Security-by-design methodology using evidence-based security approach

1 . A method for embodying a security-by-design methodology using a processor of a computing device, the method comprising:

recognizing characteristics of an enterprise and a current status of the security-by-design methodology of the enterprise;

recognizing a security-by-design methodology level of the enterprise based on the current status of the security-by-design methodology;

recognizing a rival company related to the enterprise based on the characteristics and the current status of the security-by-design methodology;

recognizing an average security-by-design methodology level of the rival company;

providing first information by quantitatively analyzing a difference in security-by-design methodology level between the rival company and the enterprise based on the average security-by-design methodology level of the rival company and the security-by-design methodology level of the enterprise;

generating a security method for the enterprise using the security-by-design methodology and the first information, the security method including security steps and security activity;

automatically mapping, using the processor, the security-by-design methodology and an evidence-based security methodology, the evidence-based security methodology including security activities associated with the security steps, the mapping generating a structured mapping result linking the security-by-design methodology to respective products satisfying a respective activity of the evidence-based security methodology for a respective step of the security-by-design methodology;

storing the structured mapping result in a database comprising a plurality of linked tables for efficient retrieval and traceability;

receiving an appropriate security-by-design methodology level requested by the enterprise;

providing second information identifying at least one required security activity and at least one corresponding product related to the requested security-by-design methodology level among the security activities included in the mapping result; and

refining the security method based on the mapping result.

2 . The method of claim 1 ,

wherein the security steps includes one or more of a first step related to security training, a second step related to initiation and planning, a third step related to requirement analysis, a fourth step related to acquisition, a fifth step related to design, a sixth step related to implementation, a seventh step related to verification, an eighth step related to release, a ninth step related to operation, and a tenth step related to disposal.

3 . The method of claim 1 , wherein the recognizing an average security-by-design methodology level of the rival company comprises:

acquiring current status information for a security standard of an information protection product executed by the rival company; and

recognizing the average security-by-design methodology level of the rival company based on the current status information.

4 . The method of claim 1 , wherein the mapping result includes security-by-design methodology level information in which security-by-design methodology levels granted to an each of plurality of detailed security activities included in each of the security activities are recorded, and

wherein the recognizing a security-by-design methodology level of the enterprise based on the mapping result and the current status of the security-by-design methodology includes, recognizing the security-by-design methodology level of the enterprise for each of the security activities based on the security-by-design methodology level information and the current status of the security-by-design methodology.

5 . The method of claim 1 , wherein the second information includes one or more required products mapped to a respective required security step including one or more required security activities.

6 . The method of claim 1 , wherein the providing first information comprises:

generating a graph including the first information quantitatively to illustrate the difference in security-by-design methodology level between the rival company and the enterprise.

7 . The method of claim 6 , wherein the graph includes an x axis representing security activities of the enterprise, a y axis representing the security-by-design methodology level for each illustrated activity of the security activities, a first line representing the average security-by-design methodology level of the rival company, and a second line representing the security-by-design methodology level of the enterprise.

8 . The method of claim 7 , wherein the graph quantitatively represents the difference in security-by-design methodology level between the rival company and the enterprise based on a gap formed by a clearance between the first line and the second line.

9 . A security-by-design device, comprising:

processors configured to execute instructions; and

a memory storing the instructions, wherein execution of the instructions configures the processors to:

recognize characteristics of an enterprise and a current status of the security-by-design methodology of the enterprise;

recognize a security-by-design methodology level of the enterprise based on the current status of the security-by-design methodology;

recognize a rival company related to the enterprise based on the characteristics and the current status of the security-by-design methodology;

recognize an average security-by-design methodology level of the rival company;

provide first information by quantitatively analyzing a difference in security-by-design methodology level between the rival company and the enterprise based on the average security-by-design methodology level of the rival company and the security-by-design methodology level of the enterprise;

generate a security method for an enterprise using a security-by-design methodology and the first information, the security method including one or more of a security step and security activity;

automatically map, using the processors, the security-by-design methodology and an evidence-based security methodology, the evidence-based security methodology including security activities associated with the security steps, the mapping generating a structured mapping result linking the security-by-design methodology to respective products satisfying a respective activity of the evidence-based security methodology for a respective step of the security-by-design methodology;

store the structured mapping result in a database comprising a plurality of linked tables for traceable and practical integration into a security management platform;

receive an appropriate security-by-design methodology level requested by the enterprise:

provide second information for at least one required security activity related to the requested security-by-design methodology level among the security activities included in the mapping result; and

refine the security method based on the mapping result.