SHIELD Web Utilization Scenario
1. Public Institution National Service
High Security Requirements
- Service for unspecified large number of people
- Personal Information Processing
- Mandatory Regular Security Inspections
- Compliance is mandatory (Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection)
Realistic difficulties
- Budget Shortage: Difficulty in securing redevelopment budget
- Technical deficiency: Lack of skilled personnel
- Lack of time: Long development period, service interruption not allowed
SHIELD Web Application Effects
- By addressing the inadequate configuration of aging servers in the annually recurring NIS vulnerability assessment, secure a stable security rating.
- Establishing a 'quarantine-centric security' system according to government guidelines to implement zero trust
- Resolve complex security requirements in a short period without code modification
Response to 21 Items of Vulnerabilities in the National Intelligence Service Website
SHIELD Web is a powerful tool for security assessment in public institutions.Compensating ControlIt can be used as a means.
| number | National Intelligence Service Diagnosis Items | SHIELD Web Response Method | Diagnosis Result (Example) |
|---|---|---|---|
| 1 | SQL Injection | Input validation and abnormal protocol blocking at the RBI layer | Good |
| 2 | Cross Site Scripting (XSS) | The script runs only in an isolated container, resulting in zero impact on the user's PC. | Good |
| 3 | Location Disclosure (Directory Listing) | Server directory structure is pixelated to block exposure sources. | Good |
| 4 | Vulnerable Method (WebDAV) | Rejecting unnecessary HTTP methods such as PUT and DELETE due to RBI policy | Good |
| 5 | Error message display | Server internal error is not communicated to the user screen as text. | Good |
| 6 | Backup file/log exposure | The actual file system path is isolated in an untraceable manner. | Good |
| 7 | File Upload Vulnerability | Upload after blocking the influx of malicious files in conjunction with CDR technology. | Good |
| 8 | File Download Vulnerability | Hiding Actual Server Path and Blocking Path Traversal | Good |
| 9 | Admin Page Exposure | Block access to management page paths outside of authenticated users. | Good |
| 10 | Vulnerable Information Exposure | Source code comments, metadata, etc. are hidden by pixel streaming. | Good |
| 11 | Parameter Tampering | Isolate user URL manipulation so that it does not affect the server. | Good |
| 12 | Insufficient authentication | Strong access control through integration of two-factor authentication (MFA) at the RBI stage | Good |
| 13 | Insufficient session management | Application of one-time/isolation session structure that makes session hijacking impossible | Good |
| 14 | Insufficient Authorization (ACL) | Fine-grained control of user-specific accessible resources in RBI policies | Good |
| 15 | Cookie Tampering/Vulnerability | Does not store actual service cookies on the user's local device. | Good |
| 16 | HTTP Header Tampering | Reconstructing and forwarding request/response headers from the RBI server | Good |
| 17 | Untrusted external input | Zero Trust Model for Primary Processing of All Inputs in a Container | Good |
| 18 | Weak Encryption Algorithm | Even on older version servers, RBI performs the latest TLS communication instead (SSL Offloading) | Good |
| 19 | Redirection Vulnerability | Policy Blocking of Forced Redirection to Unapproved External Domains | Good |
| 20 | Server-Side Request Forgery (SSRF) | Detect/Block Internal Network Access Attempts on Web Server at Isolation Layer | Good |
| 21 | Insert OS command | Since it does not communicate directly with the web server OS, command injection is not possible. | Good |
2. Financial Institution Internet Banking
High security level requirement
- Obligation to Comply with Electronic Financial Supervision Regulations
- Mandatory Regular Security Review (at least once a year)
- Immediate action required upon discovery of vulnerabilities
- Liability for Compensation in Financial Incidents
Legacy System
- Operating systems for over 10 years
- Legacy Technology Stack
- Web Standards Non-compliance
- Security vulnerabilities persist
SHIELD Web Application Effects
- Safely connecting external web resources to internal servers even in a network-separated environment
- Disabling financial fraud attempts through script manipulation in user environments in an isolated environment
- Controlling personal information leakage at the pixel level to respond to electronic financial supervision regulations
3. Defense Industry and National Defense
Protection Requirements for National Core Technologies and Military Secrets
- Intelligent Persistent Threats (APT) and Targeted Attacks by State-Sponsored Hacker Groups
- Operating many unpatched special OS and legacy web applications
- Exposing web server infrastructure information itself is a security threat.
SHIELD Web Application Effects
- Completely hide the web server's IP, OS information, and middleware environment from external sources to eliminate the attack surface.
- Structurally zeroing out the infiltration possibilities of hacker groups
- Safely maintain legacy systems without replacement
4. Private Enterprises — Business Continuity and Brand Protection
Risk of service interruption and loss of trust due to attacks
- DDoS and vulnerability attack attempts
- Damage to corporate image due to customer information leakage
- Revenue Loss Due to Service Interruption
SHIELD Web Application Effects
- The risk of service interruption is significantly reduced as attack attempts do not directly reach the server.
- Preventing customer information leakage incidents to maintain brand trust.
- Immediate application without separate equipment in a SaaS manner, minimizing operational burden.
5. Protection of Legacy Web Services
Unable to improve due to project termination
- Web service older than 5 years
- End of Contract with Outsourcing Development Company
- Insufficient source code handover
- Legacy technologies (ASP, JSP, PHP, etc.)
- Transfer of technology not possible due to the departure of the person in charge.
Security Inspection Results
- Session Management Vulnerability
- Unapplied Encryption
- Unnecessary port open
SHIELD Web Application Effects
- Immediate protection without modifying source code or server
- Even outdated OS or middleware that are no longer patched can maintain communication security by having the RBI layer perform the latest TLS communication instead.
- Safe maintenance possible without replacing the legacy system
6. Protecting Web API
Risk of Attacks Due to Exposed APIs
- Understanding WebAPI structure with browser developer tools
- Attempt to bypass permissions through parameter manipulation
- Unauthorized Data Access
- Fraudulent payment, point manipulation
Effect
- WebAPI Structure Non-exposure: Unable to verify in developer tools
- Parameter Manipulation Block: Direct API call not possible
- Unauthorized Access Blocked: Blocking External Access with a Firewall
- Attack Log Collection: Anomaly Detection
7. E-commerce Site
Commerce that is easy to target
- Attempt to steal payment information
- Price manipulation, inventory manipulation
- Coupon Fraudulent Use
- Point Manipulation
Effect
- Blocking Fraudulent Transactions: Price/Quantity manipulation not allowed
- API Protection: Coupon cannot be used multiple times
- Safe Shopping: Enhancing Customer Trust
- Personal Information Protection: Payment Information Security
8. Hospital Reservation System
Medical services with a lot of personal information
- Patient Personal Information (Sensitive Information)
- Medical information such as medical records
- Obligation to Comply with the Medical Law and the Personal Information Protection Act
Security Threats
- Unauthorized attempt to access patient information
- Access to Other's Medical Records
- Reservation Information Manipulation
Compliance
- Personal Information Safety Measures: Encryption, Access Logs, Unauthorized Access Prevention
- Compliance with Medical Law: Patient information protection, unauthorized access prevention
- Regular Inspection Passed: Security Vulnerability Improvement
9. University Bachelor's System
Various users access
- student, professor, staff
- Grades, course registration, and other sensitive information
- Traffic Surge During Specific Periods (Course Registration Period)
Security Issues
Grade Inquiry:
- Unauthorized inquiry of others' grades
- Attempt to alter grades
Course Registration:
- Use of automatic macros
- Server load attack
Effect
- Grade Protection: Unauthorized Access/Modification Prevention
- Fairness of Course Registration: Macro Blocking
- Personal Information Protection: Student Information Protection
10. Partner Web Portal (B2B)
Portal for External Partners
- dozens to hundreds of partners
- Order, Contract, Payment Information Processing
- Uncertain security level of partner company PCs
Security Concerns
- Information leakage due to malware infection on partner company PCs
- Unauthorized copying of internal information
- Difficulty in managing access logs
Effect
- Malware Blocking: Independent of the security level of partner PCs
- Information Leakage Prevention: Screen only, original data access not available