ë¥¸ 기ê???êµ?br />ì¶??´ì˜?˜ëŠ” 보안관?œì„¼?°ì— ê·??…무ë¥??„íƒ?˜ì—¬????????2 ì¡?. ë§? 중앙?‰ì •ê¸°ê????¥ì? ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•´ ?¼í•´ê°€ ë°œìƒ??경우??br />??? ì†?˜ê²Œ ?¬ê³ 조사ë¥??¤ì‹œ?˜ê³ , ?¼í•´ê°€ 중ë???경우 ê´€ê³?ì¤?br />?™í–‰?•ê¸°ê´€????ë°?êµ???•ë³´?장?게 ê·?ê²°ê³¼ë¥??µë³´?˜ì—¬????br />(????3ì¡?. ë°? êµ???•ë³´?장?€ ?¬ì´ë²„í…Œ?¬ì— ?€??체계?ì¸ ?€??ë°??€ë¹„ë? ??br />?˜ì—¬ ?¬ì´ë²„위기경보ë? ë°œë ¹?????ˆìœ¼ë©? 책임기ê????¥ì? ?¼í•´ ë°œìƒ??최소?”하거나 ?¼í•´ë³µêµ¬ 조치ë¥?취해????????5ì¡?. ?? ?•ë???경계?¨ê³„ ?´ìƒ???¬ì´ë²„위기경보ê? ë°œë ¹??경우 ?ì¸ë¶?br />?? ?¬ê³ 조사, 긴급?€?? ?¼í•´ë³µêµ¬ ?±ì„ ?„하??ê´€ê³?기ê? ë°???br />문ì¸?¥ì´ 참여?˜ëŠ” ?¬ì´ë²„위기ë?책본부ë¥?구성.?´ì˜?????ˆìŒ (????6ì¡?. ?? ?•ë????¬ì´ë²„위기ê?ë¦¬ì— ?„ìš”??ê¸°ìˆ ê°œë°œ.êµ? œ?‘ë ¥Â·?°ì—…?¡ì„±Â· ?¸ë ¥?‘성 ???„ìš”???œì±…??추진?????ˆìŒ(????9ì¡? ??0ì¡?ë°?br />??1ì¡?. - 3 – 4 - ?? ?•ë????¬ì´ë²„í…Œ??기ë„??ê´€???•ë³´ë¥??œê³µ?˜ê±°???¬ì´ë²„í…Œ??br />ë¥?ê°€???ë? ? ê³ ???ì— ?€?˜ì—¬ ?¬ìƒê¸ˆì„ ì§€ê¸‰í• ???ˆìŒ(??br />??4ì¡?. ì°? ì§ë¬´??비ë????„설??경우?는 5???´í•˜??ì§•ì— ?는 3천만??br />?´í•˜??벌금??처하ê³? 보안관?œì„¼?°ë? 구축?˜ì? ?„니??경우??br />??2천만???´í•˜??ê³¼íƒœë£Œì— ì²˜í• ???ˆìŒ(????5ì¡?ë°???6ì¡?.ë²•ë¥ ??br />??br />êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??ë²•ë¥ ??br />????ì´ì¹™ ??ì¡?목ì ) ??법ì? êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??기본?ì¸ ?¬í•??br />ê·œì •?˜ì—¬ êµ???ˆë³´ë¥??„협?˜ëŠ” ?¬ì´ë²„í…Œ?¬ë? ?ˆë°©?˜ê³ ?¬ì´ë²??„기 ë°œìƒ ??êµ?? ??Ÿ‰??결집?˜ì—¬ ? ì†?˜ê²Œ ?€ì²˜í•¨?¼ë¡œ??êµ?????ˆì „ 보장ê³??´ìµë³´í˜¸???´ë°”지?¨ì„ 목ì ?¼ë¡œ ?œë‹¤. ??ì¡??•ì˜) 1 ??법ì—???¬ìš©?˜ëŠ” ?©ì–´???•ì˜???¤ìŒê³?같다. 1. ?œì‚¬?´ë²„?ŒëŸ¬?ë? ?´í‚¹Â·ì»´í“¨??ë°”ì´?¬ìŠ¤Â·?œë¹„?¤ë°©?´Â·ì „?기????br />?„ìž???˜ë‹¨???˜í•˜???•ë³´?µì‹ ?œì„¤??침입·êµë?·마비·?Œê´´?˜ê±°??br />?•ë³´ë¥??ˆì·¨Â·?¼ì†Â·?œê³¡?„파 ?˜ëŠ” ??ëª¨ë“ ê³µê²©?‰ìœ„ë¥?ë§í•œ?? 2. ?œì‚¬?´ë²„?ˆì „?ì´?€ ?¬ì´ë²„í…Œ?¬ë¡œë¶€???•ë³´?µì‹ ?œì„¤ê³??•ë³´ë¥?보호 ?˜ê¸° ?„하???˜í–‰?˜ëŠ” 관리ì .물리??ê¸°ìˆ ???˜ë‹¨ ë°??€?‘ì¡°ì¹?br />?±ì„ ?¬í•¨???œë™?¼ë¡œ???¬ì´ë²„위기ê?리ë? ?¬í•¨?œë‹¤. 3. ?œì‚¬?´ë²„?„기?ë? ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•˜??êµ??.?¬íšŒê¸°ëŠ¥???¬ê°??br />지?¥ì„ 초래?˜ê±°???¼í•´ê°€ ?„êµ?으ë¡??•ì‚°??ê°€?¥ì„±???ˆëŠ” ê²?br />?°ë? ë§í•œ?? - 5 – 6 - 4. ?œì‚¬?´ë²„?ŒëŸ¬?•ë³´?ë? ?•ë³´?œìŠ¤??ë°??•ë³´ë³´í˜¸?œìŠ¤???Œí”„?¸ì›¨?´ë? ?¬í•¨?œë‹¤) ?±ì— ?˜í•´ ?¬ì´ë²„í…Œ???‰ìœ„ë¡??단?˜ëŠ” ?•ë³´ë¡œì„œ ?¬ì´ë²?br />?ŒëŸ¬ ê·¼ì›ì§€ë¥??Œì•…?˜ê¸° ?„í•œ ?¸í„°?·í”„ë¡œí† ì½œì£¼??IP)?€ ?¤íŠ¸?Œí¬ 카드주소(MAC)ë¥??¬í•¨?œë‹¤. 5. ?œì‚¬?´ë²„?„기경보?ë? ?¬ì´ë²„í…Œ??징후ë¥??별?˜ê±°???¬ì´ë²„위ê¸?br />ë°œìƒ???ˆìƒ?˜ëŠ” 경우 ê·??„í—˜ ?는 ?„협?˜ì???부?©ë˜??조치ë¥?br />?????ˆë„ë¡?미리 ?•ë³´ë¥??œê³µ?˜ê³ ê²½ê³ ?˜ëŠ” ê²ƒì„ ë§í•œ?? 6. ?œì‚¬?´ë²„?„기관리â€ë? ?¬ì´ë²„위기ë? ?ˆë°©?˜ê³ ?¬ì´ë²„위기ê? ë°œìƒ?˜ì? ??경우 ? ì†?˜ê³ 체계?으ë¡??€?‘하ê¸??„í•œ ?¬ì´ë²„í…Œ???ì?.?€?? ?¬ê³ ??조사.복구, 모ì˜?ˆë ¨, ê²½ë³´ë°œë ¹ ë°?관계기관 ê°„ì˜ ?‘ì¡° ??br />êµ??ì°¨ì›??ëª¨ë“ ?œë™??ë§í•œ?? 7. ?œì‚¬?´ë²„?ŒëŸ¬ ë°©ì? ë°??„기관ë¦?책임기ê?(?´í•˜ ?œì±…?„기관?ì´??br />?œë‹¤)?ì´?€ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ê´€???…무ë¥??˜í–‰??br />ê³??ˆëŠ” ?¤ìŒ ê°?ëª©ì˜ ê¸°ê???ë§í•œ?? ê°€. ?Œë??œë?êµ?—Œë²•ã€? ?Œì •ë¶€ì¡°ì§ë²•ã€? ê·?ë°–ì˜ ë²•ë ¹???°ë¼ ?¤ì¹˜??br />êµ??기ê?ê³?지방ìžì¹˜ë‹¨ì²?ë°ã€Œêµê°€?•ë³´??기본법ã€ì œ3ì¡°ì œ10??br />???°ë¥¸ 공공기ê? ?? ?Œì •ë³´í†µ? 기ë°?보호법ã€???ì¡°ì œ1??— ?°ë¥¸ 주요?•ë³´?µì‹ ê¸?br />반시?¤ì„ 관리하??기ê? ?? ?Œì •ë³´í†µ? ë§ ?´ìš©ì´‰ì§„ ë°??•ë³´ë³´í˜¸ ?±ì— ê´€??ë²•ë¥ ????6ì¡?br />????— ?°ë¥¸ 집ì ?•ë³´?µì‹ ?œì„¤?¬ì—…??ë°?ê°™ì? ë²???7ì¡°ì˜4????— ?°ë¥¸ 주요?•ë³´?µì‹ ?œë¹„???œê³µ??br />?? ?Œì‚°?…기? ì˜ ? 출방ì? ë°?보호??ê´€??ë²•ë¥ ????ì¡°ì— ?°ë¥¸ êµ???µì‹¬ê¸°ìˆ ??ë³´ìœ ??기업체나 ?°êµ¬ê¸°ê? ë§? ?Œë°©?„사?…법????ì¡°ì œ9?¸ì— ?°ë¥¸ 방위?°ì—…ì²?ë°?ê°™ì? ë²???ì¡?br />??0?¸ì— ?°ë¥¸ ?„문?°êµ¬ê¸°ê? 8. ?œì‚¬?´ë²„?ŒëŸ¬ ë°©ì? ë°??„기관ë¦?지?기관(?´í•˜ ?œì??기관?ì´??br />?œë‹¤)?ì´?€ ?¬ì´ë²„í…Œ?¬ì— ?€??? ì†???ì?·?€??ë°??¬ê³ 조사· 복구 ?±ì„ 지?하???¤ìŒ ê°?ëª©ì˜ ê¸°ê? ?는 ?…ì²´ë¥?ë§í•œ?? ê°€. ?Œê³¼?™ê¸°? 분???•ë?출연?°êµ¬ê¸°ê? ?±ì˜ ?¤ë¦½Â·?´ì˜ ë°??¡ì„±??br />ê´€??ë²•ë¥ ????ì¡°ì— ?°ë¥¸ ?œêµ?„ìž?µì‹ ?°êµ¬??부?¤ì—°êµ¬ì†Œ ?? ?Œì •ë³´í†µ? ë§ ?´ìš©ì´‰ì§„ ë°??•ë³´ë³´í˜¸ ?±ì— ê´€??ë²•ë¥ ????2ì¡?br />???°ë¥¸ ?œêµ?¸í„°?·ì§„?¥ì› ?? ?Œì†Œ?„트?¨ì–´?°ì—… 진í¥ë²•ã€ì œ24ì¡°ì— ?°ë¼ ?Œí”„?¸ì›¨?´ì‚¬?…ìžë¡?br />? ê³ ????ì¤?컴퓨?°ë°”?´ëŸ¬??ë°±ì‹ ?Œí”„?¸ì›¨?´ë? ?œìž‘ ?는 ?매 ?˜ëŠ” ??br />?? ?Œêµê°€?•ë³´??기본법ã€???ì¡°ì œ6?¸ì˜ ?•ë³´ë³´í˜¸?œìŠ¤?œì„ ?œìž‘ ?˜ê±°???˜ìž…?˜ëŠ”??br />ë§? ?Œì •ë³´í†µ? 기ë°?보호법ã€ì œ9ì¡°ì— ?°ë¼ 지?•ëœ 지?ì •ë³´ë³´??br />컨설?…ì „ë¬¸ì—…ì²?br />ë°? ê´€ê³??‰ì •ê¸°ê????¥ì´ 지?•í•œ 보안관?œì „문업ì²?br />2 ??법ì—???¬ìš©?˜ëŠ” ?©ì–´???•ì˜??????—???•í•˜??ê²ƒì„ ?œì™¸ - 7 – 8 - ?˜ê³ ???Œì •ë³´í†µ? 기ë°?보호법ã€Â·ã€Œì •ë³´í†µ? ë§ ?´ìš©ì´‰ì§„ ë°??•ë³´ë³´í˜¸ ?±ì— ê´€??ë²•ë¥ ?·「êµê°€?•ë³´??기본법ã€Â·ã€Œì „기통? 사?…법?ì—??br />?•í•˜??ë°”ì— ?°ë¥¸?? ??ì¡??¤ë¥¸ ë²•ë¥ ê³¼ì˜ ê´€ê³? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ê´€?˜ì—¬ ?¤ë¥¸ ë²•ë¥ ???¹ë³„??ê·œì •???ˆëŠ” 경우ë¥??œì™¸?˜ê³ ????법ì—???•í•˜??br />ë°”ì— ?°ë¥¸?? ?¤ë§Œ, ?¬ì´ë²„위기ê? ë°œìƒ??경우?는 ?¤ë¥¸ ë²•ë¥ ???°ì„ ?˜ì—¬ ?ìš©?œë‹¤. ??ì¡?책임기ê???책무) 책임기ê????¥ì? ?¬ì´ë²„í…Œ?¬ë? ?¬ì „ ?ˆë°©?˜ê¸° ?„하???Œê? ?•ë³´?µì‹ ?œì„¤???ˆì „??? ì???ì±…ìž„???ˆìœ¼ë©? ?´ë? ??br />?˜ì—¬ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??…무ë¥??„ë‹´?˜ëŠ” ?„문?¸ë ¥ ë°?br />?ˆì‚° ?•ë³´ ?±ì˜ ?„ìš”??조치ë¥?강구?˜ì—¬???œë‹¤. ??ì¡?민·ê? ?‘ë ¥) 1 ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??€?‘ì— ?‘ë ¥?˜ê³ ??br />?´ë²„?„기ë¥??¨ìœ¨?으ë¡?관리하ê¸??„하???€?µë ¹?¹ìœ¼ë¡??•í•˜??ë°”ì— ?°ë¼ 민간기ê? ?±ê³¼ ?‘ì˜ì²´ë? 구성.?´ì˜?????ˆë‹¤. 2 ????— ê´€?˜ì—¬ ?„ìš”???¬í• ?±ì? ?€?µë ¹?¹ìœ¼ë¡??•í•œ?? ????êµ?? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?추진체계 ??ì¡?êµ???¬ì´ë²„안?„ì „?µíšŒ??) 1 êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?br />??ê´€??중요?¬í•???¬ì˜?˜ê¸° ?„하??êµ???•ë³´?장 ?Œì†?˜ì— êµ???¬ì´ë²„안?„ì „?µíšŒ???´í•˜ ?œì „?µíšŒ?˜â€ë¼ ?œë‹¤)ë¥??”다. 2 ?„ëžµ?Œì˜???˜ìž¥?€ êµ???•ë³´?장???œë‹¤. 3 ?„ëžµ?Œì˜???„ì›?€ 중앙?‰ì •ê¸°ê???ì°¨ê?ê¸?공무?ê³¼ ?„ëžµ?Œì˜ ?˜ìž¥???„ì´‰?˜ëŠ” ?ë¡œ ?œë‹¤. 4 ?„ëžµ?Œì˜???¤ìŒ ê°??¸ì˜ ?¬í•???¬ì˜?œë‹¤. 1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???„ëžµ.?•ì±….?œë„ ?˜ë¦½ ë°?ê°?br />??br />2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€??기ê?ê°???• ì¡°ì •??ê´€???¬í• 3. ??2ì¡°ì œ2??— ?°ë¥¸ ?¬ì´ë²„위?‘ì •ë³?ê³µìœ ë°?보호??ê´€???¬í• 4. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???€?µë ¹ 지?œì‚¬??— ?€??조치 방안 5. ê·?ë°–ì— ?„ëžµ?Œì˜ ?˜ìž¥??부?˜í•˜ê±°ë‚˜ ?„ì›???œì¶œ???¬í• 5 ?„ëžµ?Œì˜???¨ìœ¨???´ì˜???„하???„ëžµ?Œì˜??êµ???¬ì´ë²„안?„ë?ì±?br />?Œì˜(?´í•˜ ?œë?책회?˜â€ë¼ ?œë‹¤)ë¥??????ˆë‹¤. 6 ?„ëžµ?Œì˜ ë°??€ì±…회?˜ì˜ 구성.?´ì˜ ?±ì— ê´€?˜ì—¬ ?„ìš”??구체?ì¸ ?¬í•?€ ?€?µë ¹?¹ìœ¼ë¡??•í•œ?? ??ì¡?êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê¸°ë³¸ê³„íš ?˜ë¦½ ?? 1 ?•ë???br />?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??€ì±…ì˜ ?¨ìœ¨??체계??추진???„하 ??êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?기본계íš(?´í•˜ ?œê¸°ë³¸ê³„?â€ì´??br />?œë‹¤)???˜ë¦½.?œí–‰?˜ì—¬???œë‹¤. 2 기본계íš?€ ?€?µë ¹?¹ìœ¼ë¡??•í•˜??ë°”ì— ?°ë¼ êµ???•ë³´?장??ê´€ - 9 – 10 - ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘ì˜?˜ì—¬ ?„ëžµ?Œì˜ ?¬ì˜ë¥?ê±°ì³ ë§ˆë ¨?œë‹¤. 3 중앙?‰ì •ê¸°ê????¥ì? ????˜ 기본계íš???°ë¼ ?Œê? 책임기ê???br />?¥ì´ ?œìš©?????ˆë„ë¡?êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??œí–‰ê³„íš (?´í•˜ ?œì‹œ?‰ê³„?â€ì´?¼ê³ ?œë‹¤)???‘성?˜ì—¬ ?Œê? 책임기ê????¥ì—ê²?br />ë°°í¬?˜ì—¬???œë‹¤. ??ì¡??œí–‰ê³„íš???´í–‰?¬ë? ?•ì¸ ë°?êµ?šŒ ë³´ê³ ) 1 중앙?‰ì •ê¸°ê????¥ì? ?Œê? 책임기ê????€?˜ì—¬ 매년 ?œí–‰ê³„íš???´í–‰?¬ë?ë¥??•ì¸?˜ì—¬??br />?œë‹¤. 2 êµ???•ë³´?장?€ ????˜ ?•ì¸ê²°ê³¼ë¥?종합?˜ì—¬ êµ???¬ì´ë²„í…Œ??br />ë°©ì? ë°??„기관ë¦??¤íƒœë¥??ê?.?‰ê??˜ê³ ê·?ê²°ê³¼ë¥?êµ?šŒ??ë³´ê³ ??br />?¬ì•¼ ?œë‹¤. ?¤ë§Œ, êµ?šŒ, 법ì›, ?Œë²•?¬íŒ?? 중앙? 거관리위?회???€ ???ê?.?‰ê???êµ?šŒ ?¬ë¬´ì´ìž¥, 법ì›?‰ì •ì²˜ìž¥, ?Œë²•?¬íŒ???¬ë¬´ì²?br />??ë°?주앙? 거관리위?회 ?¬ë¬´ì´ìž¥???”ì²??경우???œí•œ?? 3 ????ë°?????˜ ?ˆì°¨?€ 방법 ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•?€ ?€??br />?¹ë ¹?¼ë¡œ ?•í•œ?? ??ì¡?êµ???¬ì´ë²„안?„센?°ì˜ ?¤ì¹˜) 1 ?¬ì´ë²„í…Œ?¬ì— ?€??êµ??ì°¨ì›??br />종합?ì´ê³?체계?ì¸ ?ˆë°©.?€?‘ê³¼ ?¬ì´ë²„위기ê?리ë? ?„하??êµ?? ?•ë³´?장 ?Œì†?¼ë¡œ êµ???¬ì´ë²„안?„센???´í•˜ ?œì•ˆ?„센?°â€ë¼ ?œë‹¤)ë¥?br />?”다. 2 ?ˆì „?¼í„°???¤ìŒ ê°??¸ì˜ ?…무ë¥??˜í–‰?œë‹¤. 1. êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??•ì±…???˜ë¦½2. ?„ëžµ?Œì˜ ë°??€ì±…회???´ì˜???€??지??br />3. ?¬ì´ë²„í…Œ??ê´€???•ë³´???˜ì§‘.분ì„.?„파 4. êµ???•ë³´?µì‹ ë§ì˜ ?ˆì „???•ë³´ 5. êµ?? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?매뉴???‘성.ë°°í¬ 6. ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•˜??ë°œìƒ???¬ê³ ??조사 ë°?복구 지??br />7. ?¸êµê³¼ì˜ ?¬ì´ë²?공격 ê´€???•ë³´???‘ë ¥ 3 êµ???•ë³´?장?€ ????˜ ?ˆì „?¼í„°ë¥??´ì˜?¨ì— ?ˆì–´ êµ??ì°¨ì›??br />종합?단, ?황관?? ?„협?”ì¸ ë¶„ì„, ?¬ê³ 조사 ?±ì„ ?„í•´ ë¯?ê´€. êµ??©ë™?€?‘í?(?´í•˜ ?œí•©?™ë??‘í??ì´???œë‹¤)???¤ì¹˜.?´ì˜??????br />?? 4 êµ???•ë³´?장?€ ?©ë™?€?‘í????¤ì¹˜.?´ì˜?˜ê¸° ?„하???„ìš”??ê²?br />?°ì—??중앙?‰ì •ê¸°ê? ë°?지?기관???¥ì—ê²??¸ë ¥???Œê²¬ê³??¥ë¹„??지??br />???”ì²?????ˆë‹¤. ?????¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??œë™ ??0ì¡??¬ì´ë²„í…Œ??ë°©ì??€ì±…ì˜ ?˜ë¦½.?œí–‰) 1 책임기ê????¥ì? ?Œê? ?•ë³´?µì‹ ë§ê³¼ ?•ë³´ ?±ì˜ ?ˆì „??ë°?? 뢰???•ë³´ë¥??„í•œ ?¬ì´ë²„í…Œ??br />ë°©ì??€ì±…ì„ ê°•êµ¬?˜ì—¬???œë‹¤. 2 êµ???•ë³´?장?€ ????— ?°ë¥¸ ?¬ì´ë²„í…Œ??ë°©ì??€ì±…ì˜ ?˜ë¦½????br />- 11 – 12 - ?”í•œ ì§€ì¹¨ì„ ?‘성 ë°°í¬?????ˆë‹¤. ??경우, êµ???•ë³´?장?€ 미리 ê´€ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘ì˜?˜ì—¬???œë‹¤. 3 ????„ ?ìš©???Œì—??êµ?šŒ, 법ì›, ?Œë²•?¬íŒ?? 중앙? 거관리위 ?회???‰ì •?¬ë¬´ë¥?처리?˜ëŠ” 기ê???경우?는 ?´ë‹¹ 기ê????¥ì´ ??br />?”하?¤ê³ ?¸ì •?˜ëŠ” 경우?만 ?ìš©?œë‹¤. ??1ì¡??…성?„로그램???•ì‚° 차단) 1 ?•ë????…성?„로그램 ?±ì´ ?¬í•¨ ???¹ì‚¬?´íŠ¸ ?는 ?Œí”„?¸ì›¨???±ì„ 발견??경우??ê·??´ì˜?ì—ê²?br />?…성?„로그램??ê°ì—¼ ?•ì‚°ë°©ì? ?±ì— ?„ìš”??보안조치ë¥??????ˆë„ ë¡?ê´€???•ë³´ë¥??œê³µ?˜ì—¬???œë‹¤. 2 ?•ë???????˜ 조치?ë„ ë¶ˆêµ¬?˜ê³ ?¬ì´ë²„í…Œ?¬ì— ?…ìš©?˜ê±°??br />?„í—˜?±ì´ ?’다ê³??단?˜ëŠ” 경우??ë°±ì‹ ?„로그램??? í¬ ?±ì„ ?µí•´ ?…성?„로그램 ?±ì„ ?? œ ?는 차단?˜ê²Œ ?????ˆë‹¤. 3 ????ë°?????— ?°ë¼ ?„ìš”??조치??구체?ì¸ ?¬í•?€ ?€?µë ¹ ?¹ìœ¼ë¡??•í•œ?? ??2ì¡?보안관?œì„¼???±ì˜ ?¤ì¹˜) 1 책임기ê????¥ì? ?¬ì´ë²„í…Œ???•ë³´ë¥?br />?ì?·분ì„?˜ì—¬ 즉시 ?€??조치ë¥??????ˆëŠ” 기구(?´í•˜ ?œë³´?ˆê???br />?¼í„°?ë¼ ?œë‹¤)ë¥?구축·?´ì˜?˜ê±°???¤ìŒ ê°??¸ì˜ 기ê???구축·?´ì˜ ?˜ëŠ” 보안관?œì„¼?°ì— ê·??…무ë¥??„íƒ?˜ì—¬???œë‹¤. ?¤ë§Œ, ?Œì •ë³´í†µ??br />기반 보호법ã€???6ì¡°ì— ?°ë¥¸ ?•ë³´ê³µìœ ·분ì„?¼í„°??보안관?œì„¼?°ë¡œ 본다. 1. ê´€ê³?중앙?‰ì •ê¸°ê?2. êµ???•ë³´??br />3. ??ì¡°ì œ1?? œ8?¸ë°”ëª©ì˜ ë³´ì•ˆê´€?œì „문업ì²?br />2 책임기ê????¥ì? ????— ?°ë¥¸ ?¬ì´ë²„í…Œ???•ë³´?€ ?•ë³´?µì‹ ë§? ?Œí”„?¸ì›¨?´ì˜ 취약???±ì˜ ?•ë³´(?´í•˜ ?œì‚¬?´ë²„?„협?•ë³´?ë¼ ?œë‹¤)ë¥?br />ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?장ê³?ê³µìœ ?˜ì—¬???œë‹¤. 3 êµ???•ë³´?장?€ ????˜ ?¬ì´ë²„위?‘ì •ë³´ì˜ ?¨ìœ¨?ì¸ ê´€ë¦?ë°???br />?©ì„ ?„하??관계기관???¥ê³¼ ê³µë™?¼ë¡œ ?¬ì´ë²„위?‘ì •ë³´í†µ?©ê³µ? ì²´ 계ë? 구축·?´ì˜?????ˆë‹¤. 4 ?„구? ì? ????— ?°ë¼ ê³µìœ ?˜ëŠ” ?•ë³´???€?˜ì—¬???¬ì´ë²„위기ê? 리ë? ?„하???„ìš”???…무범위???œí•˜???•ë‹¹?˜ê²Œ ?¬ìš© 관리하?¬ì•¼ ?œë‹¤. 5 ????— ?°ë¥¸ 보안관?œì„¼?°ì? ????— ?°ë¥¸ ?¬ì´ë²„위?‘ì •ë³?br />?µí•©ê³µìœ 체계 구축·?´ì˜ ë°??•ë³´ ê´€ë¦¬ì— ê´€???¬í•ê³?????— ?°ë¥¸ ?¬ì´ë²„í…Œ???•ë³´??ê³µìœ ??ê´€??범위.?ˆì°¨.방법 ?±ì— ê´€???¬í•?€ ?€?µë ¹?¹ìœ¼ë¡??•í•œ?? ??3ì¡??¬ê³ 조사) 1 중앙?‰ì •ê¸°ê????¥ì? ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•˜???Œê? 분야???¼í•´ê°€ ë°œìƒ??경우?는 ê·??ì¸ê³??¼í•´?´ìš© ?±ì— ê´€?˜ì—¬ ? ì†???¬ê³ 조사ë¥??¤ì‹œ?˜ê³ , ?¼í•´ê°€ 중ë??˜ê±°???•ì‚°???°ë ¤ê°€ ??br />??경우 즉시 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?장?게 ê·?ê²?br />ê³¼ë? ?µë³´?˜ì—¬???œë‹¤. 2 êµ???•ë³´?장?€ ????—??불구?˜ê³ êµ???ˆë³´ ë°??´ìµ??중ë???br />- 13 – 14 - ?í–¥??미친?¤ê³ ?단?˜ëŠ” 경우 ê´€ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘ì˜??br />??ì§ì ‘ ê·??¬ê³ 조사ë¥??¤ì‹œ?????ˆë‹¤. 3 êµ???•ë³´?장?€ ????— ?°ë¼ ?¬ê³ 조사 ê²°ê³¼ë¥??µë³´ë°›ê±°???? ??— ?°ë¼ ?¬ê³ 조사ë¥???ê²°ê³¼, ?¼í•´??복구 ë°??•ì‚°ë°©ì?ë¥??„하??br />? ì†???œì •???„ìš”?˜ë‹¤ê³??단?˜ëŠ” 경우 책임기ê????¥ì—ê²??„ìš” ??조치ë¥??”ì²?????ˆë‹¤. ??경우 책임기ê????¥ì? ?¹ë³„???¬ìœ ê°€ ?†ëŠ” ???´ì— ?°ë¼???œë‹¤. 4 ?„구? ì? ????ë°?????— ?°ë¥¸ ?¬ê³ 조사ë¥??„료?˜ê¸° ?„ì— ?¬ì´ë²„í…Œ?¬ì? ê´€?¨ëœ ?료ë¥??„ì˜ë¡??? œÂ·?¼ì†Â·ë³€ì¡°í•˜?¬ì„œ???„니 ?œë‹¤. ??4ì¡??€?‘훈?? 1 ?•ë????¬ì´ë²„í…Œ?¬ë? ë°©ì??˜ê³ ?¬ì´ë²„ìœ„ê¸°ì— ì²´ê³„?ì´ê³??¨ìœ¨?으ë¡??€?‘하ê¸??„하???ˆë ¨???¤ì‹œ?˜ì—¬???œë‹¤. 2 ????˜ ?ˆë ¨?€ 매년 ?•ê¸° ?는 ?˜ì‹œë¡?구분?˜ì—¬ ?¤ì‹œ?????ˆìœ¼ë©? ?•ê¸° ?ˆë ¨?€ ?Œë¹„?ë?비ìž??관리법????4ì¡°ì— ?°ë¥¸ 비ìƒ?€ë¹„훈??br />ê³??¨ê»˜ ?¤ì‹œ?????ˆë‹¤. 3 ????˜ ?ˆë ¨ ?¤ì‹œë°©ë²• ë°??ˆì°¨ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•?€ ?€ ?µë ¹?¹ìœ¼ë¡??•í•œ?? ??5ì¡??¬ì´ë²„ìœ„ê¸°ê²½ë³´ì˜ ë°œë ¹) 1 êµ???•ë³´?장?€ ?¬ì´ë²„í…Œ?¬ì— ?€??br />체계?ì¸ ?€ë¹„ì? ?€?‘ì„ ?„하??책임기ê????¥ì˜ ?”ì²ê³???2ì¡°ì œ2 ??— ?°ë¼ ?˜ì§‘???•ë³´ë¥?종합·?단?˜ì—¬ ê´€??·ì£¼?˜Â·ê²½ê³„·심ê°??¨ê³„ ???¬ì´ë²„위기경보ë? ë°œë ¹?????ˆë‹¤.2 êµ???•ë³´?장?€ ?¬ì´ë²„í…Œ?¬ê? êµ???ˆë³´??중ë????„í•´ë¥?초래??br />것으ë¡??단?˜ëŠ” 경우?는 êµ???ˆë³´?¤ì˜ êµ???„기?황 ?…무ë¥??´ë‹¹ ?˜ëŠ” ?˜ì„비서관ê³??‘ì˜?˜ì—¬ ?¬ê° ?˜ì???경보ë¥?ë°œë ¹?????ˆìœ¼ë©? ?¬ê°?¨ê³„???¬ì´ë²„위기경보ë? ë°œë ¹??경우?는 ê·??¬ìœ ë¥?êµ?šŒ??br />?µë³´?˜ì—¬???œë‹¤. 3 êµ???•ë³´?장?€ ?¬ì´ë²„위기경보ë? ë°œë ¹??경우 관계기관???¥ê³¼ 경보 ?˜ì????¬ì „ ?‘ì˜?˜ì—¬???œë‹¤. 4 책임기ê????¥ì? ????— ?°ë¥¸ ?¬ì´ë²„위기경보ê? ë°œë ¹??경우 즉시 ?¼í•´ë°œìƒ??최소??ë°??¼í•´ë³µêµ¬ë¥??„í•œ 조치ë¥?취하?¬ì•¼ ?œë‹¤. 5 ?¬ì´ë²„위기경ë³?ë°œë ¹???ˆì°¨Â·ê¸°ì? ë°?책임기ê????¥ì˜ 조치 ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•?€ ?€?µë ¹?¹ìœ¼ë¡??•í•œ?? ??6ì¡??¬ì´ë²„위기ë?책본부??구성) 1 ?•ë???경계?¨ê³„ ?´ìƒ???¬ì´ 버위기경보ê? ë°œë ¹??경우 ?ì¸ë¶„ì„, ?¬ê³ 조사, 긴급?€?? ?¼í•´ë³µêµ¬ ?±ì˜ ? ì†??조치ë¥?취하ê¸??„하??êµ?? ??Ÿ‰??결집??ë¯?ê´€.êµ?br />?„문가가 참여?˜ëŠ” ?¬ì´ë²„위기ë?책본부(?´í•˜ ?œë?책본부?ë¼ ?œë‹¤)ë¥?br />구성·?´ì˜?????ˆë‹¤. 2 ?€ì±…본부?????´í•˜ ?œë?책본부?¥â€ì´???œë‹¤)?€ êµ???•ë³´?장?¼ë¡œ ?˜ë©°, ?€ì±…본부??구성·?´ì˜ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•?€ êµ???•ë³´??br />?¥ì´ ê´€ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘ì˜?˜ì—¬ ?•í•œ?? 3 ?€ì±…본부?¥ì? ????— ?°ë¥¸ ?€ì±…본부ë¥?구성·?´ì˜?˜ê¸° ?„하??ì±?br />?„기관 ë°?지?기관???¥ì—ê²??„ìš”???¸ë ¥???Œê²¬ ë°??¥ë¹„???œê³µ - 15 – 16 - ???”ì²?????ˆë‹¤. ??경우 책임기ê? ë°?지?기관???¥ì? ?¹ë³„??br />?¬ìœ ê°€ ?†ëŠ” ???´ì— ?°ë¼???œë‹¤. 4 ?€ì±…본부?¥ì? ????— ?°ë¼ ?¸ë ¥???Œê²¬ ë°??¥ë¹„???œê³µ????br />기ê????¥ì—ê²?ê·??Œìš”경비ë¥?지?í• ???ˆë‹¤. ??7ì¡?ê¸°ìˆ ì§€?? 1 책임기ê????¥ì´ ??2ì¡°ì œ1??ë°???5ì¡°ì œ4??˜ ?…무ë¥??˜í–‰?¨ì— ?ˆì–´ ?„ìš”??경우 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ?? ?•ë³´?장?게 지?ì„ ?”ì²?????ˆë‹¤. 2 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?장?€ ????— ?°ë¥¸ 지??br />???”ì²ë°›ì•˜????? ì†???€?‘ì´ ?´ë£¨?´ì§ˆ ???ˆë„ë¡?ê¸°ìˆ ì§€????br />?„ìš”??조치ë¥??˜ì—¬???œë‹¤. 3 ????— ?°ë¥¸ 조치ë¥??„하??ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ????br />ë³´ì›?¥ì? ?´ë‹¹ 지?기관???¥ì—ê²??„ìš”??지?ì„ ?”ì²?????ˆìœ¼ë©? ??경우, 지?기관???¥ì—ê²?지?í• ?´ìš©ê³?기간??미리 ?µë³´?˜ì—¬??br />?œë‹¤. 4 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?장?€ ????— ?°ë¼ 지??br />????기ê????¥ì—ê²?ê·??Œìš”경비ë¥?지?í• ???ˆë‹¤. ?????°êµ¬ê°œë°œ ë°?지??br />??br />??8ì¡?책임기ê????€??지?? ?•ë???책임기ê????€?˜ì—¬ ?•ë³´?µì‹ ë§?br />??보호?˜ê¸° ?„하???„ìš”??ê¸°ìˆ ???´ì „, ?¥ë¹„???œê³µ ë°?ê·?ë°–ì˜?„ìš”??지?ì„ ?????ˆë‹¤. ??9ì¡??°êµ¬ê°œë°œ) 1 ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ?„ìš”??br />ê¸°ìˆ ê°œë°œê³?ê¸°ìˆ ?˜ì????¥ìƒ???„하???¤ìŒ ê°??¸ì˜ ?œì±…??추진??br />???ˆë‹¤. 1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ê´€??êµ?? ?°êµ¬ê°œë°œ 계íš????br />ë¦??œí–‰ 2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리기???˜ìš”조사 ë°??™í–¥ë¶„ì„ ?±ì— ê´€???¬ì—… 3. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ê´€??ê¸°ìˆ ??개발.보급.??br />???¬ì—… 4. ê·?ë°–ì— ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€??ê¸°ìˆ ê°œë°œ ë°?ê¸°ìˆ ?¥ìƒ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í• 2 êµ???•ë³´?장?€ ????— ?°ë¼ ?°êµ¬?Œë? ?¤ë¦½?˜ê±°?? ?¤ë¥¸ ë²•ë ¹??br />?˜í•˜???¤ë¦½??기ê????„문기ê??¼ë¡œ 지?•í• ???ˆë‹¤. 3 êµ?? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê¸°ìˆ ???°êµ¬ê°œë°œ??ê´€????br />차·방ë²????¸ë??¬í•?€ êµ???•ë³´?장???°ë¡œ ?•í•œ?? ??0ì¡??°ì—…?¡ì„±) 1 ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ?„ìš”??br />?°ì—…???¡ì„±??지?하ê¸??„하???¤ìŒ ê°??¸ì˜ ?œì±…???˜ë¦½.?œí–‰?˜ê³ ?´ì— ?„ìš”???¬ì› ?•ë³´ 방안 ?±ì„ ë§ˆë ¨?˜ì—¬???œë‹¤. 1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ?•ì±…?˜ë¦½ 지??br />2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ë°œì „???„í•œ ? 통?œìž¥ ?œì„± - 17 – 18 - ??지??br />3. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ?¡ì„±???„í•œ ??????br />?‘ë ¥ì²´ê³„ 구축 4. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ê´€??êµ? œêµë¥˜.?‘ë ¥ ë°???br />?¸ì§„ì¶œì˜ ì§€??br />2 ?•ë?????9ì¡°ì œ2??˜ ?°êµ¬??ë°??„문기ê??¼ë¡œ ?˜ì—¬ê¸?????˜ ?°ì—…?¡ì„±???„ìš”???…무ë¥??˜í–‰?˜ê²Œ ?????ˆë‹¤. ??1ì¡??¸ë ¥?‘성 ë°?êµìœ¡?ë³´) ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì˜ ê¸°ë°˜??조성?˜ê³ ?¬ì´ë²„ìœ„ê¸°ì— ?€??êµ?????¸ì‹???œê³ ?˜ê¸° ?„하??br />?¤ìŒ ê°??¸ì˜ ?œì±…??강구?˜ì—¬???œë‹¤. 1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???„문?¸ë ¥???‘성 2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ê´€???€êµ?? ?ë³´?œë™ ë°?êµìœ¡ 3. ê·?ë°–ì— ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???„문?¸ë ¥ ?‘성 ë°?êµìœ¡?ë³´ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í• ??2ì¡?êµ? œ?‘ë ¥) ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì— ê´€?˜ì—¬ êµ? œ 기구·?¨ì²´ ë°??¸êµê³¼ì˜ ?‘ë ¥??ì¦ì§„?˜ê¸° ?„하???¤ìŒ ê°??¸ì˜ ?…무 ë¥??˜í–‰?????ˆë‹¤. 1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리ë? ?„í•œ ?호ê°??‘ë ¥ì²´ê³„ 구축 2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê¸°ìˆ ??ê´€???•ë³´??êµë¥˜?€ ê³µë™?€??br />3. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??„ë‹´?¸ë ¥???호ê°??Œê²¬êµìœ¡ ??3ì¡?비ë? ?„수???˜ë¬´) ??ë²•ì— ?°ë¼ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„ê¸°ê´€ë¦¬ì—…ë¬´ì— ì¢…ì‚¬?˜ê±°??종사?˜ì????는 ê·?ì§ë¬´???Œê²Œ ??비ë????€??br />?게 ?„설?˜ê±°??ì§ë¬´??목ì ?¸ì— ?´ë? ?¬ìš©?˜ì—¬?œëŠ” ?„니 ?œë‹¤. ??4ì¡??¬ìƒ ?? 1 êµ???•ë³´?장?€ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리ì? ê´€?¨í•˜???¤ìŒ ê°??¸ì˜ ?´ëŠ ?˜ë‚˜???´ë‹¹?˜ëŠ” ?ì— ?€?˜ì—¬ ?¬ìƒ??br />ê³? ?ˆì‚°??범위?ì„œ ?¬ìƒê¸ˆì„ ì§€ê¸‰í• ???ˆë‹¤. 1. ?¬ì´ë²„í…Œ??기ë„??ê´€???•ë³´ë¥??œê³µ????br />2. ?¬ì´ë²„í…Œ?¬ë? ê°€???ë? ? ê³ ????br />3. ?¬ì´ë²„í…Œ?¬ì˜ ?ì? ë°??€?‘Â·ë³µêµ¬ì— ê³µì´ ë§Žì? ??br />2 ????— ?°ë¥¸ ?¬ìƒê³??¬ìƒê¸?ì§€ê¸‰ì˜ ê¸°ì?·방법ê³??ˆì°¨, 구체?ì¸ ì§€ê¸‰ì•¡ ???„ìš”???¬í•?€ êµ???•ë³´?장???•í•œ?? ????벌칙 ??5ì¡?벌칙) 1 ?¤ìŒ ê°??¸ì˜ ?´ëŠ ?˜ë‚˜???´ë‹¹?˜ëŠ” ?는 5???´í•˜ ??ì§•ì— ?는 3천만???´í•˜??벌금??처한?? 1. ??2ì¡°ì œ2??ë°???2ì¡°ì œ4??„ ?„ë°˜????br />2. ??3ì¡°ì œ4??„ ?„ë°˜????br />3. ??3ì¡°ë? ?„ë°˜????br />2 ?…무??과실ë¡??¸í•˜??????˜ 죄ë? 범한 ?는 2???´í•˜??ì§•ì— ?는 1천만???´í•˜??벌금??처한?? ??6ì¡?과태ë£? 1 ?¤ìŒ ê°??¸ì˜ ?´ëŠ ?˜ë‚˜???´ë‹¹?˜ëŠ” ?는 2천만??br />?´í•˜??ê³¼íƒœë£Œì— ì²˜í•œ?? - 19 – 20 - 1. ??3ì¡°ì œ1??„ ?„ë°˜????br />2. ??6ì¡°ì œ3??„ ?„ë°˜????br />2 ??3ì¡°ì œ3??„ ?„ë°˜???는 1천만???´í•˜??ê³¼íƒœë£Œì— ì²˜í•œ?? 3 ????ë°?????— ?°ë¥¸ 과태료는 ?€?µë ¹?¹ì´ ?•í•˜??ë°”ì— ?°ë¼ ê´€ê³?중앙?‰ì •ê¸°ê???부ê³?징수?œë‹¤. 부 ì¹?br />??ì¡??œí–‰?? ??법ì? ê³µí¬ ??6개월??경과??? ë????œí–‰?œë‹¤. ??ì¡?보안관?œì „ë¬¸ì—…ì²´ì— ?€??경과조치) ??ë²??œí–‰ ?¹ì‹œ 책임기ê???br />??2ì¡???˜ 보안관?œì„¼???…무ë¥??œê³µ?˜ê³ ?ˆëŠ” ?…ì²´????ë²??œí–‰ ?¼ë???6개월 ?´ì— ?‰ì •ê¸°ê????¥ì—ê²?보안관?œì „문업체로 지??ë°?br />?„야 ?œë‹¤.êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??ë²•ë¥ ??비용추계??미첨부 ?¬ìœ ??br />1. ?¬ì •?˜ë°˜?”ì¸ ?œì •?ˆì? êµ???•ë³´?장 ?Œì†?˜ì— êµ???¬ì´ë²„안?„센?°ë? ?¤ì¹˜?˜ë„ë¡??˜ê³ ??br />ê³?????ì¡?, ?¬ê°?¨ê³„???¬ì´ë²„위기경보ê? ë°œë ¹??경우?는 ?¬ì´ë²„위기ë?책본 부ë¥?별ë„ë¡?구성·?´ì˜?˜ë˜ 본ë??¥ì? ?¸ë ¥???Œê²¬ ë°??¥ë¹„ë¥??œê³µ??기ê?????br />?게 ê·??Œìš”경비ë¥?지?í• ???ˆë„ë¡?ê·œì •?˜ê³ ?ˆìœ¼ë©?????6ì¡?, 책임기ê???br />?¥ì˜ ê¸°ìˆ ì§€???”ì²???°ë¼ 지?ì„ ??기ê????¥ì—ê²?ê·??Œìš”경비ë¥?지?í• ??br />?„ë¡ ?˜ê³ ?ˆê³ (????7ì¡?, 책임기ê????€?˜ì—¬ ê¸°ìˆ ???´ì „, ?¥ë¹„???œê³µ ?±ì˜ 지?ì„ ?????ˆë„ë¡??˜ê³ ?ˆìœ¼ë©?????8ì¡?, ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리ì? ê´€?¨í•˜???¬ìƒê¸ˆì„ ì§€ê¸‰í• ???ˆë„ë¡??˜ê³ ?ˆë‹¤(????4ì¡?. 2. 미첨부 근거 ê·œì • ?Œì˜?ˆì˜ 비용추계 ?±ì— ê´€??규칙?ì œ3ì¡°ì œ1?? œ2??비용추계???€?ì´ êµ?? ?ˆì „보장·군사기ë???ê´€???¬í•??경우) ë°?????ê¸°ìˆ ?으ë¡?추계가 ?´ë ¤??ê²?br />?????´ë‹¹?œë‹¤. 3. 미첨부 ?¬ìœ ?œì •?ˆì— ?°ë¼ ?¬ì •?Œìš”ê°€ ë°œìƒ??것으ë¡??ˆìƒ?˜ëŠ” 부ë¶?ì¤?첫째, êµ???¬ì´ë²?br />?ˆì „?¼í„°???¤ì¹˜Â·?´ì˜ë¹„ìš©ê³?ê´€?¨í•˜?¬ì„œ???„재 ?˜êµê°€?¬ì´ë²„안?„ê?리규???€??br />?¹í›ˆ????22????ì¡??™ì— ?˜í•˜???´ë? ì¡°ì§???œë™ ì¤‘ì— ?ˆìœ¼ë©? ?œì •?ˆì˜ ??br />?‰ì— ?°ë¼ 별ë„ë¡?추ê????¸ë ¥?´ë‚˜ ?œì„¤???†ì„ 것ì´?´ì„œ 추ê?비용 ë°œìƒ?€ ??br />- 21 – 22 - 견ë˜ì§€ ?ŠëŠ”?¤ëŠ” ?´ë‹¹?ì˜ ?µë????ˆì—ˆ?? ?í•œ ?„재 ?´ì˜ ì¤‘ì¸ ì¡°ì§?´ì˜ ë°???br />?…ë‚´??? êµ???ˆì „보장ê³?ê´€?¨ëœ ?œë™?´ì—???¬í•¨?˜ì–´ ?ˆìœ¼ë¯€ë¡??´ë? 공개?˜ê¸° 곤ë??˜ë‹¤ê³??˜ëŠ” ??êµ???€?ŒëŸ¬?¼í„°ë¥??¤ì¹˜Â·?´ì˜ë¹„ìš©??ì¶”ì •?˜ëŠ”???„실?으ë¡?br />?œê³„ê°€ 존재?œë‹¤. ?˜ì§¸, ?¬ì´ë²„위기ë?책본부??구성ê³??´ì˜???€???Œìš”경비 지?ì? ?¨ê??°ì •??br />ì°¸ê³ ??과거 ? 사?¬ë?(?¬ê°?¨ê³„???¬ì´ë²„위기경보ê? ë°œë ¹???¬ë?)ê°€ 충분??ì¡?br />?¬í•˜ì§€ ?Šê³ , ?¬ì´ë²„ìœ„ê¸°ì˜ ì¢…ë¥˜?€ ?¼í•´???•ë„·범위 ë°?ê·¸ì— ?°ë¥¸ ?¸ë ¥???Œê²¬ ê³??¥ë¹„???œê³µ?¼ë¡œ ?¸í•´ ë°œìƒ?˜ëŠ” ?Œìš”경비ë¥??°ì •?˜ëŠ”???„ìš”???©ë¦¬??기ì? ?±ì´ 부족하???„재?œì ?ì„œ ? ë¹™???ˆëŠ” 추계ë¥??‘성?˜ê¸°ê°€ 곤ë??˜ë‹¤. ?‹ì§¸, 책임기ê? 지?기관???€??지?? 책임기ê????€??지??ë°??¬ì´ë²„í…Œ??br />ë°©ì??€ ê´€?¨í•œ ?¬ìƒê¸?지급과 ê´€?¨í•˜?¬ì„œ???„재 ?œì ?ì„œ 책임기ê???지?ìš” ì²??´ìš©?´ë‚˜ ê·?규모ë¥??ˆì¸¡?˜ê±°??책임기ê????€??지?ì˜ êµ¬ì²´?ì¸ ?´ìš©??br />?ˆìƒ?˜ëŠ” ê²ƒì´ ?¬ì‹¤??곤ë??˜ê³ , ?¬ì´ë²„í…Œ??ë°©ì??€ ê´€?¨í•œ ?¬ìƒê¸?ì§€ê¸‰ì— ê´€??br />기ì? ë°?지급액 ?±ì´ ë¯¸ì •???태?´ê¸° ?Œë¬¸??ê´€??비용??추계?˜ê¸°ê°€ 곤ë???br />?? 4. ?‘성??br />?œìƒê¸??˜ì›???¥ì˜¤??보좌관 (02-788-2271) |
What is Cybersecurity?
Last week, a number of Korean organizations fell victim to cyber attacks. This has prompted discussions about cybersecurity in Korea, and while following this issue I’ve realized that Korea’s main challenge appears to be understanding what cybersecurity actually is.
From many of the discussions, representatives from various organizations appear to believe that security is a force, much like the police or military. Cybersecurity, however, is not an organization. It is not something that can be prevented by a single group. Cybersecurity is a responsibility – a mindset – that each technology user must adopt. Everyone plays a part in the cybersecurity of Korea (and the world), and anyone not considering the security of their devices are putting not only themselves, but also their friends/family/workplace/bank/government/etc. in danger.
Indeed, organizations can play a part in helping to improve cybersecurity. Police investigations, for example, can lead to catching cyber criminals, and thus potentially reduce on-line crime. But Police cannot be everywhere, and are inherently reactionary. And unless citizens want the government protecting the people from themselves (via pre-incident monitoring to make sure you don’t click on the ‘wrong’ link), then security of the country should be achieved through education of everyone.
The thing that every citizen, company and government entity needs to realize that your device probably will be compromised. So think of security as a function of time. With enough time, even the strongest security can be broken. So just give hackers less time. Change your passwords often, factory reset your phone and reformat your computers every 6 to 12 months, make sure your software is always up to date, use anti-viruses and firewalls on all your devices, and be very selective about software and websites you use. There is a lot of information available about on-line security, so there is really no reason not to understand and implement the basics. It doesn’t take a lot of time, and it could end up saving you, or someone you love, a lot of inconvenience later.
Remember, cybercrime is not static. Security that worked yesterday may not work today. So securing devices should become a way of life, not a once-off effort.
Security resources: www.google.com/intl/ko/goodtoknow, www.kisa.or.kr and www.ctrc.go.kr
Letter to Editor: [PDF ENG] [PDF KOR]
[CFP] ICDF2C 2013 Note of Change of Date
Please note, the dates for the ICDF2C 2013 have slightly changed.
Fifth International Conference on Digital Forensics and Cyber Crime - ICDF2C 2013
25-27 September 2013
Moscow, Russia
http://www.d-forensics.org/2013
Submission deadline: 17 May 2013
Notification of Acceptance: 17 June 2013
Camera Ready: 1st September 2013
Conference Date: 25th and 27th September 2013
Signature Based Detection of User Events for Post-Mortem Forensic Analysis
As seen on DigitalFIRE
<div>
<div class="separator" style="clear: both; text-align: center;">
</div>The concept of signatures is used in many fields, normally for the detection of some sort of pattern. For example, antivirus and network intrusion detection systems sometimes implement signature matching to attempt to differentiate legitimate code or network traffic from malicious data. The principle of these systems that that within a given set of data, malicious data will have some recognizable pattern. If malicious code, for example, has a pattern that is different in some way to non-malicious data, then the malicious data may be able to be differentiated with signature-based methods. In terms of malware, however, signature based methods are becoming less effective as malicious software gains the ability to alter or hide malicious patterns. For example, polymorphic or encrypted code.
This work suggests that signature based methods may also be used to detect patterns or user actions of a digital system. This is based on the principle that computer systems are interactive. This means that when a user interacts with the system, the system is immediately updated. In this work, we analyzed a user’s actions in relation to timestamp updates on the system.
During experimentation, we found that timestamps on a system may be updated for many different reasons. Our work, however, determined that there are at least three major timestamp update patterns given a user action. We define these as Core, Supporting and Shared timestamp update patterns.
Core timestamps are timestamps that are updated each time, and only when, the user action is executed.
Supporting timestamps are timestamps that are updated sometimes, and only when, the user action is executed.
Shared timestamps are timestamps that are shared between multiple user actions. So, for example, the timestamps of a single file might be updated by two different user actions. With shared timestamps it is impossible to determine which action updated the timestamp without more information.
By categorizing timestamps into these three primary categories, we can construct timestamp signatures to detect if and when a user action must have happened. For example, since only one action can update Core timestamps, the time value of the timestamp is approximately the time in which the user action must have taken place.
The same can be said for Supporting timestamps, but we would expect Supporting timestamps values to be at or before the last instance of the user action.
Using this categorization system, and finding associations of timestamps to user actions, user actions in the past can be reconstructed just by using readily available meta-data in a computer system.
For more information, please see our article on this topic:
James, J., P. Gladyshev, and Y. Zhu. (2011) “Signature Based Detection of User Events for Post-Mortem Forensic Analysis”. Digital Forensics and Cyber Crime: Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering. Volume 53, pp 96-109. Springer. [PDF][arXiv:1302.2395]</div>
Image courtesy of Salvatore Vuono / FreeDigitalPhotos.net