A Study on the Improvement of Cybersecurity Exercise Policy for the Nuclear Facilities

㤦

㤦㧦⩻㔲㍺

㌂㧊⻚㌂Ị ╖㦧䤞⩾ 㩫㺛 Ṳ㍶㦚 㥚䞲

′㩲⹿㞞

㡆

㡆ῂ

G

A Study on the Improvement of Cybersecurity Exercise

Policy for the Nuclear Facilities

Jinho Ryu*

*Cyber Security Division, Korea Institute of Nuclear Nonproliferation and Control 殚 檃檃 㩫⽊㻮Ⰲ₆㑶㧊 ⹲╂䞾㠦 ➆⧒ 㤦㧦⩻㔲㍺㠦 ╖䞲 ㌂㧊⻚䂾䟊 Ṗ⓻㎇㧊 Ṟ㑮⪳ ⏨㞚㰖ἶ 㧞┺. ⹿㌂⓻⹿㨂⻫ ⹥ ὖ⩾ ⻫⪏㠦 㦮Ệ䞮㡂 ῃ⌊ 㤦㧦⩻㔲㍺㦖 ṗ 㔲㍺ ⼚ ㌂㧊⻚㌂Ị ゚㌗╖㦧 㩞㹾⯒ 㑮Ⱃ䞮ἶ 㩞㹾㦮 㥶䣾㎇ ⹥ ゚㌗╖㦧㫆㰗㦮 ╖㦧㡃⨟㦚 㩲ἶ䞮₆ 㥚䞲 ⳿㩗㦮 㭒₆㩗㧎 ㌂㧊⻚㌂Ị ╖㦧䤞⩾㦚 㔺㔲䞮ἶ 㧞㦒Ⳇ, ′㩲₆ὖ㦮 ☛Ⱃ㩗㧎 䤞⩾䘟Ṗ ἆὒ⯒ 䐋䟊 Ⱔ㦖 Ṳ㍶㌂䟃㧊 ☚㿲♮ ἶ 㧞┺. ⽎ ⏒ⶎ㠦㍲⓪ 䡚䟟 㤦㧦⩻㔲㍺㦮 ㌂㧊⻚㌂Ị ╖㦧䤞⩾ 㼊Ἒ⯒ ⿚㍳䞮㡂 ㌂㧊⻚㌂Ị╖㦧 䤞⩾ 㩫㺛㦮 Ṳ⎦㠦 ╖䟊, ῃ⌊ȡ㣎 ₆㭖㠦 ➆⯎ ㌂㧊⻚㌂Ị ╖㦧䤞⩾ 㩫㺛㦮 㣪㏢⯒ 㔳⼚䞮㡂 㧊⯒ Ṳ㍶䞮₆ 㥚䞲 ῂ㼊㩗㧎 ′㩲⹿㞞㦚 㩲㔲䞲┺. 1. 昢嵦 㩚 ㎎Ἒ㩗㧎 㩫⽊㻮Ⰲ₆㑶㦮 ⹲╂㦖 ㌆㠛㩲㠊㔲㓺 䎲㦚 䢲㣿䞮⓪ 㤦㧦⩻㔲㍺ Ἒ䁷 ⹥ 㩲㠊⿚㟒㠦 ╖䟊 ❪㰖䎎䢪♲ ₆₆✺㦮 ☚㧛✺㦚 㽟⹲䞮Ⳇ Ⱔ㦖 ⼖䢪⯒ Ṗ㪎㢪┺. 㧊⩂䞲 ⼖䢪Ṗ 㩗㔲㎇, 䣾㥾㎇㦚 㯳╖㔲䋾 ⹮Ⳋ, ㌂㧊⻚⽊㞞㦮 ὖ㩦㠦㍲⓪ ⡦ ┺⯎ ╖㺛㧊 㣪ῂ ♮㠞┺. 2015 ⎚ 㤦㧦⩻㔲㍺ ❇㦮 ⹿䢎 ⹥ ⹿㌂⓻ ⹿㨂 ╖㺛⻫㦮 Ṳ㩫㦒⪲ 㤦㧦⩻㔲㍺㠦 ╖䞲 㩚㧦㩗䂾䟊䟟 㥚㠦 ╖䞲 ╖㺛㧊 㑮Ⱃ♮☚⪳ ⻫⪏㼊ἚṖ 㩫゚♮㠞┺. 2016 ⎚ 䞲ῃ㤦㧦⩻䐋㩲₆㑶㤦㠦㍲ ⹲䟟䞲 㤦㧦⩻ 㔲㍺㦮 䅊䜾䎆 ⹥ 㩫⽊㔲㓺䎲 ⽊㞞 㕂ȡỖ㌂ ₆㭖㍲[1] ⓪ ṗ 㤦㧦⩻㔲㍺⼚ ㌂㧊⻚⽊㞞㫆䂮 㧊䟟㦮 ₆㭖㧊 ♮⓪ “㩫⽊㔲㓺䎲 ⽊㞞′㩫 (Cyber Security Plan, CSP)” 㦮 㰖䂾㦚 㩲㔲䞮Ⳇ, 㧊㠦 ➆⧒ 䟊╏ Ἒ䣣㦮 ┾Ἒ⼚ 㧊䟟㠦 ╖䞲 䔏⼚Ỗ㌂Ṗ 2019 ⎚ 㢚⬢♲ ⹪ 㧞┺. 㞚㤎⩂ 㤦㧦⩻㔲㍺㠦 ⹲㌳䞶 㑮 㧞⓪ ㌂㧊⻚㌂Ị㠦 ╖䞲 ╖㦧㼊Ἒ⯒ 㔲䠮䞮ἶ ╖㦧㡃⨟㦚 㩲ἶ䞮₆ 㥚䞲 ㌂㧊⻚㌂Ị ╖㦧䤞⩾(㧊䞮, ㌂㧊⻚⽊㞞 䤞⩾)㧊 ὖ⩾ ⻫⪏㠦 ⁒Ệ䞮㡂 2016 ⎚⿖䎆 㔺㔲♮ἶ 㧞┺. ⁎⩂⋮ ㌂㧊⻚⽊㞞 䞚㑮❪㰖䎎㧦㌆ 㔳⼚, 䦊╖㣿 㩖㧻ⰺ㼊 䐋㩲, 㕂䂋⹿䢎 㩗㣿 ❇ 㭒㣪 ⽊㞞㫆䂮✺㧊 㞴㍲ 㠎  䞲 CSP 㠦 ➆⧒ 㧊䟟♮ἶ 㧞⓪ ộὒ⓪ ╂Ⰲ ㌂㧊⻚ ⽊㞞 䤞⩾㦖 㭒⪲ ὖ⩾ ⻫⪏ ⹥ ἶ㔲㠦 ⁒Ệ䞮㡂 㑮 䟟♮ἶ 㧞┺. 㧊㠦 ➆⧒ 㤦㧦⩻㔲㍺ ㌂㧊⻚⽊㞞 㧊䟟 㦮 ₆㭖㧊 ♮⓪ CSP 㢖 ㌂㧊⻚⽊㞞 䤞⩾ὒ㦮 ὖἚ㎇ 㧊 ⳾䢎䞮ἶ, ㌂㧊⻚⽊㞞 䤞⩾㦮 ⌊㣿㧊 KINAC/RS-015 㠦 ➆⯎ 䤞⩾ 㰖䂾㦮 ⌊㣿㦚 㩗㩞䧞 ⹮㡗♶ 㑮 㠜 ⓪ ῂ㫆⪲ ㌳ṗ♮ἶ 㧞┺. 㧊㠦 ⽎ ⏒ⶎ㠦㍲⓪, 㤦㧦⩻㔲㍺ ㌂㧊⻚⽊㞞 䤞⩾ 㦮 㑮㭖㦚 㩲ἶ䞮₆ 㥚䟊㍲ CSP 㑮㭖㦮 㩫㺛㧊 Ṳ⹲ ♶ 䞚㣪Ṗ 㧞㦢㦚 ὖ⩾ ⶎ䠢㫆㌂⯒ 䐋䟊 ✍⹱䂾䞮ἶ, 㧊㠦 ╖䞲 ῂ㼊㩗㧎 ⹿㞞㠦 ╖䟊 ⏒㦮䞮ἶ㧦 䞲┺. 2. 毖沖崫柢昪 斲決憊懺橎 篎崮 勢洢熺凊 笊筯 ☯⻫ 㩲 9 㫆㦮 3(ⶒⰂ㩗⹿䢎 䤞⩾) ⹥ 㤦㧦⩻㞞㩚㥚 㤦䣢 ἶ㔲 㩲 2017-1 䢎㠦 ➆⧒ 㤦㧦⩻㔲㍺㦖 ⶒⰂ㩗⹿ 䢎 䤞⩾㦮 㧒䢮㦒⪲ ㌂㧊⻚⽊㞞 䤞⩾㦚 㔺㔲䞮☚⪳ 㣪ῂ⹱ἶ 㧞㦒Ⳇ, 㧊㠦 ➆⧒ ῃ⌊ 㤦㧦⩻㔲㍺㦖 2016 ⎚⿖䎆 䡚㨂₢㰖 ṗ 㔲㍺⼚⪲ 㡆 3 䣢(㩚㼊䤞⩾ 1 䣢/ ⿖⿚䤞⩾ 2 䣢)㦮 䤞⩾㦚 㑮䟟䞮ἶ 㧞┺. ṗ 㤦㧦⩻㔲 ㍺㦖 䤞⩾㦚 㔺㔲䞮₆ 㥚䟊 㡆Ṛ䤞⩾Ἒ䣣 ⹥ 䤞⩾ ㎎ ⿖Ἒ䣣㦚 㑮Ⱃ䞮㡂 㤦㧦⩻㞞㩚㥚㤦䣢㦮 㔏㧎㦚 ⹱㦖 ⛺ 㔺㔲䞮㡂㟒 䞲┺. ὖ⩾ ⻫⪏Ṛ㦮 ㌗ὖὖἚ⯒ ☚㔳 䢪䞮Ⳋ 㞚⧮ ⁎Ⱂὒ ṯ┺.

302

ڃ⁎Ⱂٻڌڄٻ⹿㌂⓻⹿㨂⻫㠦ٻ➆⯎ٻ㌂㧊⻚⽊㞞ٻ䤞⩾ٻὖ⩾ٻ⻫⪏ٻ 3. 毖毖沖崫柢昪 斲決憊懺橎 篎崮 洛煋 笊筯 ڎډڌ 㤦㧦⩻㔲㍺ٻ㌂㧊⻚⽊㞞ٻ䤞⩾ٻ㩫㺛㦮ٻ㩫㦮ٻ 䟟㩫䞯㌂㩚[2]㠦 ➆⯊Ⳋ 㩫㺛㧊⧖ "ὋὋⶎ㩲⯒ 䟊 ἆἶ㧦 㩫⿖㠦 㦮䟊 ἆ㩫♲ 䟟☯⹿䂾㦚 Ⱖ䞮Ⳇ, ⻫⮶∙ 㩫⿖⹿䂾∙㩫㺛㰖䂾∙ἆ㦮㢖 ṯ㧊 㡂⩂ 䡫䌲⪲ 䚲䡚" ♮ Ⳇ "䞿⻫㩗 ṫ㩲⩻㦚 㑮⹮䞮⓪ ῢ㥚Ṗ ⿖㡂♮ἶ 㧊㠦 ➆⯊㰖 㞠㦚 ἓ㤆 ⻢⁞∙㩲㨂 ❇㦮 㫆䂮"⯒ ⹱⓪ ộ㦚 㦮⹎䞲┺. ⹿㌂⓻⹿㨂⻫ 㩲 9 㫆(ⶒⰂ㩗⹿䢎㠦 ╖䞲 㤦㧦⩻㌂ 㠛㧦㦮 㺛㧚)㠦 ➆⧒ 㤦㧦⩻㌂㠛㧦⓪ CSP ⯒ 㑮Ⱃ䞮 㡂 㧊⯒ 㤦㧦⩻㞞㩚㥚㤦䣢(㩫⿖)㦮 㔏㧎㦚 ⹱㞚㟒 䞲 ┺. 㔏㧎⹱㦖 CSP ⯒ 㥚⹮䞮㡖㦚 ἓ㤆 ☯⻫ 㩲 12 㫆 (Ỗ㌂) 㩲 2 䟃㠦 ➆⧒ 㩫⿖⓪ 㔲㩫㦚 ⳛ䞶 㑮 㧞┺. Ⱎ 㰖Ⱏ㦒⪲ ☯⻫ 㩲 50 㫆(⻢䂯)㠦 ➆⧒ 㩫⿖⓪ Ỗ㌂㠦 ➆⯎ 㔲㩫 ⳛ⪏㦚 㥚⹮䞶 ἓ㤆 1 ⎚ 㧊䞮㦮 㰫㡃 ⡦⓪ 1 㻲Ⱒ㤦 㧊䞮㦮 ⻢⁞㦚 ⿖ὒ䞶 㑮 㧞┺. 㧊⩂䞲 ⻫⮶ῂ㫆⯒ 㫛䞿䞶 ➢, 㤦㧦⩻㔲㍺㦮 CSP ⓪ 䟟㩫䞯㌂㩚㠦㍲ 㩫㦮䞮⓪ 㩫㺛㦮 㫆Ị㦚 㿿㫇䞲┺ ἶ ⽒ 㑮 㧞┺. ڎډڍ 㤦㧦⩻㔲㍺ٻ㌂㧊⻚⽊㞞ٻ䤞⩾ٻ㩫㺛ٻ䡚䢿ٻ 㤦㧦⩻㞞㩚㥚㤦䣢ٻἶ㔲ٻ㩲 ڍڋڌڒڈڐڌ 䢎ڃⶒⰂ㩗⹿䢎′ 㩫ٻ❇㦮ٻ㧧㎇⌊㣿㦮ٻ䟃⳿⼚ٻ㎎⿖㧧㎇₆㭖ڄٻ⼚䚲ٻڏڃ㩫 ⽊㔲㓺䎲ٻ ⽊㞞′㩫㦮ٻ ㎎⿖㧧㎇₆㭖ڄ㦖ٻ 㤦㧦⩻㌂㠛㧦 㦮ٻڞڮګ Ṗٻ㧧㎇♮㠊㟒ٻ䞶ٻ㎎⿖₆㭖㦚ٻ㩲㔲䞲┺ډٻ☯ٻἶ 㔲㦮ٻ ದ㩚㧦㩗ٻ 䂾䟊䟟㥚㠦ٻ ╖䞲ٻ 㤦㧦⩻㔲㍺ٻ 䅊䜾䎆ٻ ⹥ٻ㩫⽊㔲㓺䎲ٻ╖㦧㫆䂮Ἒ䣣㠦ٻὖ䞲ٻ㌂䟃ಧ㠦㍲⓪ٻ⽎ٻ ⏒ⶎ㠦㍲ٻ ┺⬾ἶ㧦ٻ 䞮⓪ٻ ㌂㧊⻚㌂Ịٻ ╖㦧ὒٻ ὖ⩾䞲ٻ ᾦ㥷ٻ⹥ٻ䤞⩾㠦ٻὖ䞲ٻ㌂䟃㦚ٻ₆㑶䞮☚⪳ٻⳛ㔲䞮ἶٻ㧞 ┺ډٻٻ 㧊⩂䞲ٻ㣪Ị㦖ٻڦڤکڜڞڊڭڮڈڋڌڐٻ⿖⪳ ڍ 㠦ٻ⁒Ệ䞮㡂ٻ㑮 Ⱃ♲ٻ㤦㧦⩻㔲㍺⼚ٻڞڮګ 㠦ٻ⹮㡗♮㠊ٻ㧞┺ډٻ➆⧒㍲ٻ䡚 㨂ٻ 㤦㧦⩻㔲㍺㦖ٻ ㌂㧊⻚㌂Ịٻ ╖㦧㦚ٻ 㥚䞲ٻ 㾲㏢䞲㦮ٻ 㩫㺛㧊ٻ㫊㨂䞲┺ἶٻ⽒ٻ㑮ٻ㧞┺ډٻ㤦㧦⩻㔲㍺⼚ٻڞڮګٻ㑮 Ⱃٻ㔲ٻ㺎㫆♲ٻڦڤکڜڞڊڭڮڈڋڌڐ 㦮ٻ䟊╏ٻ╖⳿㦖ٻ㞚⧮㢖ٻṯ ┺ډٻ ٻ ڎډډڎٻᾦ㥷ٻٻ⹥ٻٻ䤞⩾㠦ٻٻὖ䞲ٻٻ㌂䟃ٻٻ ٻڎډڎډڌٻᾦ㥷ٻ⹥ٻ䤞⩾ٻ ٻٻڎډڎډڌډڌٻ゚㌗㌂Ịٻ╖㦧ٻ䤞⩾ٻ ٻٻٻٻڃ㤦㧦⩻㌂㠛㧦ڄ⓪ٻ゚㌗㌂Ị╖㦧ٻᾦ㥷ٻ⹥ٻ䤞⩾ὒٻὖ⩾䞮㡂ٻٻ ┺㦢㦚ٻ㧊䟟䞲┺ٻ ٻٻṖډٻ㌂㧊⻚Ὃỿٻ゚㌗㌂Ị╖㦧ٻ㧎⩻㠦ٻ╖䞮㡂ٻ㭒₆㩗㦒⪲ٻ ᾦ㥷ٻ㩲Ὃٻ ٻٻ⋮ډٻṲ⹲♲ٻ゚㌗㌂Ị╖㦧ٻ㩞㹾ٻ⹥ٻṖ㌗ٻ㔲⋮Ⰲ㡺⯒ٻ₆⹮㦒⪲ٻٻ 㤦㧦⩻㔲㍺ٻ 㤊㡗㠦ٻ 㡗䟻㦚ٻ 㭒㰖ٻ 㞠㦖ٻ ⻪㥚ٻ ⌊㠦㍲ٻ 㭒₆ 㩗㧎ڃ㾲㏢ٻ⎚ٻڌ 䣢ٻ㧊㌗ڄٻ⳾㦮ٻ䤞⩾ٻ㔺㔲ڃ゚Ὃ㰖ٻ䤞⩾ٻ䙂 䞾ڄٻ ٻٻ┺ډٻᾦ㥷䤞⩾ٻἆὒ㠦ٻ╖䞲ٻⶎ㍲䢪ٻ ٻ ٻٻٻڎډڎډڌډڍٻ゚㌗ٻ⽋ῂἚ䣣ٻ㩦Ỗٻ⹥ٻ䤞⩾ٻ ٻٻٻٻڃ㤦㧦⩻㌂㠛㧦ڄ⓪ٻ┺㦢㧊ٻ㑮䟟♮☚⪳ٻ⽊㧻䞲┺ډٻ ٻٻṖډٻ゚㌗⽋ῂἚ䣣㠦ٻ╖䞲ٻ㭒₆㩗ٻ㩦Ỗٻ⹥ٻ䤞⩾ڃ㾲㏢ٻ⎚ٻڌ 䣢ٻٻ 㧊㌗ڄ㦚ٻ䐋䟊ٻ䣾ὒ㎇ٻ㧛㯳ٻ ٻٻ⋮ډٻ䤞⩾㦚ٻ㔺㩲ٻ⺇㠛♶ٻ㧻㏢㠦㍲ٻ㑮䟟䞮㡂ٻὖ⩾㧦⪲ٻ䞮㡂⁞ٻٻ ⁎⩂䞲ٻ ㌗䢿㠦ٻ 㧋㑯䟊ٻ 㰞ٻ 㑮ٻ 㧞☚⪳ٻ 䞮Ⳇڇٻ 䟊╏ٻ㧻㏢Ṗٻ ゚㌗ٻ⽋ῂἚ䣣㦚ٻ㰖㤦䞶ٻ⓻⩻㦚ٻṬ㿪㠞⓪㰖ٻ䢫㧎ٻ ٻٻ┺ډٻ䤞⩾㦖ٻ⹎Ⰲٻ㍺㩫♲ٻ㔺㩲ٻ⹲㌳♶ٻ㑮ٻ㧞⓪ٻ䡚㔺㩗㧎ٻ㔲⋮ٻ Ⰲ㡺⯒ٻ₆⹮㦒⪲ٻ㑮䟟ٻ ٻٻ⧒ډٻ䤞⩾ٻ㔲ٻ䞚㑮❪㰖䎎㧦㌆㠦ٻ╖䞲ٻ⽋ῂٻ⹥ٻ㨂ῂ㎇ٻ䙂䞾ٻ ٻٻⰞډٻ㩦Ỗٻ⹥ٻ䤞⩾ٻἆὒ⯒ٻỖ䏶䞮㡂ٻ⽊㢚㌂䟃㠦ٻ╖䞲ٻ㩗㩞䞲ٻٻ 㫆䂮ٻ㧊䟟ٻ⹥ٻ゚㌗ٻ⽋ῂἚ䣣ٻṲ㩫ٻ ٻٻ⹪ډٻ゚㌗ٻ⽋ῂἚ䣣ٻ䤞⩾㧊ٻ䞚㑮❪㰖䎎㧦㌆ٻ⽎⧮㦮ٻڮڮڠګٻ₆⓻ٻ ㎇⓻ٻ ⹥ٻ 㔶⬆㎇㠦ٻ 㞛㡗䟻㦚ٻ ⹎㼦ٻ 㑮䟟㧊ٻ ⿞Ṗ䞶ٻ ἓ㤆㠦 ⓪ٻ┺⯎ٻ╖㞞㩗㧎ٻ╖㺛ٻ㑮Ⱃٻ ٻٻ㌂ډٻἚ䣣㡞⹿㩫゚ٻ₆Ṛٻ❇㦚ٻ䢲㣿䞮㡂ٻ゚㌗ٻ⽋ῂἚ䣣㠦ٻ╖䞲ٻ ٻ㩦Ỗٻ⹥ٻ䤞⩾ٻ㑮䟟ٻṖ⓻ٻ ڃ⁎Ⱂٻڍڄٻڦڤکڜڞڊڭڮڈڋڌڐ 㦮ٻ㩚㧦㩗ٻ䂾䟊䟟㥚㠦ٻ╖䞲ٻ㤦㧦⩻ 㔲㍺ٻ䅊䜾䎆ٻ⹥ٻ㩫⽊㔲㓺䎲ٻ╖㦧㫆䂮Ἒ䣣㠦ٻὖ䞲ٻ㌂䟃ٻ㭧ٻ ㌂㧊⻚㌂Ị╖㦧ٻᾦ㥷ٻ⹥ٻ䤞⩾㠦ٻὖ䞲ٻ㌂䟃ٻ 4. 剳喺ȝ歾 匶渆櫖 娶幾 斲決憊 篎崮 洛煋 殚割斲穳 ڏډڌٻڦڤکڜڞڊڭڮڈڋڌڐٻ゚㌗㌂Ịٻ╖㦧㠦ٻὖ䞲ٻ㌂䟃ٻ ڦڤکڜڞڊڭڮڈڋڌڐٻ ڍډڎڃ゚㌗㌂Ịٻ ╖㦧ٻ ⹥ٻ ⽋ῂڄ㠦ٻ ➆⯊ Ⳋٻ 㤦㧦⩻㌂㠛㧦⓪ٻ ゚㌗㌂Ị㠦ٻ ╖㦧䞮₆ٻ 㥚䞲ٻ ⳿㩗ڇٻ ⻪㥚ڇٻ㡃䞶ڇٻ㺛㧚ٻ⹥ٻὖⰂ㩗㧎ٻ㌂䟃㦚ٻ₆㑶䞮⓪ٻ゚㌗ ㌂Ịٻ ╖㦧ٻ㩫㺛㦚ٻ Ṳ⹲䟊㟒ٻ䞲┺ډٻ㧊⓪ٻ ㌂㧊⻚ٻ ゚㌗ ㌂Ị㠦ٻ╖䞲ٻ䤞⩾㠦ٻὖ䞲ٻ㌂䟃㦚ٻ䙂䞾䞮₆ٻ➢ⶎ㠦ٻ㌂ 㧊⻚⽊㞞ٻ 䤞⩾㠦ٻ ╖䞲ٻ 㤦㧦⩻㌂㠛㧦㦮ٻ ㌗㥚ٻ ⶎ㍲㠦ٻ 䟊╏䞲┺ډٻ ➆⧒㍲ڇٻ 㧊⩂䞲ٻ 㣪ῂ㌂䟃㦖ٻ 䤞⩾㠦ٻ ὖ䞲ٻ 㩫㺛㦮ٻ䞚㣪㎇㦚ٻ㠎 䞮ἶٻ㧞⓪ٻộ㦒⪲ٻṚ㭒♶ٻ㑮ٻ㧞 ┺ډٻ ٻٻ ڏډڍٻ胃ٻῃⰓ䚲㭖₆㑶㡆ῂ㏢ڃکڤڮگڄٻڮګٻړڋڋڈړڏٻ ⹎ٻῃⰓ䚲㭖₆㑶㡆ῂ㏢ٻ䚲㭖ⶎ㍲㧎ٻکڤڮگٻڮګٻړڋڋڈړڏٻ ڶڎڸ⓪ٻ₆ὖ㦮ٻ㌂㧊⻚㌂Ị╖㦧㦚ٻ㥚䞲ٻڤگٻ㩚⨋ٻἚ䣣㠦ٻ ╖䞲ٻṖ㧊✲⯒ٻ㩲Ὃ䞮⓪ٻⶎ㍲㧊┺ډٻ⽎ٻⶎ㍲㠦㍲⓪ٻ㫛 䞿㩗㧎ٻᾦ㥷ٻ⹥ٻ䤞⩾㠦ٻ╖䞲ٻ㩫㺛㦚ٻṲ⹲䞶ٻộ㦚ٻⳛ 㔲䞮ἶٻ㧞㦒Ⳇڇٻ㩫㺛ٻ䟃⳿㦒⪲ٻ㩲㞞䞮⓪ٻ㌂䟃㦖ٻ㞚⧮ 㢖ٻṯ┺ډٻ ‡ٻ⳿㩗ٻ ‡ٻ㥶䣾㧒㧦ٻ

303

‡ٻ╂㎇䞮ἶ㧦ٻ䞮⓪ٻ⳿䚲✺ٻ ‡ٻ㩗㣿ٻ╖㌗ٻ⹥ٻ⻪㥚ٻ ‡ٻὖ⩾ٻ⻫⪏ٻ⹥ٻ′㩲㣪Ịٻ ‡ٻ㺛㧚ٻ㫆㰗ٻ⹥ٻ╊╏㧦ٻ ‡ٻ䤞⩾ٻ㩫㺛ٻ㣪ῂ㌂䟃ٻ ‡ٻ䤞⩾ٻ㩫㺛㠦ٻ╖䞲ٻỖ䏶ٻ⹥ٻ㔏㧎ٻ ٻ ڏ ڏډڎٻ胃ٻῃ䏶㞞⽊⿖㦮ٻ䤞⩾ٻ䘟Ṗٻ䝚⪲⁎⧾ڃڣڮڠڠګڄٻ ⹎ῃٻ ῃ䏶㞞⽊⿖ڃڟڣڮڄ㦮ٻ ῃ䏶㞞⽊䤞⩾ٻ ⹥ٻ 䘟Ṗٻ 䝚 ⪲⁎⧾ڃڣۊۈۀۇڼۉڿٻ ڮۀھېۍۄۏ۔ٻ ڼۉڿٻ ڠۑڼۇېڼۏۄۊۉٻ ګۍۊۂۍڼۈڇٻ ڣڮڠڠګڄڶڏڸ⓪ٻ⹎ῃ㦮ٻڔډڌڌٻ 䎢⩂ٻ㧊䤚ٻ ⹲Ṛ♲ٻ 㰖䂾ٻ⹥ٻ Ṗ㧊✲ٻ㎇ỿ㦮ٻⶎ㍲⪲ٻ┺㟧䞲ٻ゚㌗╖㦧⿚㟒ڃ㨂⋲ڇٻ䎢 ⩂ڇٻ㌂㧊⻚Ὃỿٻ❇ڄ㠦㍲ٻ㩗㣿ٻ Ṗ⓻䞲ٻ䤞⩾ٻ ㍺Ἒڇٻ㔺 㔲ٻ⹥ٻ䘟Ṗ㠦ٻ╖䞲ٻ₆㭖㦚ٻ㩲㔲䞲┺ډٻ ڣڮڠڠګ ⓪ٻ Ṗ㧻ٻ Ⲓ㩖ٻ 䤞⩾ٻ 䝚⪲⁎⧾ٻ ὖⰂڃۋۍۊۂۍڼۈٻ ۈڼۉڼۂۀۈۀۉۏڄ㠦ٻ ὖ䞲ٻ ㌂䟃㦚ٻ ┺⭂┺ډٻ 㡂₆㍲ٻ ٽ䝚⪲⁎ ⧾ٽ㧊⧒ٻ 䞾㦖ٻ 䔏㩫ٻ 㧻₆⳿䚲㠦ٻ ╖䞲ٻ 㼊Ἒ䢪♲ٻ 䟟☯ڊ 㫆䂮✺㦚ٻ 㦮⹎䞮Ⳇڇٻ ➆⧒㍲ٻ 䤞⩾ٻ 䝚⪲⁎⧾㦖ٻ 䤞⩾㦮ٻ Ἒ䣣ڇٻ㑮䟟ٻ ⹥ٻ 䘟Ṗ㠦ٻ ╖䞲ٻ㧒ὖ♲ٻ㩧⁒⹿⻫㦚ٻ ⦑䞲 ┺ډٻ 䤞⩾ٻ 䝚⪲⁎⧾ٻ ὖⰂ⓪ٻ 䤞⩾ٻ 䝚⪲⁎⧾ٻ 㭧㩦㌂䟃 ڃۋۍۄۊۍۄۏۄۀێڄ✺㧊ٻ╂㎇♮☚⪳ٻ㭧㩦㌂䟃ٻ⁎ٻ㧦㼊⯒ٻ㔳 ⼚䞮ἶڇٻ 䞚㣪䞲ٻ 㧦㤦㦚ٻ ⺆⿚䞮ἶڇٻ 䤞⩾㧊ٻ 㰖㏣♮₆ٻ 㥚䞲ٻ 㫆㰗ڊ⿖㻮ڊ₆ὖ㦚ٻ 䐋䞿䞮⓪ٻ 䢲☯㦚ٻ 㦮⹎䞲┺ډٻ 㧊⯒ٻ 䐋䟊ٻ 㧒⩾㦮ٻ 䤞⩾䢲☯㦚ٻ 㰖㏣㩗㦒⪲ٻ Ṧ☛䞮ἶٻ 㭧㩦㌂䟃㦚ٻ 㧒ὖ㎇ٻ 㧞Ợٻ 㿪ῂ䟊ٻ ⋮Ṗ⓪ٻ ộ㦚ٻ ⽊㧻䞲 ┺ډٻ㧊㠦ٻ➆⧒ٻ 䤞⩾ٻ䝚⪲⁎⧾ٻ 㭧㩦㌂䟃ٻ 㡃㔲ٻ䤞⩾㦮ٻ 㩫㺛㠦ٻ⹮㡗♮㠊㟒ٻ䞶ٻ㭧㣪䞲ٻ㣪㏢⪲ٻṚ㭒♶ٻ㑮ٻ㧞┺ډٻٻ ⡦䞲ڇٻڣڮڠڠګ ⯒ٻ䐋䟊ٻ㩲㔲♮⓪ٻ䤞⩾㦮ٻ㥶䡫㠦ٻὖ䞲ٻ 㩫㦮⓪ٻ ╖䚲㩗㦒⪲ٻ 䤞⩾ٻ 㩫㺛㠦ٻ 䙂䞾♮㠊㟒ٻ 䞶ٻ 㣪㏢ ⪲ٻ⽒ٻ㑮ٻ㧞┺ډٻ䡚䟟ٻ㌂㧊⻚⽊㞞ٻ䤞⩾㦮ٻἓ㤆ڇٻ䤞⩾ 㦚ٻ㔺㔲䞮⓪ٻ⹿⻫ٻ⹥ٻ㫛⮮㠦ٻ╖䞲ٻ₆㭖㧊ٻ⳾䢎䞲ٻ⹮ Ⳋڇٻڣڮڠڠګ 㠦ٻ⁒Ệ䞲ٻ䤞⩾ٻ㥶䡫ٻ⿚⮮㼊Ἒ⓪ٻ䟻䤚ٻ䤞⩾ 㦮ٻ㔺㔲ٻ⳿㩗㠦ٻ㩗䞿䞲ٻ䡫䌲㦮ٻ䤞⩾㦚ٻ㑮䟟䞶ٻ㑮ٻ㧞 ⓪ٻ⁒Ệ⪲ٻ䢲㣿♶ٻ㑮ٻ㧞㦚ٻộ㧊┺ډٻ کڤڮگٻڮګٻړڋڋڈړڏ 㢖ٻڣڮڠڠګ 㠦ٻ➆⯎ٻ䤞⩾㦮ٻ㥶䡫ٻ⿚⮮ 㼊Ἒ⯒ٻ㫛䞿䞮Ⳋٻ㞚⧮ٻ⁎Ⱂὒٻṯ㧊ٻ䚲䡚䞶ٻ㑮ٻ㧞┺ډٻ ٻ ڃ⁎Ⱂٻڎڄٻکڤڮگٻڮګٻړڋڋڈړڏٻ⹥ٻڟڣڮٻڣڮڠڠګ 㠦ٻ➆⯎ٻ㌂㧊⻚⽊㞞ٻ 䤞⩾ٻ㥶䡫⿚⮮ٻ㼊Ἒڶڐڸٻ 5. 旇显 勢洢愯橎 5.1 CSP Ṳ㩫㦚 䐋䞲 ㌂㧊⻚⽊㞞 䤞⩾ 㩫㺛 Ṳ㍶ 㤦㧦⩻㌂㠛㧦㦮ٻ㌂㧊⻚⽊㞞ٻ㧊䟟ٻ䢲☯㦮ٻ㾲㌗㥚ٻⶎ ㍲Ṗٻ ♮⓪ٻ ڞڮګٻ Ṳ㩫㦚ٻ 䐋䟊ٻ 䤞⩾ٻ 㩫㺛㦚ٻ 㑮Ⱃ䞶ٻ 㑮ٻ 㧞┺ډٻⶒⰂ㩗⹿䢎㦮ٻὖ㩦㠦㍲ٻ㤦㧦⩻㔲㍺ٻ′㩫ٻ㭧ٻ⹿ ㌂⓻⹿㨂⻫㌗ٻڞڮګ 㠦ٻ㌗㦧䞮⓪ٻ′㩫㧎ٻٽ㤦㧦⩻㔲㍺ٻ❇ 㦮ٻⶒⰂ㩗⹿䢎⯒ٻ㥚䞲ٻ′㩫ٽ㠦ٻ➆⯊ⳊٻⶒⰂ㩗⹿䢎ٻᾦ 㥷ٻ⹥ٻ䤞⩾ὒٻὖ䞲ٻ㌂䟃㦮ٻ₆㑶㧊ٻὖ⩾ٻ䤞⩾ٻἶ㔲㢖ٻ 㡆☯♮㠊ٻ 㩚㼊䤞⩾ٻ ⹥ٻ ⿖⿚䤞⩾㦮ٻ 㔺㔲㠦ٻ ὖ䞮㡂ٻ 㩗 㔲♮㠊ٻ㧞┺ډٻ 㧊⩂䞲ٻ㌂⪖⯒ٻ㺎㫆䞶ٻ➢ڇٻڞڮګ 㦮ٻದ㩚㧦㩗ٻ䂾䟊䟟 㥚㠦ٻ ╖䞲ٻ 㤦㧦⩻㔲㍺ٻ 䅊䜾䎆ٻ ⹥ٻ 㩫⽊㔲㓺䎲ٻ ╖㦧㫆 䂮Ἒ䣣㠦ٻ ὖ䞲ٻ ㌂䟃ಧ㠦ٻ ➆⯎ٻ ᾦ㥷ٻ ⹥ٻ 䤞⩾㠦ٻ ὖ䞲ٻ ㌂䟃㠦㍲☚ڇٻ䟊╏ٻ䤞⩾㧊ٻ⹿㌂⓻⹿㨂⻫ٻ⹥ٻὖ⩾ٻἶ㔲 㠦ٻ➆⧒ٻ㑮䟟䞲┺⓪ٻ₆㑶㧊ٻ䞚㣪䞮┺ډٻ ⡦䞲ڇٻ䟊╏ٻ′㩲㣪Ị㦚ٻⰢ㫇㔲䋺₆ٻ㥚䞲ٻ䤞⩾㦮ٻ㔺 㔲ٻ 㥶䡫㠦ٻ ╖䞮㡂ٻ ⽎ٻ ⏒ⶎ㠦㍲ٻ 㩲㔲䞲ٻ ⹪㢖ٻ ṯ㧊ٻ کڤڮگٻڮګٻړڋڋڈړڏٻ⹥ٻڣڮڠڠګ 㠦ٻ➆⯎ٻ┺㟧䞲ٻ䡫䌲㦮ٻ䤞⩾ 䡫䌲㠦ٻ╖䟊ٻ㩫㦮䞮⓪ٻộ㧊ٻ䞚㣪䞮┺ډٻ ₆䌖ٻکڤڮگٻ ڮګٻ ړڋڋڈړڏٻ ⹥ٻڣڮڠڠګ 㠦ٻ ➆⯎ٻ䤞⩾ٻ㩫㺛 㦮ٻ㭒㣪ٻ 㣪㏢ڃ㩫㺛ٻ 㑮Ⱃٻὒ㩫㠦㍲ٻ㭧ἂٻ Ṛ⿖㦮ٻ 㺎㡂ٻ ⽊㧻ڇٻ 䤞⩾㦮ٻ 㭧㩦㌂䟃ڃۋۍۄۊۍۄۏۄۀێڄٻ ❇ڄ㠦ٻ ╖䟊㍲☚ٻ ڞڮګ 㠦ٻ⹮㡗♮㠊㟒ٻ䞶ٻộ㧊┺ډٻ 㧊⩂䞲ٻ ڞڮګ 㦮ٻ Ṳ㩫⹿㞞㦖ٻ ἆῃٻ Ṳ㩫⹿䟻ὒٻ ⁎ٻ ⌊ 㣿㠦ٻ ╖䞲ٻ ′㩲㰖䂾㦚ٻ 㩲Ὃ䞮⓪ٻ ㌂㧊⻚⽊㞞ٻ 䤞⩾ٻ ′ 㩲㰖䂾㦮ٻ 䞚㣪㎇㦚ٻ 㡃㍺䞲┺ډٻ ′㩲₆ὖ㦖ٻ 䡚䟟ٻ ὖ⩾ٻ ′㩲㣪Ịٻ⹥ٻڦڤکڜڞڊڭڮڈڋڌڐ 㦮ٻ⌊㣿㦚ٻ⽊┺ٻ㌗㎎䢪ٻ⹥ٻ ⽊㿿䞮⓪ٻ 㑮㭖㦮ٻ ′㩲㰖䂾㦚ٻ Ṳ⹲䞮㡂ٻ ⽎ٻ ⏒ⶎ㠦㍲ٻ 㩲㞞䞮⓪ٻ⹪㢖ٻṯ㧊ٻῃ⌊ȡ㣎ٻ₆㭖㠦ٻ➆⯎ٻ㌂㧊⻚⽊㞞ٻ 䤞⩾㠦ٻὖ䞲ٻ㩫㺛㦚ٻ㑮Ⱃ䞮⓪ٻ₆㭖㦚ٻ㩲㔲䟊㟒ٻ䞶ٻộ 㧊┺ډٻὖ⩾ٻ⻫⪏㼊Ἒ㢖ٻ㡆Ἒ♲ٻ′㩲ٻṲ㍶⹿㞞㦖ٻ㞚⧮ٻ ⁎Ⱂὒٻṯ㧊ٻ☚㔳䢪ٻ䞶ٻ㑮ٻ㧞┺ډٻ ٻ ڃ⁎Ⱂٻڏڄٻ㌂㧊⻚⽊㞞ٻ䤞⩾ٻ′㩲㣪Ị㠦ٻ➆⯎ٻ′㩲㰖䂾ٻ⹥ٻ 㔲㍺ٻ⼚ٻ㌂㧊⻚⽊㞞ٻ䤞⩾ٻ㩫㺛㦮ٻὖἚ☚ٻ 5.2 㡆Ṛ䤞⩾Ἒ䣣 㕂㌂⯒ 䐋䞲 ㌂㠛㧦 㩫㺛 㑮Ⱃ 㥶☚ ㌂㧊⻚⽊㞞 䤞⩾ 㩫㺛㦮 㣪㏢ 㭧 㔲㍺ ′㩫㠦 ⹮㡗 ♮₆ 㠊⩺㤊 㑮㭖㦮 㩫㺛㧊 㫊㨂䞶 㑮 㧞┺. 㡞⯒ ✺ 㠊 㩫₆ 㧎㌂⯒ 䐋䟊 ⹪≪ 㑮 㧞⓪ 㩫㺛 ╊╏㧦, ⡦ ⓪ ⽊┺ ┾₆Ṛ㠦 ╂㎇䞮ἶ㧦 䞮⓪ 㩫㺛 ❇㦮 ἓ㤆㠦 ⓪ ὖ⩾ ′㩲₆ὖ㦮 㔏㧎㦚 ⹱㞚㟒䞮⓪ ㌂㠛㧦 ′㩫 㧊 㞚┢ 㭒₆㩗㦒⪲ ẇ㔶♮⓪ ⶎ㍲⯒ 䐋䟊 ῂ䡚䞮⓪ ộ㧊 ⹪⧢㰗䞶 ộ㧊┺.

304

䡚 ㌂㧊⻚⽊㞞 䤞⩾ ′㩲 㼊Ἒ㠦⓪ 㧊⩂䞲 ㎇ỿ㦮 ⶎ㍲⪲ ㌂㧊⻚⽊㞞 㡆Ṛ䤞⩾Ἒ䣣㧊 㫊㨂䞲┺. 㡆Ṛ䤞 ⩾Ἒ䣣㦖 㩚⎚☚ 11 㤪 Ⱖ₢㰖 ὖ⩾ ′㩲₆ὖ㠦 㩲㿲 ♮㠊 㕂㌂ ⹥ 㔏㧎㦚 ⹱⓪ 㤦㧦⩻㔲㍺㦮 ╏䟊⎚☚ 䤞 ⩾Ἒ䣣㠦 ὖ䞲 ㌂䟃㦒⪲ ⰺ⎚ ⼖☯♶ 㑮 㧞⓪ ㎇ỿ㦮 㩫㺛㦚 ₆㑶䞮₆㠦 㩗䞿䞮┺. 㡆Ṛ䤞⩾Ἒ䣣㦚 䐋䟊 ῂ䡚♲ 㩫㺛㦖 ṗ ⿖⿚/㩚㼊䤞⩾ ㎎⿖Ἒ䣣 㕂㌂ ⹥ 䤞⩾ 䘟Ṗ⯒ 䐋䟊 ⁎ 㧊䟟㡂⿖Ṗ 㩦Ỗ♶ ộ㧊┺. 㧊 ⩂䞲 ㌂㧊⻚⽊㞞 䤞⩾ 㑮䟟ὒ ὖ⩾♲ ′㩲 㩞㹾⓪ ㌂ ⶊ䘎⧢[1]㠦 ₆㑶♮㠊 㧞㦒Ⳇ, 㧊⯒ ☚㔳䢪䞮Ⳋ 㞚⧮ ⁎Ⱂὒ ṯ┺ G ڃ⁎Ⱂٻڐڄٻ㤦㧦⩻㔲㍺⼚ٻ㡆Ṛ䤞⩾Ἒ䣣ٻ⹥ٻ㩚㼊䤞⩾ٻ㎎⿖Ἒ 䣣㠦ٻ╖䞲ٻ㕂㌂ٻ⹥ٻ䤞⩾䘟Ṗٻ㩞㹾☚ٻ ٻ 6. 冶冶嵦 㩫⽊⽊㞞 ⹥ ㌂㧊⻚⽊㞞㠦 㧞㠊㍲ 㩫㺛㦚 㑮Ⱃ䞮ἶ 㧊⯒ 㧊䟟䞮⓪ ộ㦖 㫆㰗㦮 ⽊㞞 ὖ㩦㠦㍲㦮 ⳿䚲⯒ 㰖㏣㩗㦒⪲ ╂㎇䞮⓪◆ 㭧㣪䞲 㣪㏢㧊┺. ⽎ ⏒ⶎ㠦 ㍲⓪ 㤦㧦⩻㔲㍺ ㌂㧊⻚⽊㞞 䤞⩾ ⿚㟒㠦 ╖䟊㍲ ₆ 㫊 ′㩲㼊Ἒ䞮㠦㍲ 㑮䟟♲ ⏎⩻✺㦚 ㌊䘊⽊ἶ, 䤞⩾ 㩫㺛㦮 Ṳ㍶㧊 䞚㣪䞾㦚 㰚┾䞮㡖㦒Ⳇ, ⁎ Ṳ㍶⹿㞞 㦒⪲ 㩫⽊㔲㓺䎲 ⽊㞞′㩫(CSP) 㹾㤦㦮 䤞⩾ 㩫㺛 ⹥ 㡆Ṛ䤞⩾Ἒ䣣㦮 ⽊㢚㦚 䐋䞲 㩫㺛㦮 㑮Ⱃ㦚 㩲㔲䞮㡖 ┺. ⡦䞲, 㑮Ⱃ♶ 䤞⩾ 㩫㺛㠦 ✺㠊Ṟ 㣪㏢✺㠦 ╖䟊 ㍲☚ ῃ⌊ȡ㣎 ₆㭖㦚 ⁒Ệ⪲ 㡊Ệ䞮㡖┺. ㌂㧊⻚⽊㞞 ㌂Ị╖㦧䤞⩾㦖 㧒⹮㩗㧎 㫆㰗㠦㍲ ㌂ 㧊⻚㌂Ị╖㦧 Ἒ䣣㦮 㧒䢮㦒⪲ ㌂Ị╖㦧㫆㰗 ῂ㎇㤦 㦮 㡃⨟㦚 㩲ἶ䞮₆ 㥚䟊 㔺㔲♮⓪ 䢲☯㧊┺. 㧊㠦 ➆⧒, ㌂㧊⻚⽊㞞 䤞⩾ 㩫㺛㦖 ἆὒ㩗㦒⪲ ㌂㧊⻚㌂ Ị╖㦧 㩫㺛㦮 䞲 ⿖⿚㦒⪲ 㧦Ⰲ㧷㦚 㑮 㧞㦒Ⳇ, 㧊 ⓪ 㔺㩲 KINAC/RS-015 㠦㍲ 㩲㔲䞮⓪ ⹪㢖 㧒䂮䞲┺. ⽎ ⏒ⶎ㠦㍲ 㩲㔲䞮⓪ ㌂㧊⻚⽊㞞 䤞⩾ 㩫㺛㦮 Ṳ㍶ 䢲☯㦖 㡆ὖ♲ ㌂㧊⻚⽊㞞⿚㟒 㩫㺛㦮 㑮Ⱃ ⹥ Ṳ㍶ 㠦 䕢 ♮㠊 㩚⹮㩗㧎 㤦㧦⩻㔲㍺ ㌂㧊⻚⽊㞞 㼊ἚṖ Ṳ㍶♮⓪ ộ㧊 ⹪⧢㰗 䞶 ộ㧊┺. 焾処怾竒 [1] "㤦㧦⩻㔲㍺㦮 䅊䜾䎆 ⹥ 㩫⽊㔲㓺䎲 ⽊㞞 (KINAC/RS-015)", 䞲ῃ㤦㧦⩻䐋㩲₆㑶㤦, 2016. [2] 䞮☯㍳ 㣎 1 㧎, “㧊䟊䞮₆ 㓓Ợ 㝊 䟟㩫䞯㣿㠊㌂ 㩚”, ㌞㩫⽊⹎❪㠊, 2010.

[3] Tim Grance et al., “Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities”, NIST, 2006 [4] "Homeland Security Exercise and Evaluation Program

(HSEEP)." US Department of Homeland Security, 2013. [5] T. Aoyama et al., "On the complexity of Cybersecurity

Exercises Proportional to Preparedness", Journal of Disaster Research, Vol. 12, No.3, 1081, 2017.

[6] "㤦㧦⩻㔲㍺❇㦮 ⶒⰂ㩗⹿䢎 ὖ⩾ ㌂ⶊ䘎⧢", 䞲ῃ 㤦㧦⩻䐋㩲₆㑶㤦, pp.22-26, 2016.

305