=Paper=
{{Paper
|id=Vol-469/paper-4
|storemode=property
|title=A Exploratory Study on R&D Strategies in Industrial Technology Security
|pdfUrl=https://ceur-ws.org/Vol-469/paper4.pdf
|volume=Vol-469
}}
==A Exploratory Study on R&D Strategies in Industrial Technology Security==
https://ceur-ws.org/Vol-469/paper4.pdf
A Exploratory Study on R&D Strategies in
Industrial Technology Security
Hangbae Chang1 , Jonggu Kang1 Hyukjun Kwon2 , and Ilsun You3
1
Daejin University, San 11-1, Sundan-Dong, Gyeonggi-Do, 487-711, Korea
hbchang@daejin.ac.kr and Jaikang7@gmail.com
2
Yonsei University, New Millenium Hall, 262 Seongsanno, Seodaemun-Gu, Seoul,
120-749, Korea
junkwon@yonsei.ac.kr
3
Korean Bible University, 205, Sanggye-Dong, Nowon-Gu, Seoul, 139-791, Korea
isyou@bible.ac.kr
Abstract. To enhance international competitiveness through the pro-
tection of cutting-edge industrial technology, it is essential to establish
the policy for strengthening ability to develop industrial security tech-
nology and raising international competitiveness. In this study we inves-
tigated and analyzed not only the ecumenic trend but also the present
condition, then we executed the deduction of the industrial security tech-
nology development program in a aspect of government and analyzed the
current status of the technical security technology for developing security
technology and increasing leaks of the advanced industrial technology.
1 Present Status of Industrial Technology Leakage
According to the survey conducted by National Intelligence Service in 2008, the
number of disclosure of domestic industrial technology leakage is 125 from 2000
to December of 2007. If these cases were not detected, it could have caused
approximately 95 trillion won of property loss. If we have a look at the status
of annual industrial technology leakage disclosure, the number of attempts to
thieve technology which were less than 10, but it has recorded 26 in 2004, 29 in
2005, 31 in 2006, 32 in 2007. It indicates a constant increase and is urgent to
prepare a strategy to prevent the technology leakage.
The main subject of industrial technology leakage is primarily divided into in-
ternal and external stakeholders[9]. The industrial technology leakage by insider
which targets important information or electronic documents occurs via personal
computer, web based e-mail, and internet messenger[1][2]. And in case of offline
documents, it was reported as they are flowed out through Web, trespass by out-
sider committing system hacking with virus or warm, larceny by outsider flowing
D. Chadwick, I. You and H. Chang (Eds.): Proceedings of the 1st International
Workshop on Managing Insider Security Threats (MIST2009), Purdue University,
West Lafayette, USA, June 16, 2009. *Copyright is held by the author(s)*
52 Hangbae Chang et al.
Fig. 1. Status of Industrial Information Leakage
out offline documents produced by printer or photocopier. There exists an actual
case that outsider for maintenance accessed database of business process system
and flowed the large amount of information and offline documents out.
Likewise, to prevent an industrial technology leakage, domestic authority con-
cerned put Technology Leak Prevention and Industrial Technology Protection
and Support Act in operation to improve the competitiveness of domestic indus-
trial and contribute to development of national economy by preventing illegal
leakage of the industrial technology. Yet for a concrete application of this Act, it
is essential that the current status of industrial technology security and further
study of this field is needed. Thus in this study, we analyzed the current level
of domestic industrial security technology and technical competitiveness. We
expect to utilize analysis data as basic information for improving international
competitiveness and ability to develop industrial security technology[6].
To execute this plan, we analyzed the needs for industrial technology pro-
tection and designed the technical framework to fulfill those needs which were
deduced. Following designed framework, we analyzed a current level of technol-
ogy and limitation then deduced further development subject[8][10].
2 Investigation of Needs for Industrial Security
Technology
In this study, to investigate actual needs for industrial security technology, we
visited 15 providers of technology and 15 demander of technology then conducted
in-depth interviews. The primary needs for industrial security technology are as
followings[4][5]:
A Exploratory Study on R&D Strategies in Industrial Technology Security 53
Fig. 2. Research Methodology
– As a result of the investigation, it appeared to be essential to develop counter
measures for emergence of various portable storage devices(secure digital
card, compact flash card, memory stick) and communication methods(infra-
red data communications, wireless internet, blue tooth, etc)
– Some security technologies for ordinary business documents(word, excel,
power point files) have reached secure level, but security technologies for
blueprints or program source documents have yet to be well developed
– The access control method is mainly used for database security technology
rather than encryption due to a performance problem and there exist needs
for some technology enabling illegal SQL questions to be standardized.
– Measure model for security level of remote computer is still on the way
of development. And further researches about control method and resource
utilization authority management for computers which reached some extent
of security level.
– Currently, there occurs some security vulnerable spot in the linked section
because there isnt the integration between physical and technical security.
3 Technical Industrial Security Technology Framework
Design
In this study, according to disadvantage analysis result derived from risk analysis
process, we applied industrial security technology design methodology based on
risk analysis for solving vulnerability[3]. Information security technology devel-
opment methodology based on risk analysis listed vulnerability and threats for
information asset through information asset identification and analysis. Then
we designed technical industrial security technology framework by reflecting as-
sessment result about influence and risk caused by certain attack to needs for
security technology development.
Before anything else, the patterns of the security vulnerability of the personal
computer are classified as the damage of internal information in personal com-
54 Hangbae Chang et al.
puters caused by malicious external access(outflow of document file by hacking
tool considering the vulnerability of operation system, virus, worm), unreliabil-
ity(external penetration according to the absence of window password during
booting, outflow of document file caused by the absence of screen saver) of per-
sonal computer(access control) management, and intentional internal documen-
tation leakage by personal computer user(via e-mail, portable storage device).
Fig. 3. Patterns of security vulnerability of PC
The patterns of the vulnerability of electronic document are classified as
unencryption(circulation of the unclassified confidential document) and ungrad-
uation, inadequacy of access control in a way of reading, editing, conveyance,
and printing of the documents(abuse of users’ authority, illegal outflow via e-
mail and portable storage devices, theft and loss), and illegal use of destructed
document(undestruction after using document, illegal outflow of document by
restoring deleted document)
Fig. 4. Patterns of inadequacy of access control for document
A Exploratory Study on R&D Strategies in Industrial Technology Security 55
The patterns of the vulnerability of database are classified as indiscreet ac-
cess to database(read or outflow unrelated data file, abusing access authority) of
server administrator(or usual user), outflow of data file peculating access author-
ity), outflow of data file by peculating access authority of database(outflow of
data file by peculating id and password of user or administrator), and information
damage caused by the malicious penetration from outside of the organization to
server or database.
Fig. 5. Patterns of vulnerability of database
Lastly, the patterns of the vulnerability of network are classified as packet
sniffing, penetration utilizing the vulnerability of network equipment, and net-
work pulse sniffing.
Fig. 6. Patterns of vulnerability of network
Generally, there exist the technical measures for preventing outflow of in-
formation which are classified as cut off or restriction of access to information,
56 Hangbae Chang et al.
encryption of data or files blocking the access made by unauthorized users, block-
ing file transmission or restriction to the channel of outflow, destruction of device
where data or file is stored, and monitoring log in which the outflow of the data
or file leaves traces. Based on vulnerability analysis about identified information
asset, we executed Delphi method with professional group related to literature
review and relevant field workers(3 university professor, 3 professionals working
for security corporation), then we distinguished security objective from security
technology and designed them as table 1. The Delphi method is that we collected
opinions of professional group via survey and surveyed statistical analysis result
from professional group again then repeat the collection of opinion and aggre-
gate. This method provides a chance to modify each professionals opinion and
it is positive of a chance to utilize others opinion. Currently more than 90% of
technology foresight field use Delphi method and it is settled down as universal
method. It has another advantage that it help get reliable assessment result via
professional groups participation.
A mail and messenger securities that are to prevent a industrial technology
leakage encrypt contents of e-mail and messenger via internet also filter them
in observance of rules. A portable storage device security is that it implements
authority control on portable storage devices(USB, mobile phone, memory card,
etc) which can be connected with personal computer.
Table 1. Industrial Security Framework
A document security aiming at controlling an approach to industrial tech-
nology block an attempt to access made by unauthorized or illegal person based
on encryption of the existing file. The document security also applies security
regulation to the all procedures which are made from a generation of the docu-
ment to disposal of the document including distribution of them. And it makes
it possible to grasp a channel of the important documents outflow so that it can
prevent unauthorized outflow or thief of confidential documents and product
A Exploratory Study on R&D Strategies in Industrial Technology Security 57
blueprint. Database security technology consists of database activity monitoring
and blocking technology. Both of technologies function as a means of protection
which guards stored data in the database from unauthorized access, intentional
modification and elimination of data, and contingency obstructing datas consis-
tency. Database encryption technology not only encrypts data but also stores
them. And when it is necessary, it restore the encrypted data and reads or mod-
ifies them then encrypts them again. Network access control technology protects
internal network and user terminal through certain procedures that execute an
isolation, cure, and permitting an access regarding terminal unmatched with
security policy after inspecting a status of terminal from a stage of network
access.
Consequently, contents monitoring and filtering technologies observe the dis-
tribution of industrial technology founded on a business regulation related to cer-
tain application programs. This technology also detects an inappropriate transfer
of the sensible information in network.
4 Analysis of the Current Status and Limitation of
Industrial Security Technology
As a result of in-depth interview research, a technology of portable storage device
security is developed when various portable storage devices (secure digital card,
compact flash card, memory stick, etc.) appear and new means of communication
are developed. Yet there appear a problem caused by collision with controlling
existing devices in interoperability.
Document security technology has restriction on program source file and a
blueprint due to the big size of file, interoperability between various kinds of
form of file and applications, and the needs for multi-level collaboration. And
there is lack of steady state of security technology development (currently it is
not possible to collect and integrate the usage history of files or the usage history
of read and write. It is also impossible to control downloads and authority to
use after download).
Database activity monitoring and blocking technology cannot control an ac-
cess made by each user unit but can control an access made by application unit
because database security technology cannot recognize which client access the
database in case of access conducted through application server. When database
encryption technology encrypts database, it encrypts index at the same time so
that the speed of data search become slower. Also it takes long time to encrypt
or decrypt large amount of data table. Unfortunately, this disadvantage may
cause service halt.
Network access control technology blocks an ill-intentioned program or at-
tempt that both of them are executed by computer users qualified for proper
security level according to organizations regulation. It has emerged to develop
an integrated security technology which can manage change in security policy
or health condition of computer.
58 Hangbae Chang et al.
Currently, contents monitoring and filtering technology for ordinary corpo-
ration and public office occupy 1GB of server for 1 hour-long log of operation
history and after 1 month the operation history would produce approximately
300 500GB of log. That makes it difficult to trace log after all.
5 Establishing a Strategy for Industrial Security
Technology Development
As previously explained, many security technologies are being developed with
various perspectives to protect industrial technology. But there is much work
related to managing technologies aimed at controlling outflow and those tech-
nologies only provide protection to arranged file format. Also technologies for
monitoring have a potential to commit a detection error and cannot provide
real-time interception. Inconsequence, future industrial security technology is
needed to be developed as policy-oriented based on organizations business pro-
cess. Accordingly in this study, we deduced further technology development task
as followings with professional group by Delphi method.
First, control system for different types of portable storage device conduct
access control regardless of producer or operational environment and when do-
ing data transferring to external, it still maintains access control on data from
a remote computer. In detail, this control system consists of advancement of
portable storage device and channel control technology, external transmission
security file which supports confidentiality, integrity, and tenacity. The external
transmission security file conducts encryption of document and convey decryp-
tion key to external authorized user so that user who receives security file can
read relevant document without installing a certain program into terminal. The
mere execution of security file let user read document under permissible range.
Industrial technology document integrated security system fulfills security
and compatibility among technologies which process security related to electronic
document. And it guards program source file and blueprint that possess unique
feature for business process. Considering relevant work environment, security
technology of program source file and blueprint should solve following security
needs.
Particularly, collaboration possible industrial technology electronic document
security technology should conduct an access control for user and application
program at the same time. It also needs to develop integrated electronic security
technology, being linked with the existing office document security technology.
The current compatibility and expansion possible document security integrated
technology cannot provide interoperability, when a document transmission oc-
curs between two different organizations. So this technology prevents a doc-
ument transmission in which security technology is not applied. Accordingly,
API(Application Program Interface) which can control information leakage made
from document distribution in the organizations should be developed.
The high-performance database security system solves vulnerability that a
detour of database access through web application has and minimizes user pro-
A Exploratory Study on R&D Strategies in Industrial Technology Security 59
Fig. 7. Improved e Document Security
cess delay which occurs during encryption of database field. In detail, access de-
tection and prevention technology controls non standard SQL inquiry form web
application. When the trouble appears in the database security server provid-
ing connection -oriented network service, this technology guarantees accessibility
allowing the application sever to access database directly.
The fast encryption(decryption) of database and search technology use en-
crypted index and safe key management which supports the encryption(decryption)
of database field. It also provides an index search via index at the same time.
Fig. 8. Improved Database Security
Eventually, role-oriented network end point security system solves an incom-
patibility with remote access computer and guarantees interoperability among
network access control technologies. It also supports network access control
which embodies flexible industry standard infra protection and include user
group and environment.
60 Hangbae Chang et al.
6 Exploratory Study Result regarding Industrial Security
Technology
To enhance the international competitiveness by protecting up-to-date industrial
technology, we have to analyze the current level of domestic industrial security
technology and technical competitiveness[7]. Furthermore it is vital to establish
the policy for improving the competitiveness of domestic industrial by devise a
policy to support development task. In this study, we analyzed the all-pervading
trend and present status of industrial security technology. Then, we conducted
the deduction of national development task and analyzed current level of domes-
tic industrial security technology for prevention of industrial technology leakage
and improvement of technology.
In detail, we analyzed the status of industrial technology leakage, and grasped
the main subject of leakage, channel, and method. We then designed industrial
security framework with identification of industrial technology asset, research of
literature, and visiting provider and demander of industrial security technology
On the next stage, we applied Delphi Method to the professional group and
deduced the segmented development task. As a result, we designed the control
system for different types of portable storage devices, integrated security system
for industrial technology documents, high-performance database security system,
and role-oriented network end point access control system.
The result of this study may be utilized to enhance an international compet-
itive power and devise the policy for industrial security technology development
ability as basic contents. Industrial security framework based on researches and
practitioners is also anticipated to provide an approach method regarding indus-
trial technology leakage prevention, detection and countermeasure. Hereafter,
it is needed to develop information security management system for industrial
security specialized in industrial technology protection which can carry out inte-
grated management. There also exists necessity for further research concerning
physical and managerial security system for industrial technology protection.
References
1. ISO/IEC: ISO/IEC TR 13335-4: 2000(E).: Information Technology - Guidelines
for the Management of IT Security Part 4. (2000)
2. XiSEC/AEXIS Consultants.: BS7799 Information Security SME Guide.
XiSEC/AEXIS Consultants. (2002)
3. Forte, Dario.: Information Security Assessment: Procedures and Methodology.
Computer Fraud & Security. (2000)
4. Gartner.: Hype Cycle for Governance, Risk and Compliance Technologies. (2008)
5. Gartner.: Understanding Data Leakage. (2007)
6. Hone, Karin and Eloff, JHP.: What makes an effective information security policy?.
Network security. (2002)
7. Jan Eloff, Mariki Eloff.: Information Security Management - A New Paradigm.
Proceedings of SAICSIT, (2003)
A Exploratory Study on R&D Strategies in Industrial Technology Security 61
8. M.M.Eloff, S.H. von Solms.: Information Security Management: An Approach to
combine Process Certification And Product Evaluation. Computers & Security.
(2000)
9. Dodson Rob.: Information Incident Management. Information Security Technical
Report. (2001)
10. Weill, P. and M.: What IT Infrastructure Capabilities are needed to Implement
e-Business Models?. Vitale MIS Quarterly Executive. (2002)