Session 7
보안 6대 도메인

Day 2 · 오후 후반 (약 180~200분)

네트워크 · 엔드포인트 · 데이터 · 최신 트랜드 · 거버넌스/인증 · 클라우드

강사 박수현 · 🚀 젠아이랩스(GenAI Labs)

🎨 이미지 프롬프트: "Editorial wide cover illustration on dark navy background — a giant hexagonal wheel divided into six glowing segments labeled in Korean: '네트워크' (with tiny sub-labels: Fortinet FortiGate 600F · Palo Alto PA-5450 · F5 Advanced WAF i7800), '엔드포인트' (CrowdStrike Falcon Insight XDR · Microsoft Defender for Endpoint · 안랩 V3 EDR Plus), '데이터' (마크애니 DocuMaker DRM · 신시웨이 Petra DBSafer · Forcepoint DLP), '최신 트랜드' (Zero Trust NIST SP 800-207 · SASE · Palo Alto Cortex XSOAR), '거버넌스·인증' (ISO/IEC 27001:2022 · ISMS-P · CC EAL4+ · KCMVP), '클라우드' (Wiz CNAPP · Palo Alto Prisma Cloud · Netskope CASB); each segment has a small representative icon (rackmount firewall with red logo, laptop with shield + Falcon orange chevron, locked database + key, AI brain with shield, certificate badge with wax seal, cloud with padlock + Kubernetes wheel). Behind the wheel a stylized SOC operations room with three analysts at multi-monitor desks tracking world-map threat feeds (red dots over Russia/CN/NK suggesting APT29·APT41·Lazarus·Kimsuky), Splunk Enterprise Security 7.x Glass Tables and IBM QRadar Offense Manager screens reflected on the wall, blue-purple holographic dashboards floating above; teal #00b894 and purple #6c5ce7 accents, cinematic glow, 16:9, technical editorial style"

왜 보안인가 — 국내 개인정보 유출 3선

Session 7 — 회차 메타데이터

강의 지도 — 6 PART + 운영 보너스

보안 6대 도메인 — 한눈에 보는 전체 지도

🎨 이미지 프롬프트: "Editorial circular wheel infographic on dark navy background — a central hub labeled '보안 6대 도메인' glowing in teal, with six radial segments equally divided: '① 네트워크 보안' (rackmount firewall icon with red logo accent), '② 엔드포인트 보안' (laptop+shield icon with orange Falcon-style chevron), '③ 데이터 보안' (locked database barrel icon with key), '④ 최신 트랜드' (AI brain + shield icon), '⑤ 거버넌스·인증' (certificate badge icon with red wax seal), '⑥ 클라우드 보안' (cloud + padlock icon with Kubernetes helm wheel overlay); thin teal lines connect adjacent segments suggesting overlap; each segment has 3~4 sub-keywords in tiny text — ① 'NGFW Fortinet FortiGate 600F · WAF F5 i7800 · IPS 윈스 Sniper V40 · Anti-DDoS Radware DefensePro x4420', ② 'EDR CrowdStrike Falcon · NAC Cisco ISE 3.3 · SIEM Splunk ES 7.x · SOAR Cortex XSOAR', ③ 'DRM 마크애니 DocuMaker · DLP 소만사 Mail-i · DB보안 신시웨이 Petra DBSafer · PKI Thales Luna 7', ④ 'ZTNA NIST SP 800-207 · SASE Cato·Netskope · SOAR Splunk Phantom · XDR Palo Alto Cortex', ⑤ 'ISMS-P · ISO/IEC 27001:2022 · CC EAL4+ · NIST CSF 2.0 · KCMVP 검증필', ⑥ 'CASB Netskope · CSPM Wiz · CNAPP Prisma Cloud · CWPP Lacework'; clean editorial wheel diagram, teal #00b894 and purple #6c5ce7 accents, 16:9"

보안 6대 도메인 — 한눈에 보는 전체 지도

정보보안의 3대 원칙(CIA) — 다시 확인

6대 도메인의 모든 솔루션은 CIA 중 어떤 축을 지키는가로 분류할 수 있다.

PART A

네트워크 보안 — 경계와 내부 트래픽의 통제

Firewall 4세대 · NGFW · UTM · WAF · IPS · Anti-DDoS · VPN

Firewall 4세대 진화 — Stateless → NGFW

🎨 이미지 프롬프트: "Editorial horizontal timeline illustration on dark navy background — four evolutionary stages of firewall drawn left to right as connected boxes: '1세대 Packet Filter (Stateless)' with a simple IP/Port filter icon labeled '~1990' and sub-text 'Cisco ACL · ipfw · 5-tuple (src/dst IP·port·proto)', '2세대 Stateful Inspection' with a connection table icon labeled '~1995' and sub-text 'Check Point FireWall-1 · Cisco PIX 515 · TCP state table (ESTABLISHED/SYN_SENT/...)', '3세대 Application Proxy' with a proxy gateway icon labeled '~2000' and sub-text 'TIS Gauntlet · WinGate · Layer-7 HTTP/SMTP/FTP 프록시', '4세대 NGFW' with a multi-feature stacked icon (App-ID, User-ID, IPS, SSL Decrypt, AV, URL Filter) labeled '2010~' and sub-text 'Palo Alto PA-5450 · Fortinet FortiGate 600F · Check Point Quantum 6000 · Cisco Firepower 4145 · 시큐아이 BS5800'; each stage shows its key feature in 2-3 lines of tiny text with throughput examples (e.g. '~1Gbps → ~10Gbps → ~40Gbps → 100Gbps+'); thin teal arrows showing evolution with small CVE/incident notes between them ('Code Red 2001', 'SQL Slammer 2003'); clean editorial timeline diagram, teal #00b894 and purple #6c5ce7 accents, 16:9"

신규 도입은 4세대 NGFW가 표준 — 1·2세대는 백본·내부 분리용으로만 잔존.

Firewall 4세대 진화 — Stateless → NGFW

Firewall 유형 비교 — 언제 무엇을 쓰나

NGFW — 7대 핵심 기능

🎨 이미지 프롬프트: "Editorial product-shot illustration on dark navy background — six rackmount firewall appliances arranged in two rows like a product lineup poster: top row 'Fortinet FortiGate 600F' (dark gray 2U with red FortiGate logo + front LCD panel + 16 SFP+ ports + 4 QSFP28 100G ports + dual PSU LEDs, caption '36 Gbps NGFW · ASIC NP7+CP9'), 'Palo Alto Networks PA-5450' (silver 2U with red PA triangle logo + 8 RJ45 + 4 SFP+ + 2 QSFP28 ports + management LCD, caption '72 Gbps App-ID · 5세대 NGFW'), 'Cisco Firepower 4145' (dark blue 2U chassis with Cisco logo + Snort 3 + Talos badge + dual PSU, caption '45 Gbps Threat Inspection'); bottom row 'Check Point Quantum 6000' (black 1U with Check Point chain logo + 10 RJ45 + 2 SFP+ ports, caption 'R81.20 · 28 Gbps'), 'SonicWall NSa 6700' (red 1U with SonicWall shield logo, caption 'RTDMI · 36 Gbps'), '시큐아이 BS5800' (white-gray 2U Korean NGFW with SECUI ribbon logo + CC EAL4+ KCMVP 검증필 시일 sticker on side, caption '국내 NGFW · 시큐아이'); each appliance shown front-face with small caption label below indicating throughput and form-factor; clean editorial product photography style, teal #00b894 and purple #6c5ce7 background accents, 16:9"

🎨 이미지 프롬프트: "Editorial dark-theme console mockup illustration on dark navy background — Fortinet FortiManager 7.4 centralized policy console: top header 'FortiManager 7.4.2 · ADOM: prod-korea · admin@fmg-01', breadcrumb 'Policy & Objects → IPv4 Policy', left navigation tree with 'Device Manager (24 devices)', 'Policy & Objects', 'AP Manager', 'FortiGuard'; main pane shows a tabular policy list with columns Seq/Name/Source/Destination/Service/Action/Profile/Log (sample rows: '1 allow_dmz_web · any · 10.10.0.0/24 · HTTPS · ACCEPT · NGFW_strict (IPS+AV+WebFilter+SSL-Insp) · All', '2 allow_corp_out · 10.20.0.0/16 · all · web-services · ACCEPT · NGFW_balanced · UTM', '3 BLOCK_RU_CN · geoip:RU,CN,KP · any · ALL · DENY · — · All' in red, '4 allow_branch_vpn · IPsec-tunnel-branch · 10.30.0.0/16 · all · ACCEPT · default · Sec'); right side panel shows the matching CLI: 'FGT600F # show full-configuration firewall policy 1'; bottom pane shows policy install status 'fw-edge-01 (FortiGate 600F): Installed · fw-edge-02 (FortiGate 600F): Pending · fw-dc-01 (FortiGate 3500F): Installed'; status bar with green health dots; clean editorial UI mockup style, teal #00b894 accents, 16:9"

WAF — 웹 응용 전용 방화벽

🎨 이미지 프롬프트: "Editorial split illustration on dark navy background — left half labeled 'On-Prem WAF Appliance' showing a 2U F5 BIG-IP Advanced WAF i7800 rackmount with red F-shaped logo, front LCD, 8 SFP28 + 2 QSFP28 ports, dual PSU LEDs (caption 'OWASP Top 10 · L7 DoS · Bot Defense'), mounted in a server rack with a 1U Penta WAPPLES SE-5000 unit below it (white front bezel + Korean 펜타시큐리티 ribbon, caption 'COCEP™ 엔진 · KCMVP 검증필') and an Imperva SecureSphere X8500 2U at the bottom (dark gray with red Imperva logo); right half labeled 'Cloudflare WAF Dashboard' showing a browser dashboard with rule sets panel ('Cloudflare Managed Ruleset', 'OWASP Core Ruleset 4.0', 'Custom Rules · 18 active', 'Rate Limit · 100 req/min/IP'), a world map with red dots for blocked requests concentrated over RU/CN/BR, top counter '4.2M requests blocked / 24h · Top attack: SQLi 38% / XSS 22% / Bot 19%', a stacked area chart of attack types over 24h, side panel 'Top blocked URI: /wp-login.php · /admin · /.env'; clean editorial style with teal #00b894 and purple #6c5ce7 accents, 16:9"

WAF — 웹 응용 전용 방화벽

UTM — Unified Threat Management

UTM은 AIO(All-In-One)의 편리함과 단일 장애점의 트레이드오프 — 지점·소규모에 적합.

IPS vs IDS — 탐지냐 차단이냐

🎨 이미지 프롬프트: "Editorial split-screen comparison illustration on dark navy background — left half labeled 'IDS (Tap/SPAN Mode)' showing a core switch with a SPAN port mirror line to a Gigamon network tap, an IDS sensor box drawn off-path labeled 'Snort 3.1 · Suricata 7.0' with a watching eye icon, an alarm bell ringing 'Alert only · syslog → SIEM (Splunk ES 7.x)', side note 'No packet drop · no blocking · 우회 불가 zero risk'; right half labeled 'IPS (Inline Mode)' showing the same network but with the IPS device placed in-line between edge router and core switch, drawn as a gate with a stop sign labeled 'Cisco Firepower NGIPS · 윈스 Sniper IPS V40 · SECUI MFI', blocking malicious red packets (with tags 'CVE-2024-XXXX exploit · SQL injection · Mirai bot') while green ones pass through, side note 'Latency ~수십 μs · fail-open bypass switch · 정책 오탐 시 서비스 영향'; thin teal connector lines, clean isometric perspective, teal #00b894 and purple #6c5ce7 accents, 16:9, technical illustration"

IPS vs IDS — 탐지냐 차단이냐

Anti-DDoS — 대량 트래픽 차단

APT — Advanced Persistent Threat

DPI · NDR — 심층 패킷 검사와 네트워크 탐지

🎨 이미지 프롬프트: "Editorial terminal screenshot illustration on dark navy background — three stacked dark terminal windows with title bars: top window titled '$ tcpdump -i eth0 -nn -s0 -w /tmp/cap.pcap \"tcp port 443\" &' showing tcpdump capture summary 'listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes ... 18472 packets captured · 18512 received · 0 dropped'; middle wide window titled '$ tshark -r /tmp/cap.pcap -Y \"http.request.method == POST\"' showing color-coded packet output with columns No./Time/Source/Destination/Protocol/Info: rows like '1247 12.4231 10.20.1.55 → 10.10.0.80 HTTP POST /api/login HTTP/1.1', '1248 12.4289 10.10.0.80 → 10.20.1.55 HTTP HTTP/1.1 200 OK 1.2k', '1493 14.8821 192.0.2.66 → 10.10.0.80 HTTP POST /admin/exec' with red background labeled 'suspicious · MITRE ATT&CK T1059 Command and Scripting Interpreter'; bottom terminal titled '$ openssl s_client -connect example.com:443 -showcerts -tls1_3' showing TLS 1.3 handshake output with Certificate chain (0: CN=.example.com, 1: CN=DigiCert TLS RSA SHA256 2020 CA1, 2: CN=DigiCert Global Root G2), SAN: DNS:example.com DNS:.example.com, NotBefore 2025-01-15 NotAfter 2027-01-14, 'SSL handshake has read 5328 bytes, written 423 bytes · cipher TLS_AES_256_GCM_SHA384 · Server Temp Key X25519, 253 bits · Verify return code: 0 (ok)'; clean editorial terminal style, teal #00b894 accents, 16:9"

DPI · NDR — 심층 패킷 검사와 네트워크 탐지

VPN — 네 가지 표준 + 신흥 두 가지

🎨 이미지 프롬프트: "Editorial side-by-side comparison illustration on dark navy background — left half labeled 'IPSec VPN (Site-to-Site)' showing two corporate buildings (본사 HQ Seoul · 지사 Branch Busan) connected by a thick encrypted tunnel labeled with 'IKEv2 (UDP 500/4500) · ESP (Encapsulating Security Payload) · AH (Authentication Header) · Tunnel Mode AES-256-GCM · PSK or X.509 인증서', endpoints drawn as 'Cisco ASA 5555-X' and 'Fortinet FortiGate IPsec' rackmount appliances with red logos, side note 'L3 전구간 암호화 · 항상 연결 · 분기·DC 전용'; right half labeled 'SSL VPN (Remote Access)' showing a laptop user (재택근무자) connecting via browser HTTPS (TLS 1.3) to a 'Palo Alto GlobalProtect Portal · Fortinet FortiClient EMS · Cisco AnyConnect Secure Mobility' VPN gateway in front of the corporate network, with sub-text 'TCP 443 · 브라우저만으로 접속 · split-tunnel 옵션 · MFA YubiKey/SMS OTP'; both halves use clean isometric perspective with teal #00b894 and purple #6c5ce7 accents, padlock icons on the tunnels, 16:9, technical illustration"

VPN — 네 가지 표준 + 신흥 두 가지

VPN 결정 매트릭스 — 언제 어느 것?

Part A 정리 — 네트워크 보안 9가지

PART B

엔드포인트 보안 — PC·서버·모바일의 마지막 방어선

AV → EPP → EDR → XDR → MDR · NAC · PMS · SIEM · SecureOS

엔드포인트 보안 5세대 진화

1세대 AV는 더 이상 충분하지 않다 — EDR/XDR + MDR이 2026 신규 도입 표준.

EDR — 동작 원리와 분석 흐름

🎨 이미지 프롬프트: "Editorial timeline illustration on dark navy background — horizontal time axis (T-30min → T-0 → T+5min) showing EDR endpoint event streams over time, four swim-lanes labeled 'Process (procmon)', 'File (NTFS USN journal)', 'Network (Sysmon EID 3)', 'Registry (HKLM/HKCU)'; small icons (gear, document, network arrow, key) appear along each lane as events with timestamps (sample: '10:14:22 winword.exe spawned', '10:14:23 ~$invoice.docm written to %TEMP%', '10:14:25 powershell.exe -enc base64...', '10:14:26 outbound 443 → 185.220.x.x (Tor exit)', '10:14:27 HKCU\...\Run added persistence key'); one red exclamation cluster in the middle highlighted with a circular zoom indicator labeled '이상행위 패턴 · CrowdStrike Falcon Insight XDR detection · Severity: High', a thin teal connecting line to a side panel showing 'IoC Match: SHA256 a3f5... · IP 185.220.101.42 (Tor) · ML Score 0.94 · MITRE ATT&CK TTPs: T1566.001 Spearphishing Attachment → T1059.001 PowerShell → T1547.001 Registry Run Keys → T1041 Exfiltration over C2 · Suspected actor: LockBit affiliate / APT29 Cozy Bear pattern' analysis bullets; clean editorial timeline visualization, teal #00b894 and purple #6c5ce7 accents, 16:9"

EDR — 동작 원리와 분석 흐름

XDR — Extended Detection & Response

PMS — Patch Management System

공급망 공격 — Supply Chain Attack

NAC — Network Access Control

ESM vs SIEM — 통합 보안 관제의 두 세대

🎨 이미지 프롬프트: "Editorial side-by-side console mockup illustration on dark navy background — left half labeled 'Splunk Enterprise Security 7.x · Glass Tables / Threat Topology' showing a dark-theme SOC dashboard with top notable-events count '47 OPEN / 12 HIGH · Risk Score 893', a horizontal 24h time slider, four correlated widgets: 'Notable Events by Domain (donut: Endpoint 18 / Network 14 / Identity 9 / Access 6)', 'Failed Logins spike (line: 14:22 spike to 1,847 attempts)', 'DNS Exfiltration pattern (table with src/dest/bytes: 10.20.1.55 → dns.malicious.ru 4.2MB)', 'MITRE ATT&CK Heatmap (Tactic x Technique grid with red cells highlighting T1059·T1486·T1041·T1566)', sample SPL query bar 'index=security sourcetype=stream:dns | stats sum(bytes) by query', Splunk green chevron logo top-left; right half labeled 'IBM QRadar SIEM 7.5 · Offense Manager' showing the classic blue QRadar console with 'Offenses' list (ID 18472 Magnitude 8 'Botnet C2 communication · src 10.20.1.55 · dst 185.220.101.42 · 142 events', ID 18415 Magnitude 6 'Brute force - SSH · 1,247 failed logons · src 203.0.113.x', ID 18398 Magnitude 9 'Data Exfiltration suspected · T1041 · 4.2 GB out · 야간'), magnitude bar gauges 1-10, a QFlow network widget at bottom with src/dest/bytes columns, AQL query bar 'SELECT sourceip, SUM(sourcebytes) FROM flows ...', IBM 8-bar logo top-left; thin vertical divider; clean editorial UI mockup style, teal #00b894 and purple #6c5ce7 accents, 16:9"

🎨 이미지 프롬프트: "Editorial terminal screenshot illustration on dark navy background — three side-by-side terminal windows each with a dark gray title bar, monospace text and faint teal command prompts: left window titled '[root@rhel9 ~]# iptables -L -n -v --line-numbers' showing output 'Chain INPUT (policy DROP 0 packets, 0 bytes)' with columns num/pkts/bytes/target/prot/opt/in/out/source/destination, sample rules '1 1842 142K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0', '2 8421 1.2M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22', '3 142 18K REJECT all -- * * 192.0.2.0/24 0.0.0.0/0 reject-with icmp-port-unreachable', then 'Chain FORWARD' and 'Chain OUTPUT'; middle window titled '[root@ubuntu24 ~]# nft list ruleset' nftables output with 'table inet filter { chain input { type filter hook input priority filter; policy drop; ct state established,related accept; iifname \"lo\" accept; tcp dport 22 accept; icmp type echo-request limit rate 5/second accept; } chain forward { ... } chain output { ... } }'; right window titled '[admin@centos9 ~]$ sudo firewall-cmd --list-all --zone=public' showing 'public (active) target: default · icmp-block-inversion: no · interfaces: eth0 · sources: · services: ssh dhcpv6-client cockpit · ports: 8080/tcp 443/tcp · protocols: · forward: yes · masquerade: no · forward-ports: · source-ports: · icmp-blocks: · rich rules: rule family=\"ipv4\" source address=\"10.20.0.0/16\" accept'; below the three windows a small caption '리눅스 호스트 방화벽 CLI · iptables → nftables → firewalld'; clean editorial terminal style, teal #00b894 accents, 16:9"

ESM vs SIEM — 통합 보안 관제의 두 세대

Part B 정리 — 엔드포인트 보안 8가지

PART C

데이터 보안 — 정보 자산 자체를 지키는 기술

DRM · DLP · DB보안 · TDE · PKI · FIDO · KMS/HSM

DRM — Digital Rights Management

DLP — Data Loss Prevention

DB 보안 3종 — 접근·감사·암호화

FIDO · MFA — 비밀번호 없는 인증

🎨 이미지 프롬프트: "Editorial product flat-lay illustration on dark navy background — six physical authentication devices arranged in a row like a museum display: 'YubiKey 5C NFC' (small black USB-C key with golden touch ring, slim card form factor, label 'FIDO2 · WebAuthn · PIV · OTP'), 'YubiKey 5 NFC (USB-A)' (USB-A version with the touch sensor on the gold disc, label 'NFC tap to phone'), 'YubiKey 5 Bio (Fingerprint)' (black key with on-device fingerprint sensor, label 'biometric match-on-key'), 'Google Titan Security Key (USB-C)' (white rounded USB-C with Google G logo, label 'BLE + NFC · made by Feitian'), 'Feitian ePass FIDO2 NFC' (blue compact key with white side button, label 'CTAP2 · L1 Certified'), 'SafeNet eToken 5300' (black slim USB token with Thales logo, label 'PKI 인증서 저장 · 공인인증서 호환'); to the right of the row a biometric reader terminal 'Suprema BioStation 3' (white wall-mounted unit with green LED + fingerprint sensor + camera, label 'Face + Fingerprint · 출입통제'); below each device a tiny label with model name and FIDO2 / FIDO2.1 / Passkey badge plus 'FIDO Alliance L1 Certified' or 'L2 Certified' shield; each device with subtle soft shadow; clean editorial product photography style, teal #00b894 and purple #6c5ce7 background glow, 16:9"

FIDO · MFA — 비밀번호 없는 인증

PKI — Public Key Infrastructure

🎨 이미지 프롬프트: "Editorial flow diagram on dark navy background — vertical PKI certificate lifecycle showing four entities labeled in Korean: 'CA (Certificate Authority) · Microsoft AD CS / HashiCorp Vault PKI Engine 1.16 / DigiCert ICA' at top with a wax-seal stamp icon, 'RA (Registration Authority) · KISA · 한국정보인증' below with a form-and-clipboard icon, 'Subscriber 사용자 (서버/사람)' on the left with a person+laptop icon, 'Relying Party 검증자 (브라우저/서버)' on the right with a magnifying-glass icon; arrows show the flow with protocol labels: Subscriber→RA 'CSR 신청 (PKCS#10 · openssl req -new -key key.pem -out csr.pem)', RA→CA '신원 검증 (도메인 소유권 / 기업 등기부)', CA→Subscriber '인증서 발급 (X.509 v3 · SAN · Key Usage · 365일)', Subscriber→Relying Party 'TLS Handshake 시 Certificate 제시', Relying Party→CA 'CRL 다운로드 / OCSP Stapling 검증 (RFC 6066)'; a side panel shows '인증서 수명주기: ① 신청 CSR → ② 발급 (NotBefore/NotAfter) → ③ 배포 (PEM/DER/PFX) → ④ 사용 (TLS·코드서명·S/MIME) → ⑤ 갱신 (ACME automation) → ⑥ 폐기 (Revoke → CRL/OCSP)'; bottom note 'X.509 v3 필드: Version / Serial / Issuer DN / Validity / Subject DN / SubjectPublicKeyInfo / Extensions (SAN·Key Usage·EKU·Basic Constraints·CRL DP·AIA)'; clean editorial flow diagram, teal #00b894 and purple #6c5ce7 accents, 16:9 — CRITICAL: All visible text in this image MUST be in English only; replace all Korean labels with English equivalents (transliterate Korean proper nouns). Do NOT include any Korean characters as they will be garbled by the renderer."

🎨 이미지 프롬프트: "Editorial terminal-and-window illustration on dark navy background — left side shows a dark terminal running '$ openssl x509 -in cert.pem -noout -text' with monospace output displaying X.509 v3 Certificate fields: 'Certificate: Data: Version: 3 (0x2) · Serial Number: 04:3c:8b:1f:7a:e2:9d:55:a4:... · Signature Algorithm: sha256WithRSAEncryption · Issuer: C=US, O=DigiCert Inc, CN=DigiCert Global Root G2 · Validity: Not Before: Jan 15 00:00:00 2025 GMT, Not After: Jan 14 23:59:59 2027 GMT · Subject: C=KR, ST=Seoul, O=Example Corp, CN=.example.kr · Subject Public Key Info: RSA 2048 bit · X509v3 extensions: Basic Constraints: critical CA:FALSE · Key Usage: critical Digital Signature, Key Encipherment · Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication · Subject Alternative Name: DNS:example.kr, DNS:.example.kr · CRL Distribution Points: URI:http://crl3.digicert.com/... · Authority Information Access: OCSP URI:http://ocsp.digicert.com'; below it a second prompt '$ openssl s_client -connect example.kr:443 -servername example.kr' showing TLS handshake summary; right side shows the Microsoft 'Active Directory Certificate Services (AD CS) — Certification Authority' MMC console (Windows Server 2022) titled 'certsrv - [Certification Authority (Local)\corp-CA-01]', left tree (Revoked Certificates, Issued Certificates, Pending Requests, Failed Requests, Certificate Templates), right pane lists issued certs with columns Request ID/Requester Name/Binary Certificate/Serial Number/Certificate Effective Date/Certificate Expiration Date/Certificate Template (rows like '1247 · CORP\web01$ · — · 1a2b... · 2025-03-12 · 2027-03-12 · WebServer'); a teal arrow between them labeled 'CLI ↔ AD CS GUI · 동일 X.509 인증서를 두 시각에서'; clean editorial style, teal #00b894 and purple #6c5ce7 accents, 16:9 — CRITICAL: All visible text in this image MUST be in English only; replace all Korean labels with English equivalents (transliterate Korean proper nouns like company/place names). Do NOT include any Korean characters as they will be garbled by the renderer."

PKI — Public Key Infrastructure

전자서명 vs 전자봉투 — PKI 두 가지 활용

KMS · HSM — 키 관리의 인프라

🎨 이미지 프롬프트: "Editorial product-shot illustration on dark navy background — three Hardware Security Modules displayed as a museum lineup: left 'Thales Luna Network HSM 7 (Model A790)' (silver-blue 1U rackmount with front LCD, PED PIN pad port, smart-card reader slot for cloning domain key, slim form factor, caption 'FIPS 140-3 Level 3 · CC EAL4+ · 20,000 RSA-2048 signs/sec'), center 'Entrust nShield Connect XC (High)' (dark gray 1U with the nShield trefoil logo, smart-card slot for Operator Card Set quorum (k-of-n), dual hot-swap PSU LEDs, caption 'FIPS 140-2 Level 3 · CodeSafe · 8,500 ECC P-256 ops/sec'), right 'Utimaco SecurityServer Se Gen2' (black 2U with red Utimaco accent strip, front PIN pad and SmartCard reader, caption 'FIPS 140-2 Level 3 · BSI eIDAS QSCD · German engineering'); each appliance shown front-face with FIPS 140-3 Level 3 tamper-evident holographic seal sticker visible, KCMVP 검증필 sticker on the Korean-deployed unit, and a CC EAL4+ badge; behind them a faint AD CS / HashiCorp Vault PKI Engine integration diagram showing KMIP/PKCS#11 protocols; tiny caption labels below each unit indicating FIPS level and throughput; clean editorial product photography style, teal #00b894 and purple #6c5ce7 background glow, 16:9"

KMS · HSM — 키 관리의 인프라

Part C 정리 — 데이터 보안 8가지

PART D

최신 보안 트랜드 — Zero-Trust 시대

CDR · SOAR · SASE · SDP · ZTNA · Zero-Trust · MITRE ATT&CK · TI · LLM 보안

CDR — Content Disarm & Reconstruction

SOAR — Security Orchestration, Automation & Response

SASE — Secure Access Service Edge

🎨 이미지 프롬프트: "Editorial conceptual diagram on dark navy background — center labeled 'SASE Cloud Edge · Gartner SASE Framework (2019~) · Cato Networks · Zscaler ZIA/ZPA · Netskope Intelligent SSE · Cisco Umbrella · Palo Alto Prisma Access' as a glowing teal cloud icon with global PoP map markers (Seoul·Tokyo·Singapore·Frankfurt·Virginia); two inputs from the left: 'SD-WAN (Cisco Viptela · VMware VeloCloud · Fortinet Secure SD-WAN)' (network branches with optimized routing arrows showing dynamic path selection) and from below: 'Security Stack (FWaaS Fortinet · SWG Zscaler · CASB Netskope · ZTNA NIST SP 800-207 · DLP Forcepoint · RBI Remote Browser Isolation)' as stacked icons; outputs to the right go to multiple destinations: 'Users (Remote 재택·모바일)', 'Branches (지사·매장)', 'SaaS Apps (Microsoft 365 · Salesforce · ServiceNow · Google Workspace)', 'Data Center (On-prem)', 'Public Cloud (AWS·Azure·GCP)'; thin teal connecting lines show all paths flow through the SASE cloud edge with inline inspection labels 'TLS Decrypt · Identity-aware · Continuous Verification'; clean editorial conceptual diagram, teal #00b894 and purple #6c5ce7 accents, 16:9, technical illustration"

SASE — Secure Access Service Edge

SDP · ZTNA — VPN의 대체

Zero-Trust — NIST SP 800-207 5대 축

🎨 이미지 프롬프트: "Editorial pentagonal diagram on dark navy background — based on CISA Zero Trust Maturity Model 2.0 / NIST SP 800-207, five glowing nodes arranged in a pentagon, each labeled in Korean with sub-text: 'Identity 정체성 (Okta · Azure AD · FIDO2 YubiKey · MFA)', 'Device 디바이스 (CrowdStrike Falcon Insight · Intune compliance · TPM 2.0 attestation)', 'Network 네트워크 (Microsegmentation · ZTNA Zscaler ZPA · SDP)', 'Application/Workload 응용 (CWPP Prisma Cloud · Service Mesh Istio mTLS · WAF)', 'Data 데이터 (DLP Forcepoint · DRM 마크애니 · 분류 라벨링 · 암호화 at-rest/in-transit)'; in the center the slogan 'Never Trust, Always Verify · NIST SP 800-207' in teal glow with a small circular 'Policy Engine (PE) + Policy Administrator (PA) + Policy Enforcement Point (PEP)' core; thin teal lines connect each node to the center and to adjacent nodes forming a star pattern; each node has a small icon (user with passkey, laptop with chip, network mesh, app cube, data lock); around the pentagon a faint outer ring labeled 'Visibility & Analytics · Automation & Orchestration · Governance'; clean editorial pentagon visualization, teal #00b894 and purple #6c5ce7 accents, 16:9, technical illustration"

Zero-Trust — NIST SP 800-207 5대 축

MITRE ATT&CK — 공격자의 TTPs 카탈로그

Threat Intelligence — 위협 정보의 활용

AI·LLM 보안 — 2026년 신흥 도메인

Part D 정리 — 최신 보안 9가지

PART E

보안 거버넌스·인증 — 정책·법규·인증 체계

정책 4계층 · SOP 4종 · 국내·국제 인증 · 한국 법령

보안 정책 4계층 — Policy → Guideline

SOP 4종 — 운영 표준 절차

ISMS-P — 정보보호 및 개인정보보호 관리체계

KCMVP · CC인증 · 보안기능 확인서

국제 보안 인증 — 7대 표준

한국 보안·개인정보 법령 — 5대 축

인증 절차·비용·기간 — 현실 가이드

Part E 정리 — 거버넌스·인증 8가지

PART G

보안 운영 + 실전 — SOC · 점검 · TA의 결정

SOC Tier 1·2·3 · VA · PT · BAS · TA의 12대 결정

SOC — Security Operations Center 운영

🎨 이미지 프롬프트: "Editorial illustration of a modern 24/7 Security Operations Center on dark navy background — three concentric workstation tiers labeled in Korean: 'Tier 1 모니터링 (Alert Triage · MTTA < 15min)' (front row with 6 analysts at standard dashboards showing Splunk Enterprise Security 7.x Notable Events queue and IBM QRadar Offense list), 'Tier 2 분석 (Incident Response · MTTR < 4h)' (middle row with deeper investigation screens showing CrowdStrike Falcon Console process trees and Palo Alto Cortex XDR Causality Chains), 'Tier 3 헌팅·포렌식 (Threat Hunting · Malware RE)' (back row with advanced threat hunting screens showing MITRE ATT&CK Navigator heatmap, Volatility memory forensics output, YARA rule editor, Cortex XSOAR SOAR playbook canvas); large central video wall showing world map with glowing attack indicators (red dots over RU/CN/NK/IR), threat feed scrolls 'LockBit affiliate · BlackCat ransomware · Cl0p MOVEit · APT29 Cozy Bear · Lazarus · Kimsuky', SIEM dashboards with Risk Score gauges, and a Kill Chain 7-stage banner (Recon → Weaponize → Deliver → Exploit → Install → C2 → Actions on Objectives); side wall plaques showing ISO/IEC 27001:2022 certificate and ISMS-P 인증서; ambient blue-purple lighting, cinematic depth, teal #00b894 and purple #6c5ce7 accents, 16:9, technical editorial style"

SOC — Security Operations Center 운영

침해사고 대응 — KISA·NIST 표준 절차

TA의 보안 설계 — 12대 결정 카탈로그

시나리오 ① — 중견 제조 기업, 신규 보안 체계 구축

시나리오 ② — 공공기관 클라우드 전환

시나리오 ③ — AI 스타트업, 글로벌 진출

Session 7 학습 정리 — 5대 도메인 + 운영