보안강화를 위한 보안솔루션 및 보안스위치 연동에 대한 설계 및 구현

Abstract

오늘날 기업환경에서 네트워크 사용은 없어서 안 되는 중요한 자리를 차지하고 있다. 이러한 네트워크는 개방형 인터넷과 연결되어 악의적인 목적으로 정보를 취득하거나 시스템을 파괴시키고, 또는 서비스를 하지 못하게 한다. 기업 또는 기관에서는 네트워크 환경의 취약한 보안을 강화하기 위해 방화벽(Firewall), 침입탐지(Intrusion Detection System), 보안스위치 (Security Switch) 등을 도입해 안전한 네트워크 환경을 구축하고 있다. 하지만 이러한 노력에도 지능화 되는 APT(Advanced Persistent Threat)나 백신프로그램을 무력화 시키는 악성코드로 2009년 7.7, 2013년 3.20 전산대란 같은 사건이 발생하였다. 다양한 강력한 보안솔루션과 보안스위치의 물리적인 네트워크 차단기능을 이용하여 탐지된 위협요소를 가진 Host를 차단하여 2차 감염이나 공격에서 보호할 수 있도록 위험 탐지 선 차단, 후 조치를 통해 보안을 강화할 수 있다. 본 논문에서는 네트워크 보안을 위해서 기업 또는 기관에서 각각 운영 중이던 탐지 보안솔루션과 보안스위치를 연동하여 탐지된 보안위협 호스트를 차단함으로써 악의적인 목적으로 2차 공격 및 감염을 최소화 하는 시스템을 설계 및 구현을 하고 테스트 평가를 통해 결론을 내린다.|Design and Implementation to interwork with Security Solution and Security Switch for Security Enhancement Kim, Sang hyun Major in Computer Science and Engineering The Graduate School of Engineering Hanyang University A network infrastructure has a key role of enterprise environments today. Regardless of sharing information as a right usage in the network, it would be happened to disrupt user environments, destroy systems, and extort private information frequently. Many companies adopt various preventing solutions for secured network environments, such as a firewall, Intrusion Detection System, and a security Switch. It has happened frequently to intrude their network by APT (Advanced Persistent Threat), virus, and Mal-ware, like cyber terrors on Mar 20 2013 and July 7 2009 even though making an effort to keep their network. Interworking with powerful security solutions and a physical network block in a security switch provides you to cut detected threats off and follow up disposition. The interworking skills developed in this thesis provide you to secured network service by accurate and comprehensive monitoring and controlling, like reducing serious damages and blocking the second attack from a broad range of APT in the enterprise network.; Design and Implementation to interwork with Security Solution and Security Switch for Security Enhancement Kim, Sang hyun Major in Computer Science and Engineering The Graduate School of Engineering Hanyang University A network infrastructure has a key role of enterprise environments today. Regardless of sharing information as a right usage in the network, it would be happened to disrupt user environments, destroy systems, and extort private information frequently. Many companies adopt various preventing solutions for secured network environments, such as a firewall, Intrusion Detection System, and a security Switch. It has happened frequently to intrude their network by APT (Advanced Persistent Threat), virus, and Mal-ware, like cyber terrors on Mar 20 2013 and July 7 2009 even though making an effort to keep their network. Interworking with powerful security solutions and a physical network block in a security switch provides you to cut detected threats off and follow up disposition. The interworking skills developed in this thesis provide you to secured network service by accurate and comprehensive monitoring and controlling, like reducing serious damages and blocking the second attack from a broad range of APT in the enterprise network.