KR102439818B1 - Apparatus and method for managing evaluation criteria based on financial compliance - Google Patents

Abstract

An apparatus for managing evaluation criteria based on financial compliance according to the present invention comprises: a registration management unit that registers evaluation criteria for security vulnerabilities for electronic financial infrastructure of financial institutions and financial IT regulations in an evaluation criteria DB; and evaluation in the evaluation criteria DB A change item search unit that can search for financial IT regulations and changes related to each evaluation item based on the criteria table, financial IT regulation table, evaluation items and financial IT regulation cross-reference table, and When a change in compliance is requested, a compliance change unit may include a compliance change unit for performing a change on the corresponding compliance and reflecting the performance result in the evaluation standard DB.

Description

Apparatus and method for managing evaluation criteria based on financial compliance

The present invention relates to a technique for managing the evaluation criteria of financial compliance related to security vulnerabilities in the financial field, and more particularly, to a finance necessary for analysis (checking) of security vulnerabilities of electronic financial infrastructure specialized for electronic financial services. It relates to an evaluation standard management apparatus and method based on financial compliance that can implement compliance management as a system and algorithm.

With the development and spread of information and communication technology, the security vulnerabilities of electronic financial infrastructure in the financial field using information and communication facilities are checked and analyzed, and electronic financial infrastructure is inspected from internal and external attacks based on the analysis result. It is essential to protect the target assets (eg servers, network equipment, etc.).

In the related art, there is a method of automatically analyzing a security vulnerability of a server according to a determined time schedule. As a related patent document, there is Korean Patent Application Laid-Open No. 2009-0038683 (hereinafter referred to as a prior patent).

In the prior patent, the vulnerability search database stored in advance is called according to the schedule and execution commands, the possibility of the existence of vulnerabilities in the management web server is searched according to the vulnerability data included in the called search database, and vulnerability information is derived by optimizing the search results. Then, based on the derived results, a technique for checking the vulnerabilities of the management web server is disclosed.

At this time, in order to check the security vulnerability of the IT system, analysis of various check items is required, and the server vulnerability check items are different for each operating system including the standards of electronic financial infrastructure and major information and communication infrastructure, for example, a Unix-based operating system. Since there are hundreds of separate check items for Windows and Windows operating systems, there is a problem of wasting computing resources and human resources when checking what should not be checked or when a professional manpower rechecks a false positive for the result. have.

Korea Patent Publication No. 2009-0038683 (published date: 2009. 04. 21.)

The present invention is to provide a financial compliance-based evaluation standard management device and method that can implement financial compliance management necessary for analysis (check) of security vulnerabilities of electronic financial infrastructure specialized for electronic financial services with a system and algorithm. do.

The problem to be solved by the present invention is not limited to the above-mentioned, and another problem to be solved that is not mentioned can be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description. will be.

According to one aspect, the present invention provides a registration management unit for registering evaluation criteria for security vulnerabilities and financial IT regulations for electronic financial infrastructure of financial-related institutions in an evaluation criterion DB, an evaluation criterion table in the evaluation criterion DB, and financial IT A change item search unit that can search for financial IT regulations and changes related to each evaluation item based on the regulatory table, evaluation items and financial IT regulatory cross-reference tables, and a change in evaluation criteria and compliance with financial IT regulations are requested If necessary, it is possible to provide an evaluation criteria management apparatus based on financial compliance that includes a compliance change unit that performs a change on the corresponding compliance and registers the performance result in the evaluation criteria DB.

The evaluation criteria of the security vulnerability of the present invention may include at least one or more of an information protection management system, a server, a database, a network infrastructure, a network device, an information protection system device, and a web/mobile/HTS application.

The financial IT regulation of the present invention may include at least one of the Electronic Financial Transactions Act, the Electronic Financial Transactions Act Enforcement Decree, the Electronic Financial Supervision Regulations, and the Electronic Financial Supervision Regulation Enforcement Rules.

The change of the corresponding compliance of the present invention may include at least one or more of addition, deletion, and correction of the corresponding compliance.

According to another aspect, according to another aspect, the present invention includes the steps of registering evaluation criteria for security vulnerabilities and financial IT regulations for electronic financial infrastructure of financial-related institutions in an evaluation criteria DB, an evaluation criteria table in the evaluation criteria DB, and financial IT regulations Based on the table, evaluation item and financial IT regulation cross-reference table, the step of retrieving financial IT regulations and changes related to each evaluation item, and checking whether changes in evaluation criteria and specific compliance with financial IT regulations are requested and when a change in the specific compliance is requested, performing a change to the specific compliance, and reflecting the performance result of the change in the evaluation criteria DB. Evaluation criteria management method based on financial compliance can provide

According to an embodiment of the present invention, the financial IT environment (financial IT regulation and technology ) can provide a compliance management function that can respond quickly and efficiently to changes in

1 is a block diagram of an apparatus for managing evaluation criteria based on financial compliance according to an embodiment of the present invention.
2 is a flowchart illustrating a main process of managing evaluation criteria based on financial compliance according to an embodiment of the present invention.
3 is an exemplary diagram of a user interface (UI) for an evaluation standard form.
4A and 4B are exemplary diagrams of a financial compliance configuration (cross-referenced).
5 is an exemplary diagram of a user-defined function for financial compliance.

First, the advantages and features of the present invention, and a method for achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. Here, the present invention is not limited to the embodiments disclosed below, but may be implemented in a variety of different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and are commonly used in the technical field to which the present invention pertains. Since it is provided by way of example so that those with knowledge of the present invention can clearly understand the scope of the invention, the technical scope of the present invention should be defined by the claims.

In addition, in the following description of the present invention, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary depending on the intention or custom of a user, an operator, etc., of course. Therefore, the definition should be made based on the technical idea described throughout the description of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

As is known, the information and communication infrastructure of non-financial companies can evaluate and manage security vulnerabilities using standards and certifications such as, for example, major information and communication infrastructure vulnerability evaluation standards, ISO-27001 (ISMS), and PIMS.

In addition, financial IT regulations (e.g., Electronic Financial Transactions Act, Electronic Financial Transactions Act Enforcement Decree, Electronic Financial Supervision Regulations, Electronic Finance Supervisory regulation enforcement regulations, etc.) can be registered, modified, etc., and the present invention relates to a system and algorithm for managing IT security compliance specialized in the financial sector of Korea.

1 is a block diagram of an apparatus for managing evaluation criteria based on financial compliance according to an embodiment of the present invention. .

The financial compliance management module 110 may include a registration management unit 112 , a change item search unit 114 , and a compliance change unit 116 .

The evaluation criterion DB 120 includes an evaluation criterion table 122 , a financial IT regulation table 124 , an evaluation item and a financial IT regulation cross-reference table 126 , and the like.

Referring to Figure 1, the registration management unit 112 in the financial compliance management module 110, for example, according to a user interface using a standard form such as Excel (MS-EXCEL), as an example, including evaluation item ID, item name, etc. Functions such as generating evaluation criteria (evaluation criteria for security vulnerabilities for electronic financial infrastructure of financial-related institutions (eg, Financial Security Agency)) and registering in evaluation criteria table 122 in evaluation criteria DB 120 can provide

The evaluation criteria for security vulnerabilities may include, for example, at least one or more of information protection management system, server, database, network infrastructure, network equipment, information protection system equipment, web/mobile/HTS application, and hundreds to thousands of evaluation items (eg, 720 evaluation items).

In addition, the registration management unit 112, for example, according to a user interface using a standard form such as Excel, including, as an example, the Electronic Financial Transactions Act of the Republic of Korea, the Electronic Financial Transactions Act Enforcement Ordinance, Electronic Financial Supervision Regulations, Electronic Financial Supervision Regulation Enforcement Rules, etc. It is possible to provide a function such as creating a financial IT regulation and registering it in the financial IT regulation table 124 in the evaluation criteria DB 120 .

As an example, as shown in FIG. 3 , the evaluation criteria table 122 and the financial IT regulation table 124 in the evaluation criteria DB 120 through a user interface (UI) for a standard form of evaluation criteria (eg, Excel, etc.) ), you can register and manage data such as evaluation criteria for security vulnerabilities and financial IT regulations.

Here, the evaluation criteria registered in the evaluation criteria table 122 may include, as an example, information as shown in Table 1 below.

Evaluation Criteria Table Evaluation item ID
Item name FISM-063
Whether the person in charge of computerized data is designated Evaluation item ID
Item name FISM-075
Whether device sharing is prohibited Evaluation item ID
Item name FISM-138
Whether to designate a password program contact

Financial IT regulations registered in the financial IT regulation table 124 may include, as an example, information as shown in Table 2 below.

Financial IT Regulatory Table Regulatory name
article
The details Electronic Financial Transactions Act
Article 21
Obligation to secure stability Regulatory name
article
The details Enforcement Decree of the Electronic Financial Transactions Act
Article 11-2
Financial companies targeted for information technology planning

The change item search unit 114 may be implemented according to a user interface to allow cross-reference between evaluation criteria and financial IT regulations, and is related to each evaluation item based on the evaluation item and financial IT regulatory cross-reference table 126 . It can provide functions such as financial IT regulatory search and change search (confirmation search).

To this end, the evaluation item and financial IT regulation cross-reference table 126 may include information as shown in Table 3 below as an example.

Table of Valuation Items and Financial IT Regulations Cross-Reference Evaluation item ID FISM-063 FISM-075 FISM-138 Electronic Financial Transactions Act Article 21 Article 21 Article 21 Enforcement Decree of the Electronic Financial Transactions Act Article 11-2 Article 11-2 Article 11-2

That is, according to the present invention, each evaluation item of the evaluation criteria and the table of financial IT regulations are mapped to each other, so that when a financial IT regulation corresponding to a specific item of the evaluation criteria is inquired, an automatic search may be possible.

In addition, through the above-described search function, it is also possible to search (confirm) the changed part for each evaluation item when revising financial IT regulations and evaluation standards.

4A and 4B are exemplary diagrams of a financial compliance configuration (cross-referenced).

Referring to FIGS. 4A and 4B shown as an example, in a situation where evaluation items and laws are mapped, if Article 21-2 of the Electronic Financial Transactions Act is changed as an example, related items (eg, FISM-010, etc.) are automatically searched Therefore, it is possible to easily search for possible changes (eg, detailed description of evaluation items, inspection methods, judgment standards, etc.) that may occur due to changes in laws and regulations.

The compliance change unit 116, according to the user interface, when a change in compliance with respect to evaluation standards and financial IT regulations is requested, performs addition, deletion, and correction of the corresponding compliance, and evaluates the performance result (change result) It is possible to provide a function such as reflecting (registration of change) in the reference DB 120 .

5 is an exemplary diagram of a user-defined function for financial compliance.

Referring to FIG. 5 , for example, only the changed part (eg, addition, correction, deletion of laws, etc.) through a standard form such as Excel can be modified and uploaded, and the upload result (change result) is the evaluation standard DB 120 ) is registered (reflected).

2 is a flowchart illustrating a main process of managing evaluation criteria based on financial compliance according to an embodiment of the present invention.

Referring to FIG. 2 , in the registration management unit 112 , evaluation criteria including, for example, evaluation item ID, item name, etc. (evaluation criteria for security vulnerabilities in electronic financial infrastructure of financial-related institutions (eg, Financial Security Agency, etc.)) is generated and registered in the evaluation criteria table 122 in the evaluation criteria DB 120 .

The evaluation criteria of the security vulnerability may include, for example, at least one of an information protection management system, a server, a database, a network infrastructure, a network device, an information protection system device, and a web/mobile/HTS application.

In addition, the registration management unit 112 creates financial IT regulations including, for example, the Electronic Financial Transactions Act of the Republic of Korea, the Electronic Financial Transactions Act Enforcement Decree, the Electronic Financial Supervision Regulations, the Electronic Financial Supervision Regulations Enforcement Rules, etc. It is registered in the regulation table 124 (step 202).

Here, the registration of evaluation criteria and financial IT regulations may be performed, for example, through a user interface using a standard form such as Excel, respectively.

The change item search unit 114 searches for (confirmation search) financial IT regulations and changes related to each evaluation item based on the evaluation item and financial IT regulation cross-reference table 126 (step 204). The search result here can be visually displayed through a monitor (not shown) of the management device (management system).

In the present invention, each evaluation item of the evaluation criteria and the table of financial IT regulations are mapped to each other, so if you inquire the financial IT regulation corresponding to a specific item of the evaluation criteria, it can be automatically searched, and also through the above-mentioned search function When revising financial IT regulations and evaluation standards, it is possible to search (check) the changed parts for each evaluation item.

In the compliance change unit 116, when a change in compliance with respect to evaluation criteria and financial IT regulations is requested according to the user interface (step 206), addition, deletion, and correction of the corresponding compliance are performed (step 208).

Thereafter, when the compliance change is completed, the compliance change unit 116 reflects (changes registration) the result of the compliance change in the evaluation standard DB 120 (step 210).

Meanwhile, combinations of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment, such that the instructions executed by the processor of the computer or other programmable data processing equipment correspond to each block in the block diagram or in the flowchart. Each step creates a means for performing the described functions.

These computer program instructions may also be stored in a computer-usable or computer-readable memory, etc., which may be directed to a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer-usable or computer-readable memory. The instructions stored in the block diagram may produce an article of manufacture containing instruction means for performing the functions described in each block in the block diagram or in each step in the flowchart.

And, since the computer program instructions may be mounted on a computer or other programmable data processing equipment, a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other program It is also possible that instructions for performing the possible data processing equipment provide steps for carrying out the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or each step may represent a module, segment, or part of code including at least one or more executable instructions for executing specified logical function(s). It should also be noted that in some alternative embodiments it is also possible for the functions recited in blocks or steps to occur out of order. For example, it is possible that two blocks or steps shown one after another may in fact be performed substantially simultaneously, or that the blocks or steps may sometimes be performed in the reverse order according to the corresponding function.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains may make various substitutions, modifications, and changes within the scope not departing from the essential characteristics of the present invention. It will be easy to see that this is possible. That is, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments.

Therefore, the protection scope of the present invention should be interpreted by the claims described below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

110: financial compliance management module
112: registration management department
114: change item search unit
116: compliance change department
120: evaluation criteria db
122: evaluation criteria table
124: Financial IT Regulatory Table
126: Table of Valuation Items and Financial IT Regulations Cross-Reference

Claims (4)

delete A registration management unit that registers the evaluation criteria for security vulnerabilities and financial IT regulations of financial institutions' electronic financial infrastructure in the evaluation criteria DB;
a change item search unit capable of searching for financial IT regulations and changes related to each evaluation item based on the evaluation criteria table, the financial IT regulation table, the evaluation items and the financial IT regulation cross-reference table in the evaluation criteria DB;
When a change in compliance with evaluation standards and financial IT regulations is requested, a compliance change unit that changes the corresponding compliance and reflects the performance result in the evaluation standard DB,
The evaluation criteria of the security vulnerability are,
Information security management system, server, database, network infrastructure, network equipment, information security system equipment, including at least one of web / mobile / HTS application
Evaluation criteria management device based on financial compliance. 3. The method of claim 2,
The financial IT regulation is,
Electronic Financial Transactions Act, Electronic Financial Transactions Act Enforcement Decree, Electronic Financial Supervision Regulations, Electronic Financial Supervision Regulations Enforcement Rules
Evaluation criteria management device based on financial compliance. 3. The method of claim 2,
Changes in the above compliance are:
Including at least one or more of addition, deletion, and modification of the corresponding compliance
Evaluation criteria management device based on financial compliance.

Images