보안관리의 속성과 전사적 통합 패러다임

초록

As organizations face increasingly complex and diverse risks in modern society, the limitations of existing fragmented security measures become apparent. As a result, many organizations are adopting a risk-based security management approach that encompasses the entire organization, but the boundaries between security and risk management are not clear and conceptual confusion persists. This study aims to clarify the relationship between the two disciplines, redefine the concept of security management based on this, and examine the changes in the field. A systematic analysis of relevant standards and academic literature revealed that security management and risk management share substantially the same theoretical foundation in terms of purpose, conceptual definitions, basic principles, and management strategies. Additionally, it was confirmed that risk-based design of security standards, application of risk logic in security investment decision-making, and integration of risk into security governance are widespread trends in the modern security field. Based on this, security management was redefined as “the specialized application of risk management that systematically identifies, analyzes, evaluates, and addresses uncertainties that affect the achievement of an organization’s security objectives.” In other words, security management can be considered a type of risk management, essentially referring to security risk management. Furthermore, security management is shifting from existing individual and decentralized security activities to enterprise security risk management (ESRM). This means that security management is expanding from simple technical responses to the strategic risk management domain of the entire organization, and it shows a paradigm shift toward pursuing the efficient allocation of security resources and strengthening the organization’s integrated security capabilities through security governance.

키워드