Security Requirements Analytics and Design Principles

Regulatory compliance and security requirements

Security requirements are derived to prevent breaches of the system and data, and refer to requirements or constraints concerning confidentiality (Confidentiality), integrity (Integrity), and availability (Availability) that affect the protection of data used or generated by the target system.

Security requirements include criteria for controlling system data and functions, operational access, as well as credential and access permission management, data and infrastructure security, and related measures.

When building an information system on the cloud, you must comply with information security laws and guidelines based on the types and attributes of the data the system handles.

Especially public institutions and the financial sector must follow separate cloud adoption guidelines.

Although various security activities are performed within the organization to protect information, systematically managing the extensive information security work areas without omission is a very challenging task.

Therefore, to effectively protect an organization’s information assets from various security threats, a systematic management approach is required.

The information security management system is intended for comprehensive and systematic security management of an organization, and it designs and builds policies, organizational structures, operational measures, and system security frameworks for administrative, technical, and physical security domains.

Based on this framework, organizations can maintain security levels and perform continuous security controls.

• Administrative Security Administrative security is a core area that establishes an organization’s security policies, forms a security team, and continuously improves vulnerabilities by preventing security risks through security operations and audits. This serves as the standard for implementing technical and physical security, and is responsible for the organization’s security operations and controls. Administrative security includes establishing security policies and organizational structures, personnel security management, information protection education and training, risk management, asset management, auditing and monitoring, business continuity management, and disaster recovery.

• Technical Security Technical security refers to implementing security during the adoption and operation of detailed areas such as hardware, software, and networks, based on security policies. Specifically, we design the security architecture required for IT system operations and perform the deployment, monitoring, and operation of security equipment. Technical security includes system, network, database, Application, and digital content security. The main areas of cloud architecture correspond to this technical security.

• Physical Security – Cloud Service Provider Security Physical security is a security domain that safely protects assets requiring protection, such as major facilities and equipment, from physical threats, and ensures stability and continuity. Physical security includes physical security measures, equipment and office protection, data center security, and access control solutions. In on-premises or private cloud environments, users manage physical security themselves, but in public clouds, the cloud service provider manages it.

Cloud service providers maintain physical security levels and demonstrate them through various information security management system certifications.

Establishing and operating an information security management system tailored to a specific purpose helps achieve the fundamental goal of information protection and contributes to securing trust in the organization’s security preparedness.

It also helps the organization comply with the legal regulations of its operational domain.

Various information security management system certifications are offered domestically and internationally to verify the adequacy of security operations, and organizations can obtain them as needed for their work.

The table below presents domestic and international information security management system certifications, including cloud.

Regulations and certification standards such as the above present security requirements that each organization must comply with when designing, building, and operating information systems.

It particularly outlines the requirements that cloud service providers (CSP) must comply with and the measures users must implement for information security when building information systems in the cloud.

Cloud security threats

Deploying an information system to the cloud means that an organization’s information assets shift into the cloud’s security management domain.

This means that the security domain, which was previously managed within the scope of the on‑premises computer room or data center, is expanding beyond the Internet to the cloud.

The existing security model places security devices at the boundary between the internal network and external network, establishing a trust boundary and is based on a perimeter‑based security model that protects the internal network.

However, as the trust boundary expands from the Internet to the cloud, a perimeter-based security model alone has limitations in blocking security threats.

CSA (Cloud Security Alliance) announces the major security threats that arise in the cloud each year.

The table below lists the major cloud security threats announced in 2024.