Fault response support device and fault response support method

Abstract

To appropriately respond to vulnerability information, and efficiently execute measures in an object system or the like.SOLUTION: A malfunction addressing support device 100 comprises: a storage 101 that holds various types of attribute information related to object systems in which malfunctions are to be addressed; and an arithmetic unit 104 that extracts information on a configuration in which vulnerability is indicated, specifies object system candidates including the configuration, refers to the specifications of at least one of the quality and security of the object system candidates from the attribute information, specifies the object system with the specifications at a prescribed level as an important system, and sets a value to be updated according to vulnerability information in relation to the configuration to a definition file of a configuration management tool and thereby updates the important system.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a malfunction support device and a malfunction support method. [Background technology]

[0002] When some kind of defect or vulnerability is discovered in a system, the organization operating the system is notified of so-called vulnerability information by the system's vendor or the developer of its application, etc. System administrators who receive this notification will then specifically check whether the vulnerability relates to their company's systems and take appropriate action.

[0003] Therefore, in order to assist system personnel in the above-mentioned work, a technology has been proposed that provides a method for determining whether or not a software update is necessary, which can appropriately determine whether or not a software update is necessary while taking into account the reliability of the network system (see Patent Document 1).

[0004] This technology relates to a software update necessity determination method for a computer that determines whether software installed in equipment that constitutes a specified network system needs to be updated, the method comprising: a storage step in which the computer acquires information regarding the software installed in the equipment and information regarding vulnerabilities of the software and stores the information in a storage device; a selection step in which the computer selects software installed in the equipment that has vulnerabilities based on the information regarding the software installed in the equipment and the information regarding vulnerabilities of the software that are stored in the storage device; and a determination step in which the computer determines that software that has a history of use among the selected software needs to be updated. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2007-323349 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, the above-mentioned confirmation and other measures remain a heavy burden for system administrators. Vulnerability information notified daily by vendors and others contains a huge amount of information, and it is not easy to select the appropriate information from among it. In particular, the workload is likely to be even greater for systems that must be handled by the entire organization, such as large-scale systems that span multiple organizations, or systems that are delivered to other companies and managed by a vendor. In addition, the work tends to be highly dependent on the skills of the individual staff, and there are problems such as differences in the accuracy of the work between staff due to the high degree of personalization.

[0007] Therefore, an object of the present invention is to provide a technique for appropriately dealing with vulnerability information and enabling efficient implementation of countermeasures in target systems, etc. [Means for solving the problem]

[0008] The fault response support device of the present invention, which solves the above-mentioned problem, is characterized by including a storage device that holds various attribute information regarding each target system for fault response, a process of acquiring vulnerability information issued from a specified device and extracting information on a configuration for which a vulnerability is indicated in the vulnerability information, a process of identifying candidate target systems including the configuration based on the attribute information, a process of referencing at least one of the quality and security specifications of each of the candidate target systems from the attribute information and identifying those systems for which the specifications are at a pre-specified level as important systems, and a calculation device that executes a process of updating the important systems by setting values ​​to be updated in accordance with the vulnerability information regarding the configuration in the important systems in a definition file of a specified configuration management tool to update the important systems. In addition, the fault response support method of the present invention is characterized in that an information processing device stores various attribute information regarding each target system for fault response in a storage device, acquires vulnerability information issued from a specified device, and extracts information on a configuration for which a vulnerability is indicated in the vulnerability information, identifies candidate target systems including the configuration based on the attribute information, references at least one of the quality and security specifications of each of the candidate target systems from the attribute information, and identifies those systems for which the specifications are at a predetermined level as important systems, and sets values ​​to be updated regarding the configuration in the important systems in accordance with the vulnerability information in a definition file of a specified configuration management tool to update the important systems. Effect of the Invention

[0009] According to the present invention, it is possible to appropriately respond to vulnerability information and efficiently implement countermeasures in target systems, etc. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating a network configuration including a malfunction support device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of a malfunction support device according to the present embodiment. [Diagram 3] 4 is a diagram showing an example of the configuration of an attribute information DB in the present embodiment. FIG. [Figure 4] FIG. 2 is a diagram showing an example of a flow of a malfunction response support method in the present embodiment. [Diagram 5] FIG. 4 is a diagram showing an example of a screen in the present embodiment. [Figure 6] FIG. 11 is a diagram showing an example of definition of quality assurance management rank in the present embodiment. [Figure 7] FIG. 11 is a diagram illustrating an example of a definition of a security rank in the present embodiment. [Figure 8] FIG. 11 is a diagram showing an example of a flow of a malfunction response support device according to the present embodiment. [Figure 9A]11A and 11B are diagrams illustrating examples of results of similarity determination in the present embodiment. [Figure 9B] 11A and 11B are diagrams illustrating examples of results of similarity determination in the present embodiment. [Figure 9C] 11A and 11B are diagrams illustrating examples of results of similarity determination in the present embodiment. [Figure 9D] 11A and 11B are diagrams illustrating examples of results of similarity determination in the present embodiment. [Figure 9E] 11A and 11B are diagrams illustrating examples of results of similarity determination in the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] <Network configuration> Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Fig. 1 is a network configuration diagram including a malfunction support device 100 according to the present embodiment. The malfunction support device 100 shown in Fig. 1 is a computer that can appropriately respond to vulnerability information and efficiently implement countermeasures in a target system or the like.

[0012] 1, the malfunction response support device 100 of this embodiment is communicably connected to a user terminal 200, a vulnerability detection PF 300, a configuration management platform 400, a target system 500, and a work server 600 via an appropriate network 1 such as an in-house network or the Internet. Therefore, these may be collectively referred to as a malfunction response support system 10.

[0013] The malfunction response support device 100 of this embodiment can be said to be a service providing device that supports system personnel in an organization in dealing with vulnerability information related to a system being operated in the organization (regardless of whether it is the organization's own or another organization).

[0014] It is also possible to assume that the vulnerability detection PF 300 and the configuration management platform 400 themselves have the configuration and functions of the malfunction response support device 100 of this embodiment.

[0015] On the other hand, the user terminal 200 is a terminal used by the system staff when sending and receiving information to and from the malfunction response support device 100. Specifically, a smartphone, a tablet terminal, a personal computer, or the like can be envisioned.

[0016] In addition, the vulnerability detection PF300 is a platform that manages information on products and services, such as those being operated by the above-mentioned organization itself and those delivered to and being used by other organizations, and sends necessary notifications to system personnel, etc., when a vulnerability is detected.

[0017] Therefore, the vulnerability detection PF300 holds and manages at least information on the software configuration of the above-mentioned products, services, etc. In addition, the vulnerability detection PF300 regularly acquires alerts regarding vulnerabilities from vendors of the OS (Operating System) and various applications that run on the products, services, etc., identifies systems that include the products, services, etc. that are subject to the vulnerabilities, and issues necessary alerts.

[0018] The configuration management platform 400 is a platform that manages various information such as profiles, software, hardware, networks, security, maintenance, and the connections and associations between these in each system operated and managed by the organization.

[0019] Like the vulnerability detection PF 300, this configuration management infrastructure 400 also receives and acquires software and hardware defect information from various vendors and notifies system personnel as necessary.

[0020] In this embodiment, the vulnerability detection PF300 and the configuration management platform 400 are cited as entities that issue vulnerability information, but this is merely one example, and there is no limitation as long as the entities have the function of detecting, managing, and appropriately notifying vulnerabilities, etc. in the target system for fault response support.

[0021] The target system 500 is a system that may be the target of a malfunction response, and is a system that is operated or managed by the above-mentioned organization inside or outside the organization.

[0022] This target system 500 will be appropriately updated via a definition file 615 having setting values ​​to deal with vulnerabilities, etc., by a configuration management tool 610 provided on a specified work server 600 (or it may be the fault response support device 100 or the configuration management infrastructure 400).

[0023] The above definition file 615 can be, for example, a Playbook (registered trademark) in Ansible (registered trademark). Ansible (registered trademark) is a type of configuration management tool, and is a tool that installs middleware and updates configuration files in a host securely connected via a network. Also, Playbook (registered trademark) is a file that defines the state of the above host in such an Ansible (registered trademark) environment.

[0024] Of course, the application form of such definition file 615 and its execution tool (configuration management tool) is one example, and any tool that performs system configuration management via a network and a definition file therefor can be appropriately adopted and is not limited thereto. <Hardware configuration> The hardware configuration of the malfunction response support device 100 of this embodiment is as shown in FIG.

[0025] That is, the malfunction response support device 100 includes a storage device 101 , a memory 103 , a calculation device 104 , and a communication device 105 .

[0026] Of these, the storage device 101 is configured with an appropriate non-volatile storage element such as an SSD (Solid State Drive) or a hard disk drive.

[0027] The memory 103 is composed of a volatile storage element such as a RAM (Random Access Memory).

[0028] The arithmetic device 104 is a CPU (Central Processing Unit) that reads out the program 102 stored in the storage device 101 into the memory 103 and executes the program, controls the device itself, and performs various types of judgment, calculation, and control processing.

[0029] The communication device 105 is assumed to be a network interface card or the like that is connected to the network 1 and handles communication processing with the user terminal 200, the vulnerability detection PF 300, the configuration management platform 400, the target system 500, and the operation server 600, etc.

[0030] It is preferable that the failure response support device 100 further includes an input device for accepting key input or voice input from the user, and an output device such as a display for displaying the processed data.

[0031] In addition, in the storage device 101, in addition to the program 102 for implementing the functions required for the malfunction support device of this embodiment, at least an attribute information DB 125 is stored.

[0032] However, details will be given later regarding this attribute information DB 125. Also, instead of the operation server 600, the storage device 101 may be provided with a configuration management tool 610 and a definition file 615, which can be used at will. <Data structure example> Next, various information used by the malfunction response support device 100 of this embodiment will be described. An example of the attribute information DB 125 of this embodiment is shown in Fig. 3. The attribute information DB 125 of this embodiment is a database that stores various attribute information of a system that may be a target of malfunction response, that is, a target system 500.

[0033] This attribute information DB125 is a collection of records that link data such as the system's user, name, overview, model, OS, DB, middleware, quality assurance management rank, security rank, downtime classification, and allowable downtime, using the system's identification information as a key.

[0034] Among these, the quality assurance management rank is a quality specification established for the system, and is determined in advance by a knowledgeable person or by the user of the system from the viewpoint of the social importance of the system, the scope of impact and the level of damage in the event of a malfunction, etc. Specific rank values ​​can be, for example, AAA, AA, A, B, C, in descending order.

[0035] The security rank is a specification regarding security that is determined in advance by a knowledgeable person or the user of the system in question from the viewpoint of the network environment (whether or not it is publicly available) and whether or not there is confidential information in the system. The specific value of the rank can be assumed to be the same as the quality assurance management rank described above. <Flow example: Main flow> The actual procedure of the malfunction support method in this embodiment will be described below with reference to the drawings. The various operations corresponding to the malfunction support method described below are realized by a program that the malfunction support device 100 reads into a memory or the like and executes. This program is composed of codes for performing the various operations described below.

[0036] 4 is a diagram showing an example of a flow of a defect response support method according to the present embodiment. Here, it is assumed that the vulnerability detection PF 300 or the configuration management platform 400 publishes vulnerability information or defect information (see FIG. 5) on a network 1 such as the Internet, or issues it by email.

[0037] In this case, the malfunction response support device 100 acquires the above-mentioned vulnerability information or malfunction information (hereinafter collectively referred to as vulnerability information, the same below), and extracts information on the configuration in which the vulnerability is indicated in the vulnerability information (s10). Such configuration information includes identification information and attributes of the system, OS (version, etc.), program, or function designated as the target of the vulnerability, etc.

[0038] Next, the malfunction response support device 100 checks the information extracted in s10 against each record in the attribute information DB 125, and identifies candidate target systems that include the configuration (s11).

[0039] For example, values ​​such as the name, model, and OS of the target system indicated by the configuration information extracted in s10 are compared with the target items in each record of the attribute information DB 125, and records that match at least any of the target items, i.e., systems, are identified as target system candidates. The number of target system candidates identified here is not limited to one, and it is common for multiple ones to be identified.

[0040] Next, the fault response support device 100 refers to the target records in the attribute information DB 125 for at least one of the quality and security specifications of each of the candidate target systems identified in s11, and identifies those systems whose specifications are at a predefined level as important systems (s12).

[0041] In this embodiment, the quality specification corresponds to the value of the quality assurance management rank defined in the record of the attribute information DB 125. Also, the security specification corresponds to the value of the security rank defined in the record of the attribute information DB 125. An example of the definition of such quality assurance management rank is shown in Fig. 6, and an example of the definition of the security rank is shown in Fig. 7, but these are merely examples and may be arbitrarily defined by the business operator, the system administrator, etc.

[0042] In such cases, for example, systems with a quality assurance management rank value of "AA" or higher and / or a security rank value of "SR2" or "SR3" may be considered to be critical systems.

[0043] Next, the fault response support device 100 sets a value to be updated in accordance with the above-mentioned vulnerability information for the configuration of the critical system identified in s12 (the configuration in which a vulnerability was indicated in s10) in a definition file (Playbook (registered trademark)) of a specified configuration management tool (Ansible (registered trademark)) (s13).

[0044] Furthermore, the malfunction response support device 100 provides the definition file 615 generated in s13 to the work server 600, and causes the work server 600 to execute an important system update using the configuration management tool 610 (s14). For the update work itself using the definition file 615 in the configuration management tool 610, existing technology may be appropriately selected and used. <Flow example: Other> FIG. 8 is a diagram showing an example of the flow of a fault response support method in this embodiment, specifically, a flow diagram showing the flow of applying update processing to other systems similar to the above-mentioned important system, i.e., similar systems.

[0045] In this case, the fault response support device 100 determines (s20) whether there are matches for multiple attributes of the important systems identified in s12 described above for each of the target systems (which may include the target system candidates identified in s11) whose records are stored in the attribute information DB 125.

[0046] An example of such a determination result is shown in Figures 9A to 9C. The example shown in Figure 9A is a table showing the matching status for each item of records in the attribute information DB 125 between each of the target systems "A", "C", "D", and "E" and the important system. In the case of a match, a value of "1" is set.

[0047] The example shown in Fig. 9B is a table showing the matching status for each software between the target systems "A", "C", "D", and "E" and the critical systems. In the case of a match, the value "1" is set.

[0048] The example shown in Fig. 9C is a table showing the matching status for each hardware between the target systems "A", "C", "D", and "E" and the critical systems. In the case of a match, the value "1" is set.

[0049] Next, the failure response support device 100 counts up the determination results obtained by the above-mentioned determination, that is, the matching status (between the important system and the other target systems) regarding each attribute, for each target system (s21).

[0050] Such aggregation can be performed, for example, as shown in FIG. 9D, by adding up the matching values ​​for each of the attribute items, software, and hardware determined as described above for each of the target systems “A” to “E.”

[0051] For example, in the case of "System A," the total of attribute items is "6," the total of software is "4," and the total of hardware is "3," so the total is 6+4+3=13. In addition, by dividing "13" by the total number of items in each table in Figures 9A to 9C, which is "16," the matching rate is calculated as (13÷16)×100=81%.

[0052] Next, the failure response support device 100 identifies, among the target systems, those whose matching ratios meet a standard (e.g., 80% or more) based on the results of the counting in s21, i.e., each value of the matching ratio, as similar systems (s22). In the case illustrated in Fig. 9D, among the systems, systems "A" and "C" would be identified.

[0053] It is preferable that the fault response support device 100 determines, among the target systems identified in s22, those in which at least one of the specifications of the quality assurance management rank and the security rank is at a predefined level, as similar systems.

[0054] In that case, for example, for target systems with a quality assurance management rank of "B" or lower, or a security rank of "SR2" or "SR3," the "match rate" value in the record corresponding to the target system in Figure 9D can be reduced by, for example, 5%, thereby making it possible to exclude such target systems that can be considered to be of relatively low quality from the update targets and to target good quality, important systems as the update targets.

[0055] In the example shown in Figure 9E, system "A" has a quality assurance management rank of "B", so the initial matching rate of "81%" is reduced by 5% to "76%". Therefore, system "A" is excluded from the update target based on the criterion of a matching rate of "80%" or more.

[0056] Next, the failure response support device 100 sets a value to be updated in accordance with the vulnerability information in the configuration of the similar system determined in s22 in the definition file 615 of the configuration management tool 610, thereby updating the similar system (s23).

[0057] Although the best mode for carrying out the present invention has been specifically described above, the present invention is not limited to this, and various modifications are possible without departing from the spirit and scope of the present invention.

[0058] According to this embodiment, it is possible to appropriately respond to vulnerability information and efficiently implement countermeasures in target systems, etc.

[0059] The description of this specification makes at least the following clear: That is, in the malfunction response support device of this embodiment, the arithmetic device may execute a process of determining, for each of the target systems, a match for each of a plurality of predetermined attributes in the important system and tallying up the results of the determination for each of the target systems with respect to the plurality of predetermined attributes, a process of identifying, among the target systems, those whose degree of match satisfies a criterion based on the results of the tallying up, a process of determining, among the identified target systems, those whose specifications of at least one of the quality and security are at a predefined level as similar systems, and a process of updating the similar systems by setting, in a definition file of a predetermined configuration management tool, a value to be updated in accordance with the vulnerability information with respect to the configuration in the similar system.

[0060] This makes it possible to deal with vulnerabilities not only in important systems but also in similar systems of high importance, making it possible to deal with vulnerability information more accurately and to further efficiently implement countermeasures in the target systems.

[0061] In addition, in the defect response support method of this embodiment, the information processing device may perform the following processes: determining for each of the target systems whether there is a match for each of a plurality of specified attributes in the important system, and aggregating the results of the determination for each of the target systems for the plurality of specified attributes; identifying, based on the results of the aggregation, those of the target systems whose degree of match meets a standard; determining, from among the identified target systems, those whose specifications of at least one of the quality and security are at a predetermined level as similar systems; and updating the similar systems by setting values ​​to be updated in accordance with the vulnerability information regarding the configuration in the similar systems in a definition file of a specified configuration management tool. [Explanation of symbols]

[0062] 1 Network 10. Problem-solving support system 100 Malfunction response support device 101 Storage device 102 Programs 103 Memory 104 Arithmetic equipment 105 Communication equipment 125 Attribute information DB 200 User terminals 300 Vulnerability Detection PF 400 Configuration Management Infrastructure 500 Target Systems 600 working servers 610 Configuration Management Tools 615 Definition File

Claims

1. A storage device that stores various attribute information regarding each of the target systems for troubleshooting; a computing device that executes a process of acquiring vulnerability information issued from a specified device, extracting information on a configuration for which a vulnerability is indicated in the vulnerability information, a process of identifying candidate target systems including the configuration based on the attribute information, a process of referencing at least one of specifications of quality and security of each of the candidate target systems from the attribute information, and a process of identifying a system having the specification at a predefined level as an important system, and a process of updating the important system by setting a value to be updated in accordance with the vulnerability information with respect to the configuration in the important system in a definition file of a specified configuration management tool; A malfunction response support device comprising:

2. The computing device includes: a process of judging for each of the target systems whether there is a match for each of a plurality of predetermined attributes in the important system, and aggregating the results of the judgment for each of the target systems for the plurality of predetermined attributes; a process of identifying, based on the results of the aggregation, those of the target systems for which the degree of match satisfies a standard; a process of determining, from among the identified target systems, those of which at least one of the specifications of quality and security is at a predefined level as similar systems; and a process of updating the similar systems by setting, in a definition file of a predetermined configuration management tool, values ​​to be updated in accordance with the vulnerability information with respect to the configuration in the similar systems.

2. The malfunction support device according to claim 1.

3. An information processing device, Various attribute information regarding each target system for troubleshooting is stored in a storage device, a process of acquiring vulnerability information issued from a specified device, and extracting information on a configuration for which a vulnerability is indicated in the vulnerability information; a process of identifying candidate target systems including the configuration based on the attribute information; a process of referencing at least one of quality and security specifications of each of the candidate target systems from the attribute information, and identifying those systems for which the specifications are at a predefined level as important systems; and a process of updating the important systems by setting values ​​to be updated in accordance with the vulnerability information with respect to the configuration in the important systems in a definition file of a specified configuration management tool. A malfunction response support method comprising:

4. The information processing device, a process of judging for each of the target systems whether there is a match for each of a plurality of predetermined attributes in the important system, and aggregating the results of the judgment for each of the target systems for the plurality of predetermined attributes; a process of identifying, based on the results of the aggregation, those of the target systems whose degree of match satisfies a standard; a process of determining, from among the identified target systems, those of which specifications of at least one of the quality and security are at a predefined level as similar systems; and a process of updating the similar systems by setting, in a definition file of a predetermined configuration management tool, values ​​to be updated in accordance with the vulnerability information with respect to the configuration in the similar systems.

4. The method for supporting troubleshooting according to claim 3.

Images