International Symposium on Cybercrime Response (ISCR) 2013

International Symposium on Cybercrime Response (ISCR) 2013
When: 25 - 27th June, 2013
Location: Seoul, South Korea
Website: http://iscr.netan.go.kr/iscr2013/

The International Symposium on Cybercrime Response (ISCR) is a cybercrime-related conference held annually in Seoul, Korea. The Cyber Terror Response Center (CTRC), the division in charge of cybercrime responses in the KNPA, is organizing this year’s symposium.

The ISCR started in 2000 as a forum for law enforcement agencies, government officials, academia, and various IT security experts from private sector. Every year, a theme is chosen, mainly from topics related to the latest challenges and responses of cybercrime. The Korean National Police Agency invites distinguished speakers in the disciplines of cyber security including operations, technologies, and policy strategies.

The ISCR has provided unique opportunities to meet people and share latest knowledge internationally. It is a purely non-profit event and solely sponsored by the Korean National Police. In 2012, 423 participants from 30 different countries attended the three-day-long conference.

Read more…
~1 min read

Cybersecurity and Challenges to Democracy

South Korea’s democracy can only be described as… developing. In the late 1970s, after the assassination of Military Dictator Park Chung-hee (who Koreans often refer to as ‘President Park’), slow but relatively steady progress in terms of democracy was made in South Korea. This despite the fact that the North Korean threat, and communism in general, was a topic constantly abused to allow the government to gain more power.

Recent incidents, however, have prompted a vie for power within the South Korean government that will have serious consequences for South Korea’s democracy going forward. In the recent weeks North Korea has been saber rattling per usual, to which South Koreans are generally unaffected. One issue with this situation, however, is that the recent cyber attacks on South Korean banking and broadcasting systems are also being attributed to North Korea without, at the time of this writing, any verifiable proof that North Korea carried out the attacks. South Korea currently has IP addresses tracing back to various countries, and attack patterns that are “similar” to those used by North Korea in the past. At best, the evidence is unsubstantial. However, the South Korean National Intelligence Service (NIS) (think C.I.A. on steroids) has formally released a statement claiming North Korean involvement, which, of course, no one can confirm or deny.

This statement comes days after the exceedingly toned-down proposal of the South Korean “National Cyber Terror Prevention Act”. This act, in essence, gives the NIS, or NIS-controlled groups, full power to create, vote on and enforce anti-cyber terror policies through the creation of an NIS-lead “cyber control tower”. Ironically, the act itself was proposed by the very members of Congress who are responsible for keeping the NIS in check. The most interesting aspect of the act, however, is the definition of cyber terror. Cyber terror, according to the act, can potentially be almost anything.

Consider that the NIS was created during the time of a military dictatorship with the express intention of fighting communism. Because of that, the NIS effectively reports to no authority save for the president. The NIS has, in the past, attempted to push anti-terrorism acts that would allow them even more power with little checks on how that power is used and abused. However, when discussing physical terrorism, many experts can, and have, resisted such a push. Cyber terrorism, however, is extremely vague. So much so that even experts in the field do not agree on its definition and how it should be handled. This is a problem most countries are currently facing that is related to the lack definition of terms like cyber crime, cyber war and cyber terrorism. Because of the lack of definition, government agencies all over the world are attempting to create jurisdiction around whatever term they choose, generally focusing on which term will bring the most power and budget benefits rather than which term correctly describes the situation.

South Korea is an extreme example of how agencies can combine fear with vague terms to expand their power. Of course, this is all made possible because the South Korean people allow it to happen, normally through complacency and cultural restrictions. However, regardless of culture, similar situations are happening in most countries right now. While a centralized all-knowing government ‘cyber control tower’ may have some benefits, it simply won’t stop cyber crime/terror/war. Further, what benefit such an over-powered group could contribute to a democratic society is completely undermined that group’s ability to abuse such power.

The reality is, cyber crime/terrorism/war is largely made possible by the public, and just like ‘traditional crime’ will never be completely stopped. The general public (globally) appear to have little interest in securing themselves, and they are about to give up what little freedom they have so their governments can ineffectively protect the people from themselves. Anyone who chooses to use technology should take responsibility for themselves, get informed and start implementing basic cyber security practices. If the people start securing themselves, the majority of digital crimes can be drastically reduced, and it won’t cost anyone hard-earned freedoms to do it.

[PDF]

Read more…
3 min read

South Korean National Cyber Terrorism Prevention Act (English)

An unofficial English translation of the proposed South Korean National Cyber Terrorism Prevention Act.

The recently proposed South Korean National Cyber Terrorism Prevention Act: [Korean PDF]		 [English PDF]


<div style="text-align: center;">National Anti-Cyberterrorism Act (Legislative Bill)</div>(April 9, 2013)
Rationale
The cyberspace, which is a virtual space connecting computers and other information technology
devices through networks, now has not only become a common space for the daily lives of all
citizens, but also transcends borders among states and public/private sector.
Due to its uniqueness, both public and private sectors cannot unilaterally block all cyber-attacks
that occur beyond space and time. Furthermore, unlike disorder in the physical world, a single
person can potentially cause national crisis by launching a cyber terror attack.
Cyber crisis can have enormous influence on the whole society. Attacks on national major
information communications network as shown in the case of 1.25 Internet crisis(Slammer Worm),
and organized cyber terrorism from overseas that can lead to leakage of national secrets and
technology, is increasing everyday, and is more likely to occur in the future.
However, Korea has yet to establish a systematic national anti-cyberterrorism plan or policies and
specific procedures to manage such crises. In case of a cyber crisis, this situation may lead to severe
danger and serious damage to national security and national interest.
Therefore this bill proposes the establishment of a national comprehensive response system
involving the government and the private sector, hence detect cyber terror attacks in advance to
prevent national cyber crisis and concentrate national capacity in times of crisis to take prompt
action.
Executive Summary
A. The Director of the National Intelligence Service (hearafter NIS) may organize and operate a
public-private consultative body in order to efficiently manage cyber crisis and mutually share
information related to cyber-attacks (Article 5).
B. The Director of the NIS should establish the master plan of national cyber terror prevention and
crisis management and construct an implementation plan to distribute to the Heads of responsible
agencies (Article 7).
C. Establishment of the National Cyber Security Center under the Director of the NIS for a
comprehensive and systematic national response to cyber terrorism and management of cyber crisis
(Article 9).
D. Heads of responsible organizations should either establish and operate a Security Management
Centre capable of detecting and analyzing cyber-attack information and promptly response to such
1threats, or depute the task to a Security Management Centre established and operated by other
institutions (Article 12).
E. Heads of central administrative agencies should immediately carry out investigations when
damage occurs due to a cyber terror attack, and should notify the Heads of related administrative
agencies and the Director of the NIS in cases of critical damage (Article 13).
F. The Director of the NIS can issue the Cyber Crisis Alert in the interest of systematic response to
cyber terrorism, and the Heads of responsible organizations should take appropriate measures to
minimize or restore damage (Article 15).
G. The government may organize and operate Cyber Crisis Response Headquarters consisting of
related institutions and professionals for analysis, investigation, immediate response, and damage
restoration when a Cyber Crisis Alert higher than Alert state is issued (Article 16).
H. The government may carry forward policy measures necessary for cyber crisis management,
such as technology development, international cooperation, industry development, and human
resource development (Article 19, 20, and 21).
I. The government may give monetary reward to those who provide information on cyber terror
attempts or report cyber terrorists (Article 24).
J. Those who divulge official secrets are sentenced to maximum five years in prison or fined to
maximum 30 million won. Those who have not established a Security Management Centre may be
charged with maximum 20 million won for negligence (Article 25 and 26).
*Legislative Bill for National Anti-Cyberterrorism Act
Chapter 1 General Provisions
Article 1 (Purpose)
The purpose of this Act is to contribute to national security and national interest by stipulating the
fundamental situations of national cyber terror prevention in order to prevent cyber terror which
threatens national security and enable prompt response by concentrating national capacity in cases
of cyber crises.
Article 2 (Definitions)
1) The definition of the terms used in this Act is as follows.
1. “Cyber Terrorism” refers to all offensive actions that intrude, disturb, paralyze, or destroy
information telecommunication infrastructure, or actions related to information theft, damage and
2dissemination of distorted information by electronic means such as hacking, computer virus,
denial of service, and electromagnetic wave.
2. “Cyber Security” refers to measures and responses through administrative, physical,
technological means in order to protect information telecommunication infrastructure and
information from cyber terrorism, and includes cyber crisis management.
3. “Cyber Crisis” refers to a situation in which a cyber terror attack causes serious disruption to the
function of the state and society or could potentially spread damage nationwide.
4. “Cyber Terror information” refers to information of certain actions determined by information
systems and information security system (including software) as cyber terrorism, and includes IP
addresses and MAC addresses used to identify the source of the cyber attack.
5. “Cyber Crisis Alert” refers to alerts issued in order to provide cyber threat information when a
cyber crisis is expected to occur, thereby enabling related organizations to take appropriate
measures according to the threat level.
6. “Cyber Crisis Management” refers to all national level measures and actions pertaining to cyber
terror detection, response, investigation, restoration of damage, mock exercise, issuance of
warning and cooperation among agencies in order to prevent cyber crisis and systematically take
prompt action in case of cyber crisis.
7. “Agencies Responsible of Cyber Terror Prevention and Crisis Management (“Responsible
Agencies”)” refers to the following agencies performing tasks related to cyber terror prevention
and crisis management.
a. <Constitution (대한민국헌법)>, <Government Organization Act (정부조직법)>, other
national agencies and local autonomous entities established by other legislation, and public
institutions according to Article 3, paragraph 10 of <Framework Act on National
Informatization (국가정보화 기본법)>
b. Agencies in charge of managing major information and communications infrastructure
according to Article 5, paragraph 1 of <Act on the Protection of Information and
Communications Infrastructure (정보통신기반 보호법)>
c. Business operator of clustered information and communications facilities according to Article
46, paragraph 1, and major providers of information and communications services according
to Article 47-3, paragraph 2 of <Act on Promotion of Information and Communications
Network Utilization and Information Protection, etc.(정보통신망 이용촉진 및 정보보호
등에 관한 법률)>
3d. Corporations or research institutes which hold National Core Technology according to
Article 9 of <Act on Prevention of Diligence and Protection of Industrial Technology
(산업기술의 유출방지 및 보호에 관한 법률)>
e. Defense contractors according to Article 3, paragraph 9, and specialized research institutes
according to Article 3, paragraph 10 of <Defense Acquisition Program Act (방위사업법)>
8. “Support Institution for Anti-Cyberterrorism and Crisis Management (“Support Institution”)”
refers to the following institutions or corporations which support prompt detection, response,
investigation, and damage restoration of cyber terror.
a. Electronics and Telecommunications Research Institute (ETRI) Affiliated research institute
according to Article 8 of<Act for the Establishment, Management and Promotion of
Government-supported Research Institutes in the Science and Technology Sector
(과학기술분야 정부출연연구기관 등의 설립 운영 및 육성에 관한 법률)>
b. Korea Internet Security Agency (KISA) according to Article 52 of <Act on Promotion of
Information and Communications Network Utilization and Information Protection, etc.
(정보통신망 이용촉진 및 정보보호 등에 관한 법률)>
c. Software business operators who produce or sell antivirus software according to Article 24 of
<Software Industry Promotion Act (소프트웨어산업 진흥법)>
d. Producers or importers of information protection system according to Article 3, paragraph 9
of <Framework Act on National Informatization (국가정보화 기본법)>
e. Designated consulting companies specialized in knowledge and information security
according to Article 9 of <Act on the Promotion of Information and Communications
Infrastructure (정보통신기반보호법)>
f. Companies specialized in security management designated by the Head of related
administrative agencies
2) Apart from the terms defined above, other terms used in this Act accords to <Act on the
Protection of Information and Communications Infrastructure (정보통신기반 보호법)>, <Act
on Promotion of Information and Communications Network Utilization and Information
Protection, etc (정보통신망 이용촉진 및 정보보호 등에 관한 법률)>, <Framework Act on
National Informatization (국가정보화 기본법)>, <Telecommunications Business Act
(전기통신사업법)>.
Article 3 (Relations to other legislations)
4This Act shall be applied with the exception of clauses of other legislations that regulate the
prevention of cyber terror and crisis management. However, if a cyber crisis occurs, this Act shall
supercede other legislations in application.
Article 4 (Obligation of Responsible Agencies)
Chief of Responsible Agencies are responsible for maintaining safety of information
communications facilities within their jurisdiction in order to prevent cyber terror. Accordingly,
they should devise measures to secure professional workforce dedicated to and budget necessary for
the prevention of cyber terrorism and crisis management.
Article 5 (Public-Private Cooperation)
1) The government may organize joint consultative bodies with private institutes according to the
Presidential decree in order to efficiently manage cyber crisis and cooperate to prevent cyber terror
and take appropriate countermeasures.
2) Other considerations necessary for paragraph 1 shall be prescribed by Presidential Decree.
Chapter 2 National Cyber Terror Prevention and Crisis Management System
Article 6 (National Cyber Security Strategy Council)
1) The National Cyber Security Strategy Council (hereinafter refer to as“Strategy Council”) shall be
established under the Director of the NIS to deliberate important matters regarding national anti-
cyberterrorism and crisis management.
2) The Director of the NIS chairs the Strategy Council.
3) The Strategy Council shall have vice-minister class officials of central administrative agencies
and those appointed by the Chairman of the Strategy Council (= Director of the NIS).
4) The Strategy Council shall deliberate the following.
1. Establishment and improvement of cyber terror prevention and crisis management strategies,
policies, and institutions
2. Problems pertaining to role adjustment among agencies related to cyber terror prevention and
crisis management
3. Problems pertaining to sharing and protecting cyber threat information according to Article
12, paragraph 2
4. Other problems presented by the Chairman of the Strategy Council (= Director of the NIS) or
submitted by council members
55) The Strategy Council may set up a National Cyber Security Countermeasure Council (hereinafter
refer to as “Countermeasure Council”) in order to efficiently operate the Strategy Council.
6) Other specific matters pertaining to the organization and operation of the Strategy Council or the
Countermeasure Council shall be prescribed by Presidential Decree.
Article 7 (Establishment of a Master Plan for National Anti-cyberterrorism and Crisis
Management)
1) The Government should establish and implement National Anti-cyberterrorism and Crisis
Management Master Plan (hereinafter refer to as “Master Plan”) in order to efficiently and
systematically push forward measures for cyber terror prevention and crisis management.
2) The Master Plan shall be outlined by the deliberation of the Strategy Council and discussion
among the Director of the NIS and Heads of related central administrative agencies according to
Presidential Decree.
3) The Head of central administrative agency should devise and disseminate National Anti-
cyberterrorism and Crisis Management Implementation Plan (hereinafter refer to as
“Implementation Plan”) to Heads of sub-agencies in order to enable them to utilize the Master
Plan according to paragraph 1.
Article 8 (Confirmation of Compliance to the Implementation Plan and Report to the
National Assembly)
1) The Head of central administrative agency should annually confirm the compliance of its sub-
agencies to the Implementation Plan.
2) The Director of the NIS gather the confirmation results of paragraph 1 and conduct an inspection
of the actual condition of national cyber terror prevention and crisis management, and report the
results to the National Assembly. However, inspection and assessment of the National Assembly,
Court, Constitutional Court, National Election Commission shall be conducted only when
requested by each entity.
3) Procedures and means necessary for paragraph 1 and 2 shall be prescribed by Presidential Decree.
Article 9 (Establishment of National Cyber Security Center)
1) For a comprehensive and systematic state- level prevention of and response to cyber terrorism
and cyber crisis management, National Cyber Security Center (hereinafter refer to as “Security
Center”) shall be established under the Director of the NIS.
2) The Security Center shall undertake the following duties.
1. Establishment of national anti-cyberterrorism and crisis management policies
62. Support for the Strategy Council and the operation of the Countermeasure Council
3. Collect, analyze and disseminate information related to cyber terror
4. Secure the safety of national information communications network
5. Devise and disseminate national cyber terror prevention and crisis management manual
6. Investigate cyber terror cases and support recovery from damage
7. Cooperation with other countries in sharing cyber attack information
3) The Director of the NIS may set up and operate a Private-Public-Military Joint Response Team
(hereinafter refer to as “Joint Response Team”) in order to support comprehensive judgment,
situation management, threat causation analysis, investigation, etc. according to paragraph 1
when necessary.
4) The Director of the NIS may request the Head of central administrative agency or other support
agencies to dispatch workforce and provide equipment necessary for the establishment and
operation of the Joint Support Team when needed.
Chapter 3. Anti-cyberterrorism and Cyber Crisis management ac
Article 10. (Establishment and Operation of Anti-Cyberterrorism policy)
1) To secure the safety and reliability of information and its network, heads of Responsible
Agencies shall establish Anti-cyberterrorism policy.
2) The Director of the NIS may prepare and deliver a necessary guideline for establishment of Anti-
cyberterrorism prevention policy. In this case, The Director of NIS shall consult with a head of
central administrative agencies concerned in advance.
3) In the case of paragraph 2) applied to central administrative agencies of the National Assembly,
court, constitutional court and national election commission, it is applied only in a case that the
head of concerning agency or institution considers it necessary.
Article 11 (Precluding spread of malicious program)
1) If the Government becomes aware of websites or software including malicious program, it shall
provide related information to operators so that they can take measures for security necessary to
preclude spread of malicious program.
2) The Government may, if it judges the compromised websites or software is highly likely to be
misused and potentially dangerous despite measures under paragraph 1), delete or block them by
using anti-virus program.
3) Specific details necessary measures pursuant to paragraph 10 or paragraph 2) shall be prescribed
by the Presidential Decree.
7Article 12 (Establishment of Security Control Center etc)
1) Head of a Responsible Agency shall establish and manage an organization which is able to detect
and analyze cyberterrorism information, and immediately response, or entrust the work to a security
control center which agencies, following subparagraph, establish and manage. Provided,
Information Sharing & Analysis Center, in accordance with Article 16 of Act on the Protection of
Information and Communications Infrastructure, is deemed as a security control center
1. Relevant Central Administrative Agencies
2. National Intelligence Service
3. Specialized Security Control Corporation in accordance to Article 2-Paragraph 1) -
Subparagraph f
2) Head of Responsible agencies shall share cyberterrorism information, and vulnerability of
information networks or software etc, in accordance with Paragraph 1) (hereinafter refer to as
“Cyber Threat information”), with heads of relevant agencies and the Director of the NIS
3) For efficient management and operation of Cyber Threat information, in accordance with
Paragraph 2, The Director of the NIS may establish and manage Cyber Threat information
integration system with heads of relevant agencies.
4) Any person shall fairly use and manage the information shared in accordance with paragraph 2, ,
only within the scope of Cyber Crisis management.
5) Security Control Center, in accordance with paragraph 1, establishment and management of
Cyber Threat information integration system’s establishment and management, and matters
concerning information management, in accordance with paragraph 3, scope, process and method of
Cyber Terror information sharing, in accordance with paragraph 2, shall be prescribed by the
Presidential decree.
Article 13 (Incident investigation)
1) In the case when damages made to the jurisdiction of a central administration agency, the head of
the central administration agency shall conduct incident investigation swiftly on the cause and
damages, and in the case of severe damages or concerns over the possibility of expansion of
damages, he/she shall immediately notify the results to the head of related central administration
agency and the Director of the NIS.
2) Despite the paragraph 1), when the case is deemed to cause severe impacts on national security
and interest, the Director of the NIS can consult the related central administration agency and
conduct the investigation on its own.
83) In the case when swift actions are deemed to be necessary for restoration and prevention of
further damages according to the notification of the investigation result regarding paragraph 1) or
the NIS’s own investigation regarding paragraph 2), the Director of the NIS may request necessary
measures to heads of responsible agencies. The responsible agency’s heads must abide by the
request if there is no substantial reason not to.
4) No person shall delete/damage/modify data related to cyber terror before the incident
investigation regarding paragraph 1) and 2)
Article 14 (Response Training)
1) The Government shall execute training programs to prevent cyber terror from happening and
respond systematically and efficiently.
2) Trainings regarding paragraph 1) may either be executed regularly every year or be conducted as
occasion demands, and regular training may be executed together with Emergency Preparedness
Training regarding Article 14 of <Emergency Preparedness Resources Management Act
(비상대비자원관리법)>
3) The necessary issues including the execution method and procedure of the training regarding
paragraph 1) etc. shall be prescribed in the Presidential Decree.
Article 15 (Announcement of Cyber Crisis Alert)
1) To systematically prepare and respond to cyber terror, the Director of the NIS may announce
four-stage Cyber Crisis Alert (moderate/substantial/secure/critical), based either on the request of
the head of a responsible agency or on the complement/ judgment of intelligence gathered regarding
Article 12 paragraph 2).
2) In the case when a cyber terror is deemed to cause serious damage to national security, the
Director of the NIS may consult the Senior Secretary to the President for National Crisis Control in
the National Security Department to announce critical-level alert, and in the case of the
announcement of a critical-level Alert, it shall inform the reason of the announcement to the
National Assembly.
3) The Director of the NIS shall consult the level of Cyber Crisis Alert prior to the announcement.
4) The head of responsible agencies should take measures to minimize occurring damages and to
foster restoration immediately after the announcement of Cyber Crisis Alert regarding paragraph 1).
5) The necessary issues regarding the procedure, criteria, measures by heads of responsible agencies,
etc. shall be prescribed in the Presidential Decree.
Article 16 (Organizing Cyber Crisis Response Headquarters)
91) In the case of a Cyber Crisis Alert above the “Caution-level”, the Government may organize and
operate Cyber Crisis Response Headquarters (hereinafter refer to as “Response HQ”), in which
experts from private sectors, the Government and the Military participate to concentrate national
capacity, for swift responding measures such as analysis of causes, investigation, emergency
response, recovery of damages, and etc.
2) The head of Response HQ (hereinafter refer to as “Head”) shall be the Director of the NIS, and
the necessary issues regarding the organization and operation of Response HQ shall be determined
after the Director of the NIS consults with related central administrative agencies’ heads.
3) The Head may request needed workforce and equipment from responsible agencies and
supporting agency heads in order to organize/operate the Response HQ stated in paragraph 1). The
responsible agencies and supporting agencies’ heads must abide by the request if there is no
substantial reason not to.
4) The Head may provide occurred expenses to the head of agencies that dispatched workforces and
equipments to the Response HQ.
Article 17 (Technical Assistance)
1) In the case the head of a responsible agency need support to operate on duties regarding Article
12 paragraph 1) and Article 15 paragraph 4), he/she may request support from the head of the
related central administrative agency or the Director of the NIS.
2) The head of related central administrative agency or the Director of the NIS shall provide
necessary measures including technical assistance when it received the request regarding paragraph
1), so to insure swift responses.
3) Regarding the support in paragraph 2), the head of related central administrative agency or the
Director of the NIS may request support of the requesting agency, and shall provide the content and
period of support beforehand.
4) The head of related central administrative agency or the Director of the NIS may provide
incurred expenses to the head of agencies for the support regarding paragraph 3).
Chapter 4. R&D, Support etc
Article 18(Provision for Responsible Agency)
The Government may provide the Responsible agencies necessary technical assistance, equipments
and other needed support in order to protect information & communications network.
10Article 19(R&D)
1) The Government may promote the following policies for technology development and
improvement necessary for the prevention of a Cyber Terror and Cyber Crisis management;
1. Establishment and operation of national research and development plan for Cyber Terror
prevention and Cyber Crisis management
2. Survey on the needs of Cyber Terror prevention and Cyber Crisis management technology /
project about trend analysis
3. Cyber Terror prevention and Cyber Crisis management technology’s development, supply and
distribution project
4.
And so forth, necessary matters concerning Cyber Terror prevention and Cyber Crisis
management technology’s development and improvement
2) In accordance the paragraph 1, the Director of NIS may establish research institute or designate
agency established by other act as a specialized agency.
3) The Director of the NIS may settle detailed matters concerning process and method of Cyber
Terror prevention and Cyber Crisis management technology
Article 20(Industry Promotion)
1) For industry promotion support on Cyber Terror prevention and Cyber Crisis management
technology, Government shall establish and operate policies as follow, and find necessary finance
securing method.
1. Support for policy establishment about Cyber Terror prevention and Cyber Crisis
management industry
2. Support of market invigoration for Cyber Terror prevention and Cyber Crisis management
technology development
3. Establishment of industry-academic cooperation for Cyber Terror prevention and Cyber
Crisis management industry promotion
4.
Support for International exchange and cooperation, and overseas expansion of Cyber Terror
prevention and Cyber Crisis management industry
2) Government may let a research institute or a specialized agency, stated in Paragraph 2) of Article
19, operate a necessary task for industry promotion, stated in paragraph 1).
Article 21(Education, Training and Public Awareness)
For base-establishment of Cyber Terror prevention and Cyber Crisis management, and
improvement of public awareness about Cyber Crisis, Government shall devise measures as follow;
111. Manpower training about Cyber Terror prevention and Cyber Crisis management
2. Publicity and education about Cyber Terror prevention and Cyber Crisis management
3.
And so forth, necessary matters concerning education, training and public awareness about
Cyber Terror prevention and Cyber Crisis management
Article 22 (International Cooperation)
The Government may execute the following matters to strengthen cooperation with international
organizations, agencies and foreign countries in the case of Anti-cyberterrorism and Cyber Crisis
management.
1. Construct mutual cooperation system for prevention of cyber terror and Cyber Crisis
management
2. Sharing of Information and response coordination in technologies regarding Anti-
cyberterrorism and Cyber Crisis management
3.
Secondment/training of personnel-in-charge for Anci-cyberterrorism and Cyber Crisis
management
Article 23 (Confidentiality)
Any person who engages or engaged in a job related to the prevention of cyber terror and Cyber
Crisis management affairs shall not divulge to another person any secret that he/she has learned
while performing his/her duties, nor use it for any purpose other than performance of his/her duties.
Article 24 (Reward, etc.)
1) Regarding the prevention of cyber terror and Cyber Crisis management, the Director of the NIS
may award a prize to a person that suits the followings, and may provide rewards within the
boundary permitted by its budget.
1. Person who provided information on the attempt of a cyber terror
2. Person who reported on the actor(s) of cyber terror
3. Person who provided an outstanding service in detecting, responding to, and recovering
from a cyber terror
2)The criteria, manner and procedure, concrete amount of the money paid, and other necessary
issues in awarding a prize and reward will be determined by the Director of the NIS.
Chapter 5. Penal Provisions
12Article 25 (Penal Provisions)
1) Any person falling under any of the following subparagraphs shall be punished by imprisonment
with prison labor for at most five years or by fine not exceeding 30 million won;
1. Any person in violation of Article 12 paragraph 2) and Article 12 paragraph 4)
2. Any person in violation of Article 13 paragraph 4)
3. Any person in violation of Article 23
2) Any person falling under any of the subparagraph 1. due to negligence in the conduct of business
shall be punished by imprisonment with prison labor for at most two years or by fine not exceeding
10 million won.
Article 26 (Penalty)
1) Any person falling under any of the following subparagraphs shall be charged not exceeding 20
million won for penalty;
1. Any person in violation of Article 13 paragraph 1)
2. Any person in violation of Article 16 paragraph 3)
2) Any person in violation of Article 13 paragraph 3) shall be charged not exceeding 10 million
won for penalty.
3) Penalty being charged due to paragraphs 1) and 2) shall be imposed and collected by related
National Administration Agency as prescribed in the Presidential Decree.

This unofficial translation is made for academic researches and reviews.

Any comments and/or suggestion will be very helpful for the improvement of cyber-security of
Korea and the World. Please leave a comment, or email me.
Read more…
19 min read

South Korean National Cyber Terrorism Prevention Act (Korean)

The recently proposed South Korean National Cyber Terrorism Prevention Act: [Korean PDF] [English PDF]


êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??법률??br />(?œìƒê¸°ì˜???€?œë°œ??
????br />ë²???br />4459
발의?°ì›”??: 2013. 4. 9.
ë°?br />??br />??: ?œìƒê¸?조명ì²??¤ìž¬??br />ê°•ì????¤ìƒ???•ë¬¸??br />민병ì£??¬í•™ë´??´ì² ??br />ê¹€?¥ì‹¤.? ê²½ë¦?ê¹€?¬ê²½
?¡ì˜ê·??˜ì›(13??
?œì•ˆ?´ìœ 
?¬ì´ë²„공간ì? ?•ë³´?µì‹ ê¸°ìˆ ??비약?ì¸ 발전ê³??”불???•ë³´ê¸°ê¸°?€
컴퓨??그리ê³??¸í„°???±ì˜ ?¤íŠ¸?Œí¬ë¡??°ê²°??ê°€?ì˜ 공간?¼ë¡œ ?´ë?
êµ?? ?í™œ??보편?ì¸ ?ì—­?¼ë¡œ ?ë¦¬ë§¤ê??˜ì?ê³? êµ?²½??초월?˜ì—¬ ë²?br />지구적?´ë©´???•ë??€ 민간부분이 ?í˜¸ ë°€?‘히 ?°ê³„?˜ì–´ ?ˆìŒ.
?´ëŸ¬???¹ìˆ˜?±ìœ¼ë¡?말ë??”ì•„ 복잡.고도?”되ë©? ?œê³µê°„의 ?œì•½??ë²?br />?´ë‚˜ 발생?˜ëŠ” 모든 ?¬ì´ë²„공격을 ?•ë??€ 민간 ?´ëŠ ?˜ë‚˜???¨ë…?¼ë¡œ
차단?˜ê¸°?ëŠ” 분명???œê³„ê°€ ?ˆìŒ. 게다가 ?¬ì´ë²„í…Œ?¬ë¡œ 초래?˜ëŠ” ?¬ì´
버상???„기???„실?¸ê³„??물리??질서?¼ë?ê³??¬ë¦¬ ?¹ì •ê°œì¸???€??br />것일지?¼ë„ êµ???„ì²´???„기ë¡??•ë??????ˆìŒ.
- 1 – 2 -
그리ê³?과거 1.25 ?¸í„°???€?€ê³?ê°™ì? ?„êµ­?ì¸ 규모??êµ?? 주요
?•ë³´?µì‹ ë§?마비?¬íƒœ 발생ê³??´ì™¸ë¡œë???조직?ì¸ ?¬ì´ë²„í…Œ?¬ë¡œ êµ??
기ë? ë°?첨단기술??? ì¶œ ??êµ??.?¬íšŒ ?„ë°˜??중ë????í–¥??미칠
???ˆëŠ” ?¬ì´ë²„위ê¸?발생 ê°€?¥ì„±??? ë¡œ 증ë??˜ê³  ?ˆìŒ.
그러???°ë¦¬?˜ë¼???„직 êµ??차원?ì„œ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?br />?…무ë¥?체계?ìœ¼ë¡??˜í–‰?????ˆëŠ” ?œë„?€ 구체??방법.?ˆì°¨ê°€ ?•ë¦½
?˜ì–´ ?ˆì? ?Šì•„ ?¬ì´ë²„위ê¸?발생 ??êµ???ˆë³´?€ êµ?µ??중ë????„í—˜ê³?br />막ë????í•´ë¥??¼ì¹  ?°ë ¤ê°€ ?ˆìŒ.
?°ë¼????법에?œëŠ” ?•ë??€ 민간??참여??êµ??차원??종합?ì¸ ?€??br />체계ë¥?구축?˜ë„ë¡??˜ê³ , ?´ë? ?µí•˜???¬ì´ë²„í…Œ?¬ë? ?¬ì „???ì??˜ì—¬
?¬ì´ë²„위ê¸?발생 ê°€?¥ì„±??조기??차단?˜ë©°, ?„기 발생 ??êµ??????Ÿ‰??br />결집?˜ì—¬ ? ì†???€?‘í•  ???ˆë„ë¡??˜ê³ ????
주요?´ìš©
ê°€. êµ???•ë³´?ìž¥?€ ?¬ì´ë²„위기ë? ?¨ìœ¨?ìœ¼ë¡?관리하ê³??¬ì´ë²„ê³µê²?br />ê´€?¨ì •ë³´ë? ?í˜¸ 공유?˜ê¸° ?„하??ë¯?ê´€ ?‘의체ë? 구성.?´ì˜??br />???ˆìŒ(????ì¡?.
?? êµ???•ë³´?ìž¥?€ êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관??기본계획??br />?˜ë¦½?˜ê³  ?´ì— ?°ë¼ ?œí–‰ê³„획???‘성?˜ì—¬ 책임기ê????¥ì—ê²?ë°?br />?¬í•˜?¬ì•¼ ??????ì¡?.?? ?¬ì´ë²„í…Œ?¬ì— ?€??êµ??차원??종합?ì´ê³?체계?ì¸ ?€?‘ê³¼ ??br />?´ë²„?„기관리ë? ?„하??êµ???•ë³´?ìž¥ ?Œì†?¼ë¡œ êµ???¬ì´ë²„안?„센
?°ë? ??????ì¡?.
?? 책임기ê????¥ì? ?¬ì´ë²„ê³µê²??•ë³´ë¥??ì?.분석?˜ì—¬ 즉시 ?€??br />?????ˆëŠ” 보안관?œì„¼?°ë? 구축.?´ì˜?˜ê±°???¤ë¥¸ 기ê???êµ?br />ì¶??´ì˜?˜ëŠ” 보안관?œì„¼?°ì— ê·??…무ë¥??„탁?˜ì—¬????????2
ì¡?.
ë§? 중앙?‰ì •ê¸°ê????¥ì? ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•´ ?¼í•´ê°€ 발생??경우??br />??? ì†?˜ê²Œ ?¬ê³ ì¡°ì‚¬ë¥??¤ì‹œ?˜ê³ , ?¼í•´ê°€ 중ë???경우 ê´€ê³?ì¤?br />?™í–‰?•ê¸°ê´€????ë°?êµ???•ë³´?ìž¥?ê²Œ ê·?ê²°ê³¼ë¥??µë³´?˜ì—¬????br />(????3ì¡?.
ë°? êµ???•ë³´?ìž¥?€ ?¬ì´ë²„í…Œ?¬ì— ?€??체계?ì¸ ?€??ë°??€ë¹„ë? ??br />?˜ì—¬ ?¬ì´ë²„위기경보ë? 발령?????ˆìœ¼ë©? 책임기ê????¥ì? ?¼í•´
발생??최소?”하거나 ?¼í•´ë³µêµ¬ 조치ë¥?취해????????5ì¡?.
?? ?•ë???경계?¨ê³„ ?´ìƒ???¬ì´ë²„위기경보ê? 발령??경우 ?ì¸ë¶?br />?? ?¬ê³ ì¡°ì‚¬, 긴급?€?? ?¼í•´ë³µêµ¬ ?±ì„ ?„하??ê´€ê³?기ê? ë°???br />문인?¥ì´ 참여?˜ëŠ” ?¬ì´ë²„위기ë?책본부ë¥?구성.?´ì˜?????ˆìŒ
(????6ì¡?.
?? ?•ë????¬ì´ë²„위기ê?리에 ?„ìš”??기술개발.êµ? œ?‘력·?°ì—…?¡ì„±Â·
?¸ë ¥?‘성 ???„ìš”???œì±…??추진?????ˆìŒ(????9ì¡? ??0ì¡?ë°?br />??1ì¡?.
- 3 – 4 -
?? ?•ë????¬ì´ë²„í…Œ??기도??ê´€???•ë³´ë¥??œê³µ?˜ê±°???¬ì´ë²„í…Œ??br />ë¥?ê°€???ë? ? ê³ ???ì— ?€?˜ì—¬ ?¬ìƒê¸ˆì„ 지급할 ???ˆìŒ(??br />??4ì¡?.
ì°? 직무??비ë????„설??경우?ëŠ” 5???´í•˜??징역 ?ëŠ” 3천만??br />?´í•˜??벌금??처하ê³? 보안관?œì„¼?°ë? 구축?˜ì? ?„니??경우??br />??2천만???´í•˜??과태료에 처할 ???ˆìŒ(????5ì¡?ë°???6ì¡?.법률 ??br />??br />êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??법률??br />????총칙
??ì¡?목적) ??법ì? êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??기본?ì¸ ?¬í•­??br />규정?˜ì—¬ êµ???ˆë³´ë¥??„협?˜ëŠ” ?¬ì´ë²„í…Œ?¬ë? ?ˆë°©?˜ê³  ?¬ì´ë²??„기
발생 ??êµ?? ??Ÿ‰??결집?˜ì—¬ ? ì†?˜ê²Œ ?€ì²˜í•¨?¼ë¡œ??êµ?????ˆì „
보장ê³??´ìµë³´í˜¸???´ë°”지?¨ì„ 목적?¼ë¡œ ?œë‹¤.
??ì¡??•ì˜) 1 ??법에???¬ìš©?˜ëŠ” ?©ì–´???•ì˜???¤ìŒê³?같다.
1. ?œì‚¬?´ë²„?ŒëŸ¬?ë? ?´í‚¹Â·ì»´í“¨??바이?¬ìŠ¤Â·?œë¹„?¤ë°©?´Â·ì „?ê¸°????br />?„자???˜ë‹¨???˜í•˜???•ë³´?µì‹ ?œì„¤??침입·교ë?·마비·?Œê´´?˜ê±°??br />?•ë³´ë¥??ˆì·¨Â·?¼ì†Â·?œê³¡?„파 ?˜ëŠ” ??모든 공격?‰ìœ„ë¥?말한??
2. ?œì‚¬?´ë²„?ˆì „?ì´?€ ?¬ì´ë²„í…Œ?¬ë¡œë¶€???•ë³´?µì‹ ?œì„¤ê³??•ë³´ë¥?보호
?˜ê¸° ?„하???˜í–‰?˜ëŠ” 관리적.물리??기술???˜ë‹¨ ë°??€?‘ì¡°ì¹?br />?±ì„ ?¬í•¨???œë™?¼ë¡œ???¬ì´ë²„위기ê?리ë? ?¬í•¨?œë‹¤.
3. ?œì‚¬?´ë²„?„기?ë? ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•˜??êµ??.?¬íšŒê¸°ëŠ¥???¬ê°??br />지?¥ì„ 초래?˜ê±°???¼í•´ê°€ ?„êµ­?ìœ¼ë¡??•ì‚°??ê°€?¥ì„±???ˆëŠ” ê²?br />?°ë? 말한??
- 5 – 6 -
4. ?œì‚¬?´ë²„?ŒëŸ¬?•ë³´?ë? ?•ë³´?œìŠ¤??ë°??•ë³´ë³´í˜¸?œìŠ¤???Œí”„?¸ì›¨?´ë?
?¬í•¨?œë‹¤) ?±ì— ?˜í•´ ?¬ì´ë²„í…Œ???‰ìœ„ë¡??ë‹¨?˜ëŠ” ?•ë³´ë¡œì„œ ?¬ì´ë²?br />?ŒëŸ¬ 근원지ë¥??Œì•…?˜ê¸° ?„í•œ ?¸í„°?·í”„로토콜주??IP)?€ ?¤íŠ¸?Œí¬
카드주소(MAC)ë¥??¬í•¨?œë‹¤.
5. ?œì‚¬?´ë²„?„기경보?ë? ?¬ì´ë²„í…Œ??징후ë¥??ë³„?˜ê±°???¬ì´ë²„위ê¸?br />발생???ˆìƒ?˜ëŠ” 경우 ê·??„í—˜ ?ëŠ” ?„협?˜ì???부?©ë˜??조치ë¥?br />?????ˆë„ë¡?미리 ?•ë³´ë¥??œê³µ?˜ê³  경고?˜ëŠ” 것을 말한??
6. ?œì‚¬?´ë²„?„기관리”ë? ?¬ì´ë²„위기ë? ?ˆë°©?˜ê³  ?¬ì´ë²„위기ê? 발생?˜ì?
??경우 ? ì†?˜ê³  체계?ìœ¼ë¡??€?‘하ê¸??„í•œ ?¬ì´ë²„í…Œ???ì?.?€??
?¬ê³ ??조사.복구, 모의?ˆë ¨, 경보발령 ë°?관계기관 간의 ?‘ì¡° ??br />êµ??차원??모든 ?œë™??말한??
7. ?œì‚¬?´ë²„?ŒëŸ¬ ë°©ì? ë°??„기관ë¦?책임기ê?(?´í•˜ ?œì±…?„기관?ì´??br />?œë‹¤)?ì´?€ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ê´€???…무ë¥??˜í–‰??br />ê³??ˆëŠ” ?¤ìŒ ê°?목의 기ê???말한??
ê°€. ?Œë??œë?êµ?—Œë²•ã€? ?Œì •ë¶€ì¡°ì§ë²•ã€? ê·?밖의 법령???°ë¼ ?¤ì¹˜??br />êµ??기ê?ê³?지방자치단ì²?및「국가?•ë³´??기본법」제3ì¡°ì œ10??br />???°ë¥¸ 공공기ê?
?? ?Œì •ë³´í†µ? ê¸°ë°?보호법ã€???ì¡°ì œ1??— ?°ë¥¸ 주요?•ë³´?µì‹ ê¸?br />반시?¤ì„ 관리하??기ê?
?? ?Œì •ë³´í†µ? ë§ ?´ìš©ì´‰ì§„ ë°??•ë³´ë³´í˜¸ ?±ì— ê´€??법률????6ì¡?br />????— ?°ë¥¸ 집적?•ë³´?µì‹ ?œì„¤?¬ì—…??ë°?ê°™ì? ë²???7조의4????— ?°ë¥¸ 주요?•ë³´?µì‹ ?œë¹„???œê³µ??br />?? ?Œì‚°?…기? ì˜ ? ì¶œë°©ì? ë°?보호??ê´€??법률????조에 ?°ë¥¸
êµ???µì‹¬ê¸°ìˆ ??보유??기업체나 ?°êµ¬ê¸°ê?
ë§? ?Œë°©?„사?…법????ì¡°ì œ9?¸ì— ?°ë¥¸ 방위?°ì—…ì²?ë°?ê°™ì? ë²???ì¡?br />??0?¸ì— ?°ë¥¸ ?„문?°êµ¬ê¸°ê?
8. ?œì‚¬?´ë²„?ŒëŸ¬ ë°©ì? ë°??„기관ë¦?지?ê¸°ê´€(?´í•˜ ?œì??ê¸°ê´€?ì´??br />?œë‹¤)?ì´?€ ?¬ì´ë²„í…Œ?¬ì— ?€??? ì†???ì?·?€??ë°??¬ê³ ì¡°ì‚¬Â·
복구 ?±ì„ 지?í•˜???¤ìŒ ê°?목의 기ê? ?ëŠ” ?…ì²´ë¥?말한??
ê°€. ?Œê³¼?™ê¸°? ë¶„???•ë?출연?°êµ¬ê¸°ê? ?±ì˜ ?¤ë¦½Â·?´ì˜ ë°??¡ì„±??br />ê´€??법률????조에 ?°ë¥¸ ?œêµ­?„자?µì‹ ?°êµ¬??부?¤ì—°êµ¬ì†Œ
?? ?Œì •ë³´í†µ? ë§ ?´ìš©ì´‰ì§„ ë°??•ë³´ë³´í˜¸ ?±ì— ê´€??법률????2ì¡?br />???°ë¥¸ ?œêµ­?¸í„°?·ì§„?¥ì›
?? ?Œì†Œ?„트?¨ì–´?°ì—… 진흥법」제24조에 ?°ë¼ ?Œí”„?¸ì›¨?´ì‚¬?…자ë¡?br />? ê³ ????ì¤?컴퓨?°ë°”?´ëŸ¬??백신?Œí”„?¸ì›¨?´ë? ?œìž‘ ?ëŠ” ?ë§¤
?˜ëŠ” ??br />?? ?Œêµ­ê°€?•ë³´??기본법ã€???ì¡°ì œ6?¸ì˜ ?•ë³´ë³´í˜¸?œìŠ¤?œì„ ?œìž‘
?˜ê±°???˜ìž…?˜ëŠ”??br />ë§? ?Œì •ë³´í†µ? ê¸°ë°?보호법」제9조에 ?°ë¼ 지?•ëœ 지?ì •ë³´ë³´??br />컨설?…전문업ì²?br />ë°? ê´€ê³??‰ì •ê¸°ê????¥ì´ 지?•í•œ 보안관?œì „문업ì²?br />2 ??법에???¬ìš©?˜ëŠ” ?©ì–´???•ì˜??????—???•í•˜??것을 ?œì™¸
- 7 – 8 -
?˜ê³ ???Œì •ë³´í†µ? ê¸°ë°?보호법」·「정보통? ë§ ?´ìš©ì´‰ì§„ ë°??•ë³´ë³´í˜¸
?±ì— ê´€??법률?Â·ã€Œêµ­ê°€?•ë³´??기본법」·「전기통? ì‚¬?…법?ì—??br />?•í•˜??바에 ?°ë¥¸??
??ì¡??¤ë¥¸ 법률과의 ê´€ê³? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ê´€?˜ì—¬
?¤ë¥¸ 법률???¹ë³„??규정???ˆëŠ” 경우ë¥??œì™¸?˜ê³ ????법에???•í•˜??br />바에 ?°ë¥¸?? ?¤ë§Œ, ?¬ì´ë²„위기ê? 발생??경우?ëŠ” ?¤ë¥¸ 법률???°ì„ 
?˜ì—¬ ?ìš©?œë‹¤.
??ì¡?책임기ê???책무) 책임기ê????¥ì? ?¬ì´ë²„í…Œ?¬ë? ?¬ì „ ?ˆë°©?˜ê¸°
?„하???Œê? ?•ë³´?µì‹ ?œì„¤???ˆì „??? ì???ì±…ìž„???ˆìœ¼ë©? ?´ë? ??br />?˜ì—¬ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??…무ë¥??„ë‹´?˜ëŠ” ?„문?¸ë ¥ ë°?br />?ˆì‚° ?•ë³´ ?±ì˜ ?„ìš”??조치ë¥?강구?˜ì—¬???œë‹¤.
??ì¡?민·ê? ?‘ë ¥) 1 ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??€?‘에 ?‘ë ¥?˜ê³  ??br />?´ë²„?„기ë¥??¨ìœ¨?ìœ¼ë¡?관리하ê¸??„하???€?µë ¹?¹ìœ¼ë¡??•í•˜??바에
?°ë¼ 민간기ê? ?±ê³¼ ?‘의체ë? 구성.?´ì˜?????ˆë‹¤.
2 ????— ê´€?˜ì—¬ ?„ìš”???¬í•­ ?±ì? ?€?µë ¹?¹ìœ¼ë¡??•í•œ??
????êµ?? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?추진체계
??ì¡?êµ???¬ì´ë²„안?„ì „?µíšŒ??) 1 êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?br />??ê´€??중요?¬í•­???¬ì˜?˜ê¸° ?„하??êµ???•ë³´?ìž¥ ?Œì†?˜ì— êµ???¬ì´ë²„안?„ì „?µíšŒ???´í•˜ ?œì „?µíšŒ?˜â€ë¼ ?œë‹¤)ë¥??”다.
2 ?„ëžµ?Œì˜???˜ìž¥?€ êµ???•ë³´?ìž¥???œë‹¤.
3 ?„ëžµ?Œì˜???„원?€ 중앙?‰ì •ê¸°ê???ì°¨ê?ê¸?공무?ê³¼ ?„ëžµ?Œì˜
?˜ìž¥???„ì´‰?˜ëŠ” ?ë¡œ ?œë‹¤.
4 ?„ëžµ?Œì˜???¤ìŒ ê°??¸ì˜ ?¬í•­???¬ì˜?œë‹¤.
1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???„ëžµ.?•ì±….?œë„ ?˜ë¦½ ë°?ê°?br />??br />2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€??기ê?ê°???• ì¡°ì •??ê´€???¬í•­
3. ??2ì¡°ì œ2??— ?°ë¥¸ ?¬ì´ë²„위?‘ì •ë³?공유 ë°?보호??ê´€???¬í•­
4. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???€?µë ¹ 지?œì‚¬??— ?€??조치
방안
5. ê·?밖에 ?„ëžµ?Œì˜ ?˜ìž¥??부?˜í•˜ê±°ë‚˜ ?„원???œì¶œ???¬í•­
5 ?„ëžµ?Œì˜???¨ìœ¨???´ì˜???„하???„ëžµ?Œì˜??êµ???¬ì´ë²„안?„ë?ì±?br />?Œì˜(?´í•˜ ?œë?책회?˜â€ë¼ ?œë‹¤)ë¥??????ˆë‹¤.
6 ?„ëžµ?Œì˜ ë°??€ì±…회?˜ì˜ 구성.?´ì˜ ?±ì— ê´€?˜ì—¬ ?„ìš”??구체?ì¸
?¬í•­?€ ?€?µë ¹?¹ìœ¼ë¡??•í•œ??
??ì¡?êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?기본계획 ?˜ë¦½ ?? 1 ?•ë???br />?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??€ì±…의 ?¨ìœ¨??체계??추진???„하
??êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?기본계획(?´í•˜ ?œê¸°ë³¸ê³„?â€ì´??br />?œë‹¤)???˜ë¦½.?œí–‰?˜ì—¬???œë‹¤.
2 기본계획?€ ?€?µë ¹?¹ìœ¼ë¡??•í•˜??바에 ?°ë¼ êµ???•ë³´?ìž¥??ê´€
- 9 – 10 -
ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘의?˜ì—¬ ?„ëžµ?Œì˜ ?¬ì˜ë¥?거쳐 마련?œë‹¤.
3 중앙?‰ì •ê¸°ê????¥ì? ????˜ 기본계획???°ë¼ ?Œê? 책임기ê???br />?¥ì´ ?œìš©?????ˆë„ë¡?êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??œí–‰ê³„획
(?´í•˜ ?œì‹œ?‰ê³„?â€ì´?¼ê³  ?œë‹¤)???‘성?˜ì—¬ ?Œê? 책임기ê????¥ì—ê²?br />배포?˜ì—¬???œë‹¤.
??ì¡??œí–‰ê³„획???´í–‰?¬ë? ?•ì¸ ë°?êµ?šŒ ë³´ê³ ) 1 중앙?‰ì •ê¸°ê????¥ì?
?Œê? 책임기ê????€?˜ì—¬ 매년 ?œí–‰ê³„획???´í–‰?¬ë?ë¥??•ì¸?˜ì—¬??br />?œë‹¤.
2 êµ???•ë³´?ìž¥?€ ????˜ ?•ì¸ê²°ê³¼ë¥?종합?˜ì—¬ êµ???¬ì´ë²„í…Œ??br />ë°©ì? ë°??„기관ë¦??¤íƒœë¥??ê?.?‰ê??˜ê³  ê·?ê²°ê³¼ë¥?êµ?šŒ??ë³´ê³ ??br />?¬ì•¼ ?œë‹¤. ?¤ë§Œ, êµ?šŒ, 법원, ?Œë²•?¬íŒ?? 중앙? ê±°ê´€ë¦¬ìœ„?íšŒ???€
???ê?.?‰ê???êµ?šŒ ?¬ë¬´ì´ìž¥, 법원?‰ì •ì²˜ìž¥, ?Œë²•?¬íŒ???¬ë¬´ì²?br />??ë°?주앙? ê±°ê´€ë¦¬ìœ„?íšŒ ?¬ë¬´ì´ìž¥???”ì²­??경우???œí•œ??
3 ????ë°?????˜ ?ˆì°¨?€ 방법 ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•­?€ ?€??br />?¹ë ¹?¼ë¡œ ?•í•œ??
??ì¡?êµ???¬ì´ë²„안?„센?°ì˜ ?¤ì¹˜) 1 ?¬ì´ë²„í…Œ?¬ì— ?€??êµ??차원??br />종합?ì´ê³?체계?ì¸ ?ˆë°©.?€?‘ê³¼ ?¬ì´ë²„위기ê?리ë? ?„하??êµ??
?•ë³´?ìž¥ ?Œì†?¼ë¡œ êµ???¬ì´ë²„안?„센???´í•˜ ?œì•ˆ?„센?°â€ë¼ ?œë‹¤)ë¥?br />?”다.
2 ?ˆì „?¼í„°???¤ìŒ ê°??¸ì˜ ?…무ë¥??˜í–‰?œë‹¤.
1. êµ???¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??•ì±…???˜ë¦½2. ?„ëžµ?Œì˜ ë°??€ì±…회???´ì˜???€??지??br />3. ?¬ì´ë²„í…Œ??ê´€???•ë³´???˜ì§‘.분석.?„파
4. êµ???•ë³´?µì‹ ë§ì˜ ?ˆì „???•ë³´
5. êµ?? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?매뉴???‘성.배포
6. ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•˜??발생???¬ê³ ??조사 ë°?복구 지??br />7. ?¸êµ­ê³¼ì˜ ?¬ì´ë²?공격 ê´€???•ë³´???‘ë ¥
3 êµ???•ë³´?ìž¥?€ ????˜ ?ˆì „?¼í„°ë¥??´ì˜?¨ì— ?ˆì–´ êµ??차원??br />종합?ë‹¨, ?í™©ê´€?? ?„협?”인 분석, ?¬ê³  조사 ?±ì„ ?„í•´ ë¯?ê´€.
êµ??©ë™?€?‘í?(?´í•˜ ?œí•©?™ë??‘í??ì´???œë‹¤)???¤ì¹˜.?´ì˜??????br />??
4 êµ???•ë³´?ìž¥?€ ?©ë™?€?‘í????¤ì¹˜.?´ì˜?˜ê¸° ?„하???„ìš”??ê²?br />?°ì—??중앙?‰ì •ê¸°ê? ë°?지?ê¸°ê´€???¥ì—ê²??¸ë ¥???Œê²¬ê³??¥ë¹„??지??br />???”ì²­?????ˆë‹¤.
?????¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??œë™
??0ì¡??¬ì´ë²„í…Œ??ë°©ì??€ì±…의 ?˜ë¦½.?œí–‰) 1 책임기ê????¥ì? ?Œê?
?•ë³´?µì‹ ë§ê³¼ ?•ë³´ ?±ì˜ ?ˆì „??ë°?? ë¢°???•ë³´ë¥??„í•œ ?¬ì´ë²„í…Œ??br />ë°©ì??€ì±…을 강구?˜ì—¬???œë‹¤.
2 êµ???•ë³´?ìž¥?€ ????— ?°ë¥¸ ?¬ì´ë²„í…Œ??ë°©ì??€ì±…의 ?˜ë¦½????br />- 11 – 12 -
?”í•œ 지침을 ?‘성 배포?????ˆë‹¤. ??경우, êµ???•ë³´?ìž¥?€ 미리
ê´€ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘의?˜ì—¬???œë‹¤.
3 ????„ ?ìš©???Œì—??êµ?šŒ, 법원, ?Œë²•?¬íŒ?? 중앙? ê±°ê´€ë¦¬ìœ„
?íšŒ???‰ì •?¬ë¬´ë¥?처리?˜ëŠ” 기ê???경우?ëŠ” ?´ë‹¹ 기ê????¥ì´ ??br />?”하?¤ê³  ?¸ì •?˜ëŠ” 경우?ë§Œ ?ìš©?œë‹¤.
??1ì¡??…성?„로그램???•ì‚° 차단) 1 ?•ë????…성?„로그램 ?±ì´ ?¬í•¨
???¹ì‚¬?´íŠ¸ ?ëŠ” ?Œí”„?¸ì›¨???±ì„ 발견??경우??ê·??´ì˜?ì—ê²?br />?…성?„로그램??감염 ?•ì‚°ë°©ì? ?±ì— ?„ìš”??보안조치ë¥??????ˆë„
ë¡?ê´€???•ë³´ë¥??œê³µ?˜ì—¬???œë‹¤.
2 ?•ë???????˜ 조치?ë„ 불구?˜ê³  ?¬ì´ë²„í…Œ?¬ì— ?…ìš©?˜ê±°??br />?„í—˜?±ì´ ?’다ê³??ë‹¨?˜ëŠ” 경우??백신?„로그램??? í¬ ?±ì„ ?µí•´
?…성?„로그램 ?±ì„ ?? œ ?ëŠ” 차단?˜ê²Œ ?????ˆë‹¤.
3 ????ë°?????— ?°ë¼ ?„ìš”??조치??구체?ì¸ ?¬í•­?€ ?€?µë ¹
?¹ìœ¼ë¡??•í•œ??
??2ì¡?보안관?œì„¼???±ì˜ ?¤ì¹˜) 1 책임기ê????¥ì? ?¬ì´ë²„í…Œ???•ë³´ë¥?br />?ì?·분석?˜ì—¬ 즉시 ?€??조치ë¥??????ˆëŠ” 기구(?´í•˜ ?œë³´?ˆê???br />?¼í„°?ë¼ ?œë‹¤)ë¥?구축·?´ì˜?˜ê±°???¤ìŒ ê°??¸ì˜ 기ê???구축·?´ì˜
?˜ëŠ” 보안관?œì„¼?°ì— ê·??…무ë¥??„탁?˜ì—¬???œë‹¤. ?¤ë§Œ, ?Œì •ë³´í†µ??br />기반 보호법ã€???6조에 ?°ë¥¸ ?•ë³´ê³µìœ Â·ë¶„석?¼í„°??보안관?œì„¼?°ë¡œ
본다.
1. ê´€ê³?중앙?‰ì •ê¸°ê?2. êµ???•ë³´??br />3. ??ì¡°ì œ1?? œ8?¸ë°”목의 보안관?œì „문업ì²?br />2 책임기ê????¥ì? ????— ?°ë¥¸ ?¬ì´ë²„í…Œ???•ë³´?€ ?•ë³´?µì‹ ë§?
?Œí”„?¸ì›¨?´ì˜ 취약???±ì˜ ?•ë³´(?´í•˜ ?œì‚¬?´ë²„?„협?•ë³´?ë¼ ?œë‹¤)ë¥?br />ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?ìž¥ê³?공유?˜ì—¬???œë‹¤.
3 êµ???•ë³´?ìž¥?€ ????˜ ?¬ì´ë²„위?‘정보의 ?¨ìœ¨?ì¸ ê´€ë¦?ë°???br />?©ì„ ?„하??관계기관???¥ê³¼ 공동?¼ë¡œ ?¬ì´ë²„위?‘정보통?©ê³µ? ì²´
계ë? 구축·?´ì˜?????ˆë‹¤.
4 ?„구? ì? ????— ?°ë¼ 공유?˜ëŠ” ?•ë³´???€?˜ì—¬???¬ì´ë²„위기ê?
리ë? ?„하???„ìš”???…무범위???œí•˜???•ë‹¹?˜ê²Œ ?¬ìš© 관리하?¬ì•¼
?œë‹¤.
5 ????— ?°ë¥¸ 보안관?œì„¼?°ì? ????— ?°ë¥¸ ?¬ì´ë²„위?‘ì •ë³?br />?µí•©ê³µìœ ì²´ê³„ 구축·?´ì˜ ë°??•ë³´ 관리에 ê´€???¬í•­ê³?????—
?°ë¥¸ ?¬ì´ë²„í…Œ???•ë³´??공유??ê´€??범위.?ˆì°¨.방법 ?±ì—
ê´€???¬í•­?€ ?€?µë ¹?¹ìœ¼ë¡??•í•œ??
??3ì¡??¬ê³ ì¡°ì‚¬) 1 중앙?‰ì •ê¸°ê????¥ì? ?¬ì´ë²„í…Œ?¬ë¡œ ?¸í•˜???Œê?
분야???¼í•´ê°€ 발생??경우?ëŠ” ê·??ì¸ê³??¼í•´?´ìš© ?±ì— ê´€?˜ì—¬
? ì†???¬ê³ ì¡°ì‚¬ë¥??¤ì‹œ?˜ê³ , ?¼í•´ê°€ 중ë??˜ê±°???•ì‚°???°ë ¤ê°€ ??br />??경우 즉시 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?ìž¥?ê²Œ ê·?ê²?br />ê³¼ë? ?µë³´?˜ì—¬???œë‹¤.
2 êµ???•ë³´?ìž¥?€ ????—??불구?˜ê³  êµ???ˆë³´ ë°??´ìµ??중ë???br />- 13 – 14 -
?í–¥??미친?¤ê³  ?ë‹¨?˜ëŠ” 경우 ê´€ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘의??br />??직접 ê·??¬ê³ ì¡°ì‚¬ë¥??¤ì‹œ?????ˆë‹¤.
3 êµ???•ë³´?ìž¥?€ ????— ?°ë¼ ?¬ê³ ì¡°ì‚¬ ê²°ê³¼ë¥??µë³´ë°›ê±°????
??— ?°ë¼ ?¬ê³ ì¡°ì‚¬ë¥???ê²°ê³¼, ?¼í•´??복구 ë°??•ì‚°ë°©ì?ë¥??„하??br />? ì†???œì •???„ìš”?˜ë‹¤ê³??ë‹¨?˜ëŠ” 경우 책임기ê????¥ì—ê²??„ìš”
??조치ë¥??”ì²­?????ˆë‹¤. ??경우 책임기ê????¥ì? ?¹ë³„???¬ìœ ê°€
?†ëŠ” ???´ì— ?°ë¼???œë‹¤.
4 ?„구? ì? ????ë°?????— ?°ë¥¸ ?¬ê³ ì¡°ì‚¬ë¥??„료?˜ê¸° ?„에
?¬ì´ë²„í…Œ?¬ì? ê´€?¨ëœ ?ë£Œë¥??„의ë¡??? œÂ·?¼ì†Â·ë³€ì¡°í•˜?¬ì„œ???„니
?œë‹¤.
??4ì¡??€?‘훈?? 1 ?•ë????¬ì´ë²„í…Œ?¬ë? ë°©ì??˜ê³  ?¬ì´ë²„위기에
체계?ì´ê³??¨ìœ¨?ìœ¼ë¡??€?‘하ê¸??„하???ˆë ¨???¤ì‹œ?˜ì—¬???œë‹¤.
2 ????˜ ?ˆë ¨?€ 매년 ?•ê¸° ?ëŠ” ?˜ì‹œë¡?구분?˜ì—¬ ?¤ì‹œ?????ˆìœ¼ë©?
?•ê¸° ?ˆë ¨?€ ?Œë¹„?ë?비자??관리법????4조에 ?°ë¥¸ 비상?€ë¹„훈??br />ê³??¨ê»˜ ?¤ì‹œ?????ˆë‹¤.
3 ????˜ ?ˆë ¨ ?¤ì‹œë°©ë²• ë°??ˆì°¨ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•­?€ ?€
?µë ¹?¹ìœ¼ë¡??•í•œ??
??5ì¡??¬ì´ë²„위기경보의 발령) 1 êµ???•ë³´?ìž¥?€ ?¬ì´ë²„í…Œ?¬ì— ?€??br />체계?ì¸ ?€ë¹„ì? ?€?‘을 ?„하??책임기ê????¥ì˜ ?”ì²­ê³???2ì¡°ì œ2
??— ?°ë¼ ?˜ì§‘???•ë³´ë¥?종합·?ë‹¨?˜ì—¬ ê´€??·ì£¼?˜Â·ê²½ê³„·심ê°??¨ê³„
???¬ì´ë²„위기경보ë? 발령?????ˆë‹¤.2 êµ???•ë³´?ìž¥?€ ?¬ì´ë²„í…Œ?¬ê? êµ???ˆë³´??중ë????„í•´ë¥?초래??br />것으ë¡??ë‹¨?˜ëŠ” 경우?ëŠ” êµ???ˆë³´?¤ì˜ êµ???„기?í™© ?…무ë¥??´ë‹¹
?˜ëŠ” ?˜ì„ë¹„서관ê³??‘의?˜ì—¬ ?¬ê° ?˜ì???경보ë¥?발령?????ˆìœ¼ë©?
?¬ê°?¨ê³„???¬ì´ë²„위기경보ë? 발령??경우?ëŠ” ê·??¬ìœ ë¥?êµ?šŒ??br />?µë³´?˜ì—¬???œë‹¤.
3 êµ???•ë³´?ìž¥?€ ?¬ì´ë²„위기경보ë? 발령??경우 관계기관???¥ê³¼
경보 ?˜ì????¬ì „ ?‘의?˜ì—¬???œë‹¤.
4 책임기ê????¥ì? ????— ?°ë¥¸ ?¬ì´ë²„위기경보ê? 발령??경우
즉시 ?¼í•´ë°œìƒ??최소??ë°??¼í•´ë³µêµ¬ë¥??„í•œ 조치ë¥?취하?¬ì•¼ ?œë‹¤.
5 ?¬ì´ë²„위기경ë³?발령???ˆì°¨Â·ê¸°ì? ë°?책임기ê????¥ì˜ 조치 ?±ì—
ê´€?˜ì—¬ ?„ìš”???¬í•­?€ ?€?µë ¹?¹ìœ¼ë¡??•í•œ??
??6ì¡??¬ì´ë²„위기ë?책본부??구성) 1 ?•ë???경계?¨ê³„ ?´ìƒ???¬ì´
버위기경보ê? 발령??경우 ?ì¸ë¶„석, ?¬ê³ ì¡°ì‚¬, 긴급?€?? ?¼í•´ë³µêµ¬
?±ì˜ ? ì†??조치ë¥?취하ê¸??„하??êµ?? ??Ÿ‰??결집??ë¯?ê´€.êµ?br />?„문가가 참여?˜ëŠ” ?¬ì´ë²„위기ë?책본부(?´í•˜ ?œë?책본부?ë¼ ?œë‹¤)ë¥?br />구성·?´ì˜?????ˆë‹¤.
2 ?€ì±…본부?????´í•˜ ?œë?책본부?¥â€ì´???œë‹¤)?€ êµ???•ë³´?ìž¥?¼ë¡œ
?˜ë©°, ?€ì±…본부??구성·?´ì˜ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•­?€ êµ???•ë³´??br />?¥ì´ ê´€ê³?중앙?‰ì •ê¸°ê????¥ê³¼ ?‘의?˜ì—¬ ?•í•œ??
3 ?€ì±…본부?¥ì? ????— ?°ë¥¸ ?€ì±…본부ë¥?구성·?´ì˜?˜ê¸° ?„하??ì±?br />?„기관 ë°?지?ê¸°ê´€???¥ì—ê²??„ìš”???¸ë ¥???Œê²¬ ë°??¥ë¹„???œê³µ
- 15 – 16 -
???”ì²­?????ˆë‹¤. ??경우 책임기ê? ë°?지?ê¸°ê´€???¥ì? ?¹ë³„??br />?¬ìœ ê°€ ?†ëŠ” ???´ì— ?°ë¼???œë‹¤.
4 ?€ì±…본부?¥ì? ????— ?°ë¼ ?¸ë ¥???Œê²¬ ë°??¥ë¹„???œê³µ????br />기ê????¥ì—ê²?ê·??Œìš”경비ë¥?지?í•  ???ˆë‹¤.
??7ì¡?기술지?? 1 책임기ê????¥ì´ ??2ì¡°ì œ1??ë°???5ì¡°ì œ4??˜
?…무ë¥??˜í–‰?¨ì— ?ˆì–´ ?„ìš”??경우 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ??
?•ë³´?ìž¥?ê²Œ 지?ì„ ?”ì²­?????ˆë‹¤.
2 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?ìž¥?€ ????— ?°ë¥¸ 지??br />???”청받았????? ì†???€?‘이 ?´ë£¨?´ì§ˆ ???ˆë„ë¡?기술지????br />?„ìš”??조치ë¥??˜ì—¬???œë‹¤.
3 ????— ?°ë¥¸ 조치ë¥??„하??ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ????br />보원?¥ì? ?´ë‹¹ 지?ê¸°ê´€???¥ì—ê²??„ìš”??지?ì„ ?”ì²­?????ˆìœ¼ë©?
??경우, 지?ê¸°ê´€???¥ì—ê²?지?í•  ?´ìš©ê³?기간??미리 ?µë³´?˜ì—¬??br />?œë‹¤.
4 ê´€ê³?중앙?‰ì •ê¸°ê?????ë°?êµ???•ë³´?ìž¥?€ ????— ?°ë¼ 지??br />????기ê????¥ì—ê²?ê·??Œìš”경비ë¥?지?í•  ???ˆë‹¤.
?????°êµ¬ê°œë°œ ë°?지??br />??br />??8ì¡?책임기ê????€??지?? ?•ë???책임기ê????€?˜ì—¬ ?•ë³´?µì‹ ë§?br />??보호?˜ê¸° ?„하???„ìš”??기술???´ì „, ?¥ë¹„???œê³µ ë°?ê·?밖의?„ìš”??지?ì„ ?????ˆë‹¤.
??9ì¡??°êµ¬ê°œë°œ) 1 ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ?„ìš”??br />기술개발ê³?기술?˜ì????¥ìƒ???„하???¤ìŒ ê°??¸ì˜ ?œì±…??추진??br />???ˆë‹¤.
1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ê´€??êµ?? ?°êµ¬ê°œë°œ 계획????br />ë¦??œí–‰
2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리기???˜ìš”조사 ë°??™í–¥ë¶„석 ?±ì—
ê´€???¬ì—…
3. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ê´€??기술??개발.보급.??br />???¬ì—…
4. ê·?밖에 ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€??기술개발 ë°?기술
?¥ìƒ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•­
2 êµ???•ë³´?ìž¥?€ ????— ?°ë¼ ?°êµ¬?Œë? ?¤ë¦½?˜ê±°?? ?¤ë¥¸ 법령??br />?˜í•˜???¤ë¦½??기ê????„문기ê??¼ë¡œ 지?•í•  ???ˆë‹¤.
3 êµ?? ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?기술???°êµ¬ê°œë°œ??ê´€????br />차·방ë²????¸ë??¬í•­?€ êµ???•ë³´?ìž¥???°ë¡œ ?•í•œ??
??0ì¡??°ì—…?¡ì„±) 1 ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ?„ìš”??br />?°ì—…???¡ì„±??지?í•˜ê¸??„하???¤ìŒ ê°??¸ì˜ ?œì±…???˜ë¦½.?œí–‰?˜ê³ 
?´ì— ?„ìš”???¬ì› ?•ë³´ 방안 ?±ì„ 마련?˜ì—¬???œë‹¤.
1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ?•ì±…?˜ë¦½ 지??br />2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… 발전???„í•œ ? í†µ?œìž¥ ?œì„±
- 17 – 18 -
??지??br />3. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ?¡ì„±???„í•œ ??????br />?‘력체계 구축
4. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??°ì—… ê´€??êµ? œêµë¥˜.?‘ë ¥ ë°???br />?¸ì§„출의 지??br />2 ?•ë?????9ì¡°ì œ2??˜ ?°êµ¬??ë°??„문기ê??¼ë¡œ ?˜ì—¬ê¸?????˜
?°ì—…?¡ì„±???„ìš”???…무ë¥??˜í–‰?˜ê²Œ ?????ˆë‹¤.
??1ì¡??¸ë ¥?‘성 ë°?교육?ë³´) ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리의
기반??조성?˜ê³  ?¬ì´ë²„위기에 ?€??êµ?????¸ì‹???œê³ ?˜ê¸° ?„하??br />?¤ìŒ ê°??¸ì˜ ?œì±…??강구?˜ì—¬???œë‹¤.
1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???„문?¸ë ¥???‘성
2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ê´€???€êµ?? ?ë³´?œë™ ë°?교육
3. ê·?밖에 ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?ê´€???„문?¸ë ¥ ?‘성
ë°?교육?ë³´ ?±ì— ê´€?˜ì—¬ ?„ìš”???¬í•­
??2ì¡?êµ? œ?‘ë ¥) ?•ë????¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리에 ê´€?˜ì—¬ êµ? œ
기구·?¨ì²´ ë°??¸êµ­ê³¼ì˜ ?‘ë ¥??증진?˜ê¸° ?„하???¤ìŒ ê°??¸ì˜ ?…무
ë¥??˜í–‰?????ˆë‹¤.
1. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리ë? ?„í•œ ?í˜¸ê°??‘력체계 구축
2. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦?기술??ê´€???•ë³´??교류?€ 공동?€??br />3. ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관ë¦??„ë‹´?¸ë ¥???í˜¸ê°??Œê²¬êµìœ¡
??3ì¡?비ë? ?„수???˜ë¬´) ??법에 ?°ë¼ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리업무에 종사?˜ê±°??종사?˜ì????ëŠ” ê·?직무???Œê²Œ ??비ë????€??br />?ê²Œ ?„설?˜ê±°??직무??목적 ?¸ì— ?´ë? ?¬ìš©?˜ì—¬?œëŠ” ?„니 ?œë‹¤.
??4ì¡??¬ìƒ ?? 1 êµ???•ë³´?ìž¥?€ ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리ì?
ê´€?¨í•˜???¤ìŒ ê°??¸ì˜ ?´ëŠ ?˜ë‚˜???´ë‹¹?˜ëŠ” ?ì— ?€?˜ì—¬ ?¬ìƒ??br />ê³? ?ˆì‚°??범위?ì„œ ?¬ìƒê¸ˆì„ 지급할 ???ˆë‹¤.
1. ?¬ì´ë²„í…Œ??기도??ê´€???•ë³´ë¥??œê³µ????br />2. ?¬ì´ë²„í…Œ?¬ë? ê°€???ë? ? ê³ ????br />3. ?¬ì´ë²„í…Œ?¬ì˜ ?ì? ë°??€?‘·복구에 공이 많ì? ??br />2 ????— ?°ë¥¸ ?¬ìƒê³??¬ìƒê¸?지급의 기ì?·방법ê³??ˆì°¨, 구체?ì¸
지급액 ???„ìš”???¬í•­?€ êµ???•ë³´?ìž¥???•í•œ??
????벌칙
??5ì¡?벌칙) 1 ?¤ìŒ ê°??¸ì˜ ?´ëŠ ?˜ë‚˜???´ë‹¹?˜ëŠ” ?ëŠ” 5???´í•˜
??징역 ?ëŠ” 3천만???´í•˜??벌금??처한??
1. ??2ì¡°ì œ2??ë°???2ì¡°ì œ4??„ ?„ë°˜????br />2. ??3ì¡°ì œ4??„ ?„ë°˜????br />3. ??3ì¡°ë? ?„ë°˜????br />2 ?…무??과실ë¡??¸í•˜??????˜ 죄ë? 범한 ?ëŠ” 2???´í•˜??징역
?ëŠ” 1천만???´í•˜??벌금??처한??
??6ì¡?과태ë£? 1 ?¤ìŒ ê°??¸ì˜ ?´ëŠ ?˜ë‚˜???´ë‹¹?˜ëŠ” ?ëŠ” 2천만??br />?´í•˜??과태료에 처한??
- 19 – 20 -
1. ??3ì¡°ì œ1??„ ?„ë°˜????br />2. ??6ì¡°ì œ3??„ ?„ë°˜????br />2 ??3ì¡°ì œ3??„ ?„ë°˜???ëŠ” 1천만???´í•˜??과태료에 처한??
3 ????ë°?????— ?°ë¥¸ 과태료는 ?€?µë ¹?¹ì´ ?•í•˜??바에 ?°ë¼
ê´€ê³?중앙?‰ì •ê¸°ê???부ê³?징수?œë‹¤.
부
ì¹?br />??ì¡??œí–‰?? ??법ì? 공포 ??6개월??경과??? ë????œí–‰?œë‹¤.
??ì¡?보안관?œì „문업체에 ?€??경과조치) ??ë²??œí–‰ ?¹ì‹œ 책임기ê???br />??2ì¡???˜ 보안관?œì„¼???…무ë¥??œê³µ?˜ê³  ?ˆëŠ” ?…ì²´????ë²??œí–‰
?¼ë???6개월 ?´ì— ?‰ì •ê¸°ê????¥ì—ê²?보안관?œì „문업체로 지??ë°?br />?„야 ?œë‹¤.êµ?? ?¬ì´ë²„í…Œ??ë°©ì???ê´€??법률??비용추계??미첨부 ?¬ìœ ??br />1. ?¬ì •?˜ë°˜?”인
?œì •?ˆì? êµ???•ë³´?ìž¥ ?Œì†?˜ì— êµ???¬ì´ë²„안?„센?°ë? ?¤ì¹˜?˜ë„ë¡??˜ê³  ??br />ê³?????ì¡?, ?¬ê°?¨ê³„???¬ì´ë²„위기경보ê? 발령??경우?ëŠ” ?¬ì´ë²„위기ë?책본
부ë¥?별도ë¡?구성·?´ì˜?˜ë˜ 본ë??¥ì? ?¸ë ¥???Œê²¬ ë°??¥ë¹„ë¥??œê³µ??기ê?????br />?ê²Œ ê·??Œìš”경비ë¥?지?í•  ???ˆë„ë¡?규정?˜ê³  ?ˆìœ¼ë©?????6ì¡?, 책임기ê???br />?¥ì˜ 기술지???”ì²­???°ë¼ 지?ì„ ??기ê????¥ì—ê²?ê·??Œìš”경비ë¥?지?í•  ??br />?„록 ?˜ê³  ?ˆê³ (????7ì¡?, 책임기ê????€?˜ì—¬ 기술???´ì „, ?¥ë¹„???œê³µ ?±ì˜
지?ì„ ?????ˆë„ë¡??˜ê³  ?ˆìœ¼ë©?????8ì¡?, ?¬ì´ë²„í…Œ??ë°©ì? ë°??„기관리ì?
ê´€?¨í•˜???¬ìƒê¸ˆì„ 지급할 ???ˆë„ë¡??˜ê³  ?ˆë‹¤(????4ì¡?.
2. 미첨부 근거 규정
?Œì˜?ˆì˜ 비용추계 ?±ì— ê´€??규칙?ì œ3ì¡°ì œ1?? œ2??비용추계???€?ì´ êµ??
?ˆì „보장·군사기ë???ê´€???¬í•­??경우) ë°?????기술?ìœ¼ë¡?추계가 ?´ë ¤??ê²?br />?????´ë‹¹?œë‹¤.
3. 미첨부 ?¬ìœ 
?œì •?ˆì— ?°ë¼ ?¬ì •?Œìš”ê°€ 발생??것으ë¡??ˆìƒ?˜ëŠ” 부ë¶?ì¤?첫째, êµ???¬ì´ë²?br />?ˆì „?¼í„°???¤ì¹˜Â·?´ì˜ë¹„ìš©ê³?ê´€?¨í•˜?¬ì„œ???„재 ?˜êµ­ê°€?¬ì´ë²„안?„ê?리규???€??br />?¹í›ˆ????22????ì¡??™ì— ?˜í•˜???´ë? 조직???œë™ 중에 ?ˆìœ¼ë©? ?œì •?ˆì˜ ??br />?‰ì— ?°ë¼ 별도ë¡?추ê????¸ë ¥?´ë‚˜ ?œì„¤???†ì„ 것이?´ì„œ 추ê?비용 발생?€ ??br />- 21 – 22 -
견되지 ?ŠëŠ”?¤ëŠ” ?´ë‹¹?ì˜ ?µë????ˆì—ˆ?? ?í•œ ?„재 ?´ì˜ 중인 조직?´ì˜ ë°???br />?…ë‚´??? êµ???ˆì „보장ê³?ê´€?¨ëœ ?œë™?´ì—­???¬í•¨?˜ì–´ ?ˆìœ¼ë¯€ë¡??´ë? 공개?˜ê¸°
곤ë??˜ë‹¤ê³??˜ëŠ” ??êµ???€?ŒëŸ¬?¼í„°ë¥??¤ì¹˜Â·?´ì˜ë¹„ìš©??추정?˜ëŠ”???„실?ìœ¼ë¡?br />?œê³„ê°€ 존재?œë‹¤.
?˜ì§¸, ?¬ì´ë²„위기ë?책본부??구성ê³??´ì˜???€???Œìš”경비 지?ì? ?¨ê??°ì •??br />참고??과거 ? ì‚¬?¬ë?(?¬ê°?¨ê³„???¬ì´ë²„위기경보ê? 발령???¬ë?)ê°€ 충분??ì¡?br />?¬í•˜ì§€ ?Šê³ , ?¬ì´ë²„위기의 종류?€ ?¼í•´???•ë„·범위 ë°?그에 ?°ë¥¸ ?¸ë ¥???Œê²¬
ê³??¥ë¹„???œê³µ?¼ë¡œ ?¸í•´ 발생?˜ëŠ” ?Œìš”경비ë¥??°ì •?˜ëŠ”???„ìš”???©ë¦¬??기ì?
?±ì´ 부족하???„재?œì ?ì„œ ? ë¹™???ˆëŠ” 추계ë¥??‘성?˜ê¸°ê°€ 곤ë??˜ë‹¤.
?‹ì§¸, 책임기ê? 지?ê¸°ê´€???€??지?? 책임기ê????€??지??ë°??¬ì´ë²„í…Œ??br />ë°©ì??€ ê´€?¨í•œ ?¬ìƒê¸?지급과 ê´€?¨í•˜?¬ì„œ???„재 ?œì ?ì„œ 책임기ê???지?ìš”
ì²??´ìš©?´ë‚˜ ê·?규모ë¥??ˆì¸¡?˜ê±°??책임기ê????€??지?ì˜ 구체?ì¸ ?´ìš©??br />?ˆìƒ?˜ëŠ” 것이 ?¬ì‹¤??곤ë??˜ê³ , ?¬ì´ë²„í…Œ??ë°©ì??€ ê´€?¨í•œ ?¬ìƒê¸?지급에 ê´€??br />기ì? ë°?지급액 ?±ì´ 미정???íƒœ?´ê¸° ?Œë¬¸??ê´€??비용??추계?˜ê¸°ê°€ 곤ë???br />??
4. ?‘성??br />?œìƒê¸??˜ì›???¥ì˜¤??보좌관 (02-788-2271)
Read more…
7 min read

What is Cybersecurity?

Last week, a number of Korean organizations fell victim to cyber attacks. This has prompted discussions about cybersecurity in Korea, and while following this issue I’ve realized that Korea’s main challenge appears to be understanding what cybersecurity actually is.

From many of the discussions, representatives from various organizations appear to believe that security is a force, much like the police or military. Cybersecurity, however, is not an organization. It is not something that can be prevented by a single group. Cybersecurity is a responsibility – a mindset – that each technology user must adopt. Everyone plays a part in the cybersecurity of Korea (and the world), and anyone not considering the security of their devices are putting not only themselves, but also their friends/family/workplace/bank/government/etc. in danger.

Indeed, organizations can play a part in helping to improve cybersecurity. Police investigations, for example, can lead to catching cyber criminals, and thus potentially reduce on-line crime. But Police cannot be everywhere, and are inherently reactionary. And unless citizens want the government protecting the people from themselves (via pre-incident monitoring to make sure you don’t click on the ‘wrong’ link), then security of the country should be achieved through education of everyone.

The thing that every citizen, company and government entity needs to realize that your device probably will be compromised. So think of security as a function of time. With enough time, even the strongest security can be broken. So just give hackers less time. Change your passwords often, factory reset your phone and reformat your computers every 6 to 12 months, make sure your software is always up to date, use anti-viruses and firewalls on all your devices, and be very selective about software and websites you use. There is a lot of information available about on-line security, so there is really no reason not to understand and implement the basics. It doesn’t take a lot of time, and it could end up saving you, or someone you love, a lot of inconvenience later.

Remember, cybercrime is not static. Security that worked yesterday may not work today. So securing devices should become a way of life, not a once-off effort.

Security resources: www.google.com/intl/ko/goodtoknow, www.kisa.or.kr and www.ctrc.go.kr

Letter to Editor: [PDF ENG] [PDF KOR]

Read more…
1 min read

[CFP] ICDF2C 2013 Note of Change of Date


Please note, the dates for the ICDF2C 2013 have slightly changed.

Fifth International Conference on Digital Forensics and Cyber Crime - ICDF2C 2013
25-27 September 2013
Moscow, Russia
http://www.d-forensics.org/2013

Submission deadline: 17 May 2013
Notification of Acceptance: 17 June 2013
Camera Ready: 1st September 2013
Conference Date: 25th and 27th September 2013

Read more…
~1 min read