A framework to improve the compliance guideline for critical ICT infrastructure security

Abstract

The security of critical ICT infrastructure is very important because it is directly related to the safety and lives of the people, and a successful cyber-attack can cause catastrophic damage. According to Korean laws, all critical ICT infrastructures are required to confirm the implementation of infrastructure security measures at least once a year. However, the guideline for checking the implementation of infrastructure security measures has problems such as not being suitable for infrastructures that use special systems. This study aims to identify the problems in the structure, check items, and scoring of the guideline, and seek solutions through defining principles and interviewing with infrastructure operators and security experts. The results of this study can be used to efficiently conduct security vulnerability checks and implementation checks of critical ICT infrastructure, and the improved guideline is expected to contribute to the improvement of security levels.