Information processing device, information processing method and program

Abstract

To further efficiently evaluate an adverse effect when the vulnerability of a system is attacked.SOLUTION: An information processing device includes a detecting unit, an asset identifying unit, and an evaluating unit. The detecting unit detects, from a plurality of subjected components in an information processing system subjected to evaluation, one or more first components to be affected by an adverse effect involved in the information processing system. The asset identifying unit identifies one ore more assets corresponding to the one or more detected first components using assessment information that associates at least some of the plurality of subjected components, one or more assets in the information processing system, and an adverse effect level when the asset is attacked with each other. The evaluating unit obtains an evaluation value of a damage when the vulnerability is attacked based on the adverse effect level to the identified asset.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] An embodiment of the present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Various systems (products) that use computers are equipped with software (examples of components) such as an OS (Operating System) and OSS (Open Source Software). Furthermore, this software is composed of many elements. Even if vulnerabilities are not discovered in this software when the system is constructed or the product is developed, various vulnerabilities may be discovered over time.

[0003] Intelligence agencies that collect such vulnerabilities or the software vendors themselves provide vulnerability information and countermeasures for those vulnerabilities. System (product) providers refer to this information and apply patches or workarounds provided by the vendor. In situations where a system needs to be shut down, thorough notification and planning may be required depending on the system. In addition, providers require a large processing load to verify the side effects of patches or workarounds. On the other hand, situations may arise where an excessive processing load is required even though the impact (damage) when a vulnerability is attacked is small. For this reason, it is advisable to evaluate in advance the extent of the impact when a vulnerability is attacked. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 6320965 [Patent Document 2] Patent No. 4751431 [Non-patent literature]

[0005] [Non-Patent Document 1] Information-technology Promotion Agency, Japan, Security Center Control System Security Risk Analysis Guide, 2nd Edition, p.137~p.138, March 2020 [Non-Patent Document 2] Information-technology Promotion Agency, Japan, Information Security Measures Guidelines for Small and Medium-sized Enterprises, Version 3.1, p.54-p.56, April 2023 Summary of the Invention [Problem to be solved by the invention]

[0006] An object of the present invention is to provide an information processing device, an information processing method, and a program that can more efficiently evaluate the impact when the vulnerability of a system is attacked. [Means for solving the problem]

[0007] An information processing apparatus according to an embodiment includes a detection unit, an asset identification unit, and an evaluation unit. The detection unit detects one or more first components affected by a vulnerability included in an information processing system from among multiple target components included in an information processing system to be evaluated. The asset identification unit identifies one or more assets corresponding to the detected one or more first components using assessment information that associates at least a portion of the multiple target components, one or more assets included in the information processing system, and an impact level when the asset is attacked. The evaluation unit calculates an evaluation value of damage when the vulnerability is attacked, based on the impact level corresponding to the identified asset. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of an information processing apparatus according to a first embodiment. [Diagram 2] FIG. 4 is a diagram showing an example of a data structure of vulnerability information. [Diagram 3] FIG. 4 is a diagram showing an example of a data structure of component information. [Figure 4] A diagram showing the relationships between multiple components. [Diagram 5] FIG. 4 is a diagram showing an example of a data structure of assessment information. [Figure 6] 4 is a flowchart of an evaluation process according to the first embodiment. [Figure 7] 13 is a flowchart of a component identification process. [Figure 8] AddChild flowchart. [Figure 9] SearchParent flowchart. [Figure 10] 13 is a flowchart of an evaluation value calculation process. [Figure 11] FIG. 13 is a diagram showing an example of a component list. [Figure 12] FIG. 13 is a diagram showing an example of a component list. [Figure 13] FIG. 11 is a diagram showing an example of an output evaluation value. [Figure 14] FIG. 11 is a block diagram of an information processing apparatus according to a second embodiment. [Figure 15] FIG. 4 is a diagram showing an example of a data structure of correction information. [Figure 16] 13 is a flowchart of an evaluation process according to the second embodiment. [Figure 17] FIG. 2 is a hardware configuration diagram of the information processing apparatus according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of an information processing apparatus according to the present invention will be described in detail with reference to the accompanying drawings.

[0010] The information processing device of the embodiment is a device that evaluates the impact (damage) when a vulnerability identified in an information processing system (computer system, computer application product, etc., hereinafter referred to as the target system) to be evaluated is attacked.

[0011] As a technology for evaluating the impact of attacks on vulnerabilities, a technology has been proposed that calculates the total amount of damage corresponding to vulnerabilities by preparing a database that stores vulnerability information that associates each vulnerability with a corresponding attack, attack information that associates each attack with a risk event corresponding to a predetermined period of occurrence, and risk event information that associates each risk event with an estimated amount of damage.However, such a technology requires preparing a database by assuming various attacks and risks and considering in advance the correspondence between risks and attacks, and between risks and amount of damage, which results in an excessive processing load for evaluating the amount of damage.

[0012] In the following embodiment, the results of a security risk assessment (hereinafter simply referred to as risk assessment) separately performed on the target system are used to evaluate the impact when the system's vulnerability is attacked. Risk assessment is a process that clarifies, for example, the damage caused by an attack (threat) on the target system, the magnitude of the damage, the possibility of the attack occurring, and the acceptability of the attack. In conventional technology, information obtained as a result of such risk assessment (assessment information) is not used.

[0013] The target system includes multiple components (hereinafter, target components). The target components may include not only software, but also one or more pieces of hardware such as equipment. The vulnerability of the target system may be a software vulnerability or a hardware vulnerability. The following mainly describes an example in which a software vulnerability is discovered.

[0014] (First embodiment) Fig. 1 is a block diagram showing an example of the configuration of an information processing device 100 according to the first embodiment. As shown in Fig. 1, the information processing device 100 is connected to a measurement system 201, a user environment 202, and a server 300 via a network 400.

[0015] The measurement system 201 and the user environment 202 are examples of a target system. The measurement system 201 is, for example, a system that collects sensor data measured by a sensor or the like. The user environment 202 is, for example, a system that allows a user to use the sensor data measured by the measurement system 201. The target system is not limited to the measurement system 201 and the user environment 202, and may be any system.

[0016] Server 300 is a device that collects information on vulnerabilities of multiple software programs and provides vulnerability information based on the collected information. Server 300 is operated, for example, by an information organization that collects vulnerabilities or a software vendor. For example, the National Institute of Standards and Technology (NIST) manages a vulnerability information site called the National Vulnerability Database (NVD) and makes vulnerability information publicly available through this site. Server 300 may be a device managed by such an organization.

[0017] The network 400 is, for example, the Internet, but may be any other type of network. The network 400 may be any of a wired network, a wireless network, and a mixed wired and wireless network.

[0018] The information processing device 100 includes a vulnerability information storage unit 121, a component information storage unit 122, an assessment information storage unit 123, a reception unit 101, a detection unit 111, an asset identification unit 113, an evaluation unit 114, and an output control unit 115.

[0019] The vulnerability information storage unit 121 stores vulnerability information indicating vulnerabilities collected for one or more pieces of software. The vulnerability information is collected by, for example, the server 300 and transmitted to the information processing device 100. Fig. 2 is a diagram showing an example of a data structure of the vulnerability information.

[0020] As shown in FIG. 2, the vulnerability information includes a vulnerability ID, a software name, version information, a software identifier, a vulnerability content, a CVSS (Common Vulnerability Scoring System) vector, and a vulnerability type.

[0021] The vulnerability ID is information for uniquely identifying the vulnerability information. The vulnerability ID may be a sequential number uniquely assigned within the information processing device 100, or may be a Common Vulnerabilities and Exposures (CVE) identifier.

[0022] The software name is the name of the software that is the subject of the vulnerability information. The version information indicates the condition of the version in which the vulnerability exists. The version condition may be, for example, a value indicating the relevant version, or a range of values ​​indicating the version (for example, "less than 1.0.5").

[0023] The software identifier is information that uniquely identifies software that is the subject of vulnerability information. For example, the software identifier may be the Common Platform Enumeration (CPE) defined by NIST, or may be in any other format.

[0024] The vulnerability content indicates the content of the target vulnerability information. For example, the vulnerability content is expressed as a character string including the type, target, and cause of the vulnerability.

[0025] The CVSS vector is information indicating the impact of a vulnerability, and corresponds to a vector representation of the base score defined in CVSS v3. Note that the information indicating the impact of a vulnerability is not limited to the CVSS vector, and may be information in any other format.

[0026] In the example of Figure 2, elements separated by the symbol " / " represent "assessment item:assessment value", which is a pair of each vulnerability assessment item and the assessment value of that assessment item. For example, "AV:N" indicates that the assessment value of the assessment item, which is the access vector, is "N", which stands for network. Other assessment items are also set according to the assessment methodology defined in CVSS v3. The example of vector representation in Figure 2 includes C, I, and A, which are assessment items from the perspectives of confidentiality, integrity, and availability, respectively.

[0027] The vulnerability type indicates the type of the target vulnerability. For example, the vulnerability type may be expressed according to the Common Weakness Enumeration (CWE) or any other standard. For example, the vulnerability type may be expressed using a unique classification name.

[0028] Returning to Fig. 1, the component information storage unit 122 stores component information related to target components (software and hardware) included in the target system. Fig. 3 is a diagram showing an example of the data structure of the component information.

[0029] As shown in FIG. 3, the component information includes a component number, a component type, a component name, a software name, a version number, a software identifier, and a parent component number.

[0030] The component number is an example of identification information for identifying component information, and is a unique number assigned to each piece of component information (record).

[0031] The component type indicates the type of the component of the corresponding record. For example, the component type may be one of the following: · System: Represents a system consisting of multiple devices. Equipment: Represents the hardware of devices such as personal computers, network devices, and IoT (Internet of Things) devices. ·OS: stands for operating system. · Program: Represents a program that can be executed independently. · Library: Represents the libraries called by the program. Modules: Represents drivers and extension modules that are called by the OS. ·Database: stands for DBMS (Database Management system).

[0032] The component name indicates the name of the configuration function of the software and hardware included in the system. The software name indicates the name of the software. The version number indicates the version of the software included in the system.

[0033] The software identifier is an identifier of the software included in the system. The software identifier included in the component information is expressed in the same format as the software identifier stored in the vulnerability information storage unit 121, for example.

[0034] If the component of the record is not software, the values ​​of the software name, version number, and software identifier fields are left blank.

[0035] The parent component number indicates the component number of another component that contains the component of the record. For example, if the component of the record is an OS, the component number of the device on which the OS is installed is set as the parent component number of the record.

[0036] In this way, the component information is information that also represents the relationships between multiple components. Fig. 4 is a diagram that shows the relationships between multiple components. Fig. 4 corresponds to the diagram that shows the relationships between the components shown in the component information in Fig. 3.

[0037] 1, the assessment information storage unit 123 stores assessment information that is a result of a risk assessment for a target system. The risk assessment may be performed by any method, and may be performed according to the assessment method described in Non-Patent Document 1 or Non-Patent Document 2, for example.

[0038] The assessment information obtained as a result of the risk assessment shall include at least the following information: -Protected asset name: The name of the asset (protected asset, information asset) to be protected that is included in the system. Storage location: The location in the system where the protection asset is stored (location where it exists). For example, it is expressed by the component number of one or more components where the protection asset exists. Impact: Impact on the vulnerability of the protected assets.

[0039] In this way, the assessment information corresponds to information that associates at least a portion of a plurality of target components, one or more assets included in the target system, and the degree of impact when the assets are attacked.

[0040] Although a single impact level may be defined for a protected asset, an impact level may be defined for each of confidentiality, integrity, and availability. This makes it possible to obtain the impact of vulnerabilities for each protected asset with higher accuracy. Depending on the assessment method, the impact level may be referred to as importance or evaluation value.

[0041] Fig. 5 is a diagram showing an example of a data structure of assessment information. As shown in Fig. 5, the assessment information includes an asset number, a protected asset name, a storage location, and an impact level. Fig. 5 shows an example of assessment information in which an impact level is defined for each of confidentiality, integrity, and availability.

[0042] The asset number is an example of identification information that identifies a protected asset. For example, the asset number is a unique number assigned to each piece of assessment information (record).

[0043] The protected asset name indicates the name of the protected asset. The storage location indicates the component in which the corresponding protected asset is stored or exists. For example, the storage location is represented by the component number of the component.

[0044] The impact level indicates the impact on "confidentiality," "integrity," and "availability" when the corresponding protected asset is attacked. For example, the impact level is set according to the criteria in Table 12 of Non-Patent Document 2.

[0045] 5 is an example of assessment information including only the items used in the present embodiment, and is not limited thereto. The assessment information may include other items according to the assessment method applied.

[0046] Each memory unit (vulnerability information memory unit 121, component information memory unit 122, assessment information memory unit 123) can be composed of any commonly used storage medium such as a flash memory, a memory card, a RAM (Random Access Memory), a HDD (Hard Disk Drive), and an optical disk.

[0047] Each storage unit may be realized as a physically different storage medium, or as different storage areas of a physically same storage medium.Furthermore, each storage unit may be realized by a plurality of physically different storage media.

[0048] Returning to Fig. 1, the reception unit 101 receives input of various information used in the information processing device 100. For example, the reception unit 101 receives vulnerability information from the server 300 via the network 400. The reception unit 101 may receive input of vulnerability information stored in a storage medium such as a CD-ROM. The reception unit 101 stores the received vulnerability information in, for example, the vulnerability information storage unit 121.

[0049] The detection unit 111 detects one or more components CA (first components) affected by a vulnerability included in the target system from among a plurality of target components included in the target system. The detection unit 111 includes a component identification unit 112.

[0050] The component identification unit 112 first detects one or more components CB having a vulnerability from among multiple target components. Next, the component identification unit 112 identifies one or more components affected by the vulnerability of the detected component CB from among the multiple target components, and outputs the components as components CA. Note that the one or more components affected by the vulnerability of the component CB include the component CB itself.

[0051] For example, the component identification unit 112 identifies, according to the type of the detected component CB, one or more components affected by the vulnerability of the detected component CB as components CA.

[0052] In this manner, in this embodiment, the component CA is detected not only as the component CB detected as a vulnerable component, but also as other components affected by the vulnerability of the component CB. Such processing by the component identification unit 112 can also be interpreted as processing for identifying the range of components affected by the vulnerability (scope of impact).

[0053] Note that the configuration may be such that the process of including other components affected by the vulnerability of the component CB is not executed, that is, only the component CB is output as the component CA.

[0054] Any method may be used to detect one or more components CB having a vulnerability from among multiple target components, but for example, the method described in Patent Document 2 may be applied. In this method, a component having a vulnerability is detected by determining the association between pre-registered configuration information and stored vulnerability information.

[0055] The configuration information is, for example, information including software and version information of multiple pieces of software installed in the target system. For example, the component information stored in the component information storage unit 122 can be used as the configuration information. Configuration information defined separately from the component information may also be used. For example, the vulnerability information stored in the vulnerability information storage unit 121 can be used as the vulnerability information.

[0056] In this way, the detection unit 111 (component identification unit 112) can detect one or more components having vulnerabilities from a plurality of target components using the vulnerability information. For example, the detection unit 111 detects a component having a vulnerability by determining whether or not software corresponding to the software name and version information included in the vulnerability information stored in the vulnerability information storage unit 121 exists in the target system. The detection unit 111 outputs, for example, a vulnerability ID included in the vulnerability information and a component number of a component having a vulnerability corresponding to the vulnerability ID as a detection result.

[0057] The detection unit 111 (component identification unit 112) may detect components having vulnerabilities without using vulnerability information. For example, the detection unit 111 first detects vulnerabilities in the target system. As a method for detecting vulnerabilities in the target system, for example, a method of installing a program that finds vulnerabilities in devices included in the target system and periodically executing the program to detect vulnerabilities in the target system can be used.

[0058] When a vulnerability of the target system is detected, the detection unit 111 further detects one or more components having the detected vulnerability. For example, the detection unit 111 refers to the component information stored in the component information storage unit 122 and identifies the component in which the detected vulnerability occurs.

[0059] The asset identifying unit 113 identifies one or more assets corresponding to one or more components CA detected by the detecting unit 111 using the assessment information.

[0060] The evaluation unit 114 calculates an evaluation value of damage when a vulnerability is attacked, based on the impact degree corresponding to the asset identified by the asset identification unit 113. The evaluation value of damage can be interpreted as information indicating the degree of damage.

[0061] When the assessment information includes the impact degree of confidentiality, the impact degree of integrity, and the impact degree of availability, the evaluation unit 114 may obtain a statistical value of the impact degree of confidentiality, the impact degree of integrity, and the impact degree of availability as the evaluation value. The statistical value is, for example, the maximum value of the impact degree of confidentiality, the impact degree of integrity, and the impact degree of availability. The statistical value is not limited to the maximum value, and may be a sum (accumulated value), etc.

[0062] The output control unit 115 controls the output of various information used in the information processing device 100. For example, the output control unit 115 outputs the damage evaluation value obtained by the evaluation unit 114. The output control unit 115 may output the damage evaluation value obtained for one vulnerability, or may output the damage evaluation values ​​for multiple vulnerabilities together with information indicating the vulnerability (for example, vulnerability ID). The output control unit 115 may output information in any manner, but may, for example, output (display) a screen including the information on a display device, or output to a file in a CSV (Comma Separated Values) format or the like.

[0063] Each of the above units (reception unit 101, detection unit 111, asset identification unit 113, evaluation unit 114, and output control unit 115) is realized, for example, by one or more processors. For example, each of the above units may be realized by having a processor such as a CPU (Central Processing Unit) and a GPU (Graphics Processing Unit) execute a program, that is, by software. Each of the above units may be realized by a processor such as a dedicated IC (Integrated Circuit), that is, by hardware. Each of the above units may be realized by using a combination of software and hardware. When multiple processors are used, each processor may realize one of the units, or two or more of the units.

[0064] The information processing device 100 may be physically configured as one device, or may be physically configured as multiple devices. For example, the information processing device 100 may be constructed on a cloud environment. Each unit in the information processing device 100 may be distributed and provided in multiple devices.

[0065] Next, a description will be given of the evaluation process by the information processing device 100 of the first embodiment. Fig. 6 is a flowchart showing an example of the evaluation process in the first embodiment.

[0066] The detection unit 111 (component identification unit 112) detects a vulnerable component CB from a target system (step S101). For example, the detection unit 111 outputs a list of one or more component numbers (hereinafter, referred to as a component list CLB) as a detection result. The component number can be obtained from the component information storage unit 122 as a component number corresponding to a software identifier corresponding to a vulnerability ID stored in the vulnerability information storage unit 121, for example.

[0067] When detecting a component CB without using vulnerability information, the detection unit 111 first outputs a list of one or more vulnerability IDs as a detection result. The vulnerability IDs are obtained from the vulnerability information stored in the vulnerability information storage unit 121. The detection unit 111 identifies a software identifier corresponding to the vulnerability ID included in the list, using the vulnerability information stored in the vulnerability information storage unit 121. The detection unit 111 also identifies a component number corresponding to the identified software identifier, using the component information stored in the component information storage unit 122.

[0068] In the following, an example will be described in which the component list CLB is used. If no component is detected from the component CB (if the component list CLB is empty), the evaluation process ends. If one or more components CB are detected (if the component list CLB is not empty), the following process is executed.

[0069] The component identification unit 112 acquires one component CB from the component list CLB (step S102). The component identification unit 112 executes a component identification process to identify a component CA affected by the vulnerability of the acquired component CB (step S103). The component identification process will be described in detail later.

[0070] Next, an evaluation value calculation process is executed to obtain an evaluation value of damage when a vulnerability included in the target system is attacked using the component CA identified by the component identification process (step S104). The details of the evaluation value calculation process will be described later.

[0071] The detection unit 111 determines whether or not all components CB in the component list CLB have been processed (step S105). If all components CB have not been processed (step S105: No), the process returns to step S102 and the process is repeated for the next component CB.

[0072] If all components CB have been processed (step S105: Yes), the output control unit 115 outputs the evaluation value based on the result (evaluation value list) obtained in the evaluation value calculation process (step S106), and ends the evaluation process.

[0073] Next, the component identification process in step S103 will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart showing an example of the component identification process.

[0074] In the component identification process, a component number is passed, and a component CA affected by a vulnerability of a component CB identified by the component number is identified. For example, the component identification unit 112 outputs a list of one or more component numbers (hereinafter, referred to as a component list CLA) as an identification result.

[0075] The component identification unit 112 searches the component information stored in the component information storage unit 122 for a record that matches the specified component number, and obtains the component type included in the searched record (step S201).

[0076] The component identification unit 112 initializes the component list CLA to be empty (step S202). After that, the process branches depending on the component type acquired in step S201.

[0077] First, the component identification unit 112 determines whether the component type is "device", "system", "OS", or "program" (step S203). If the component type is "device", "system", "OS", or "program" (step S203: Yes), the component identification unit 112 executes a subroutine AddChild (step S204) and ends the component identification process.

[0078] AddChild is executed, for example, with a component number as an argument. AddChild is a subroutine for adding other components (child components) included in the component with the component number specified as an argument to the component list CLA. Details of AddChild will be described later.

[0079] If the component type is not a "device", "system", "OS", or "program" (step S203: No), the component identification unit 112 determines whether the component type is a "DB" (step S205).

[0080] If the component type is "DB" (step S205: Yes), the component identification unit 112 adds the specified component number to the component list CLA (step S206) and ends the component identification process. In this way, if the component type of the specified component CB is "DB", only the component CB is identified as a component affected by the vulnerability, and other components are not added.

[0081] If the component type is not "DB" (step S205: No), that is, if the component type is "library", the component identification unit 112 adds the specified component number to the component list CLA (step S207). The component identification unit 112 acquires a record including a parent component number that matches the specified component number from the component information stored in the component information storage unit 122 (step S208).

[0082] The component identification unit 112 determines whether the component type of the acquired record is "program" (step S209). If the component type is "program" (step S209: Yes), the component identification unit 112 adds the component number included in the record to the component list CLA (step S210) and ends the component identification process.

[0083] If the component type is not "program" (step S209: No), the component identification unit 112 executes the subroutine SearchParent (step S211).

[0084] SearchParent is executed with, for example, a component number and a component type as arguments. SearchParent is a subroutine that searches for a component having a component type specified as an argument among components that include the component with the component number specified as an argument. Details of SearchParent will be described later.

[0085] In this embodiment, the component number of the component CB is specified as the component number, and "OS" is specified as the component type. SearchParent outputs the component number of the searched component as a return value. In the following, the component number output by SearchParent is represented as c.

[0086] After executing SearchParent, the component identification unit 112 executes AddChild using the component number c as an argument (step S212), and ends the component identification process.

[0087] The processing (steps S207 to S212) when the component type of component CB is "library" means that if the parent component of component CB is a program, the scope of influence is itself (component CB) and the parent component, and if the parent component is not a program, the scope of influence is all components included in the OS, including component CB.

[0088] Next, the subroutine AddChild will be described in detail with reference to a flow chart of an example of AddChild.

[0089] AddChild corresponds to a process of adding a component identified by a component number specified by an argument and all components contained within that component to the component list CLA.

[0090] The component identification unit 112 adds the component number designated by the argument to the component list CLA (step S301). The component identification unit 112 sets the variable i to 1 as an initial value (step S302).

[0091] The component identification unit 112 determines whether the component number specified by the argument matches the parent component number of the i-th record (hereinafter, i-th record) in the component information storage unit 122 (step S303).

[0092] If there is a match (step S303: Yes), the component identification unit 112 executes AddChild with the component number of the i record as an argument (step S304). This makes it possible to recursively search for other components (child components) included in the component with the component number specified by the argument.

[0093] After executing AddChild in step S304, or if it is determined in step S303 that there is no match (step S303: No), the component identification unit 112 adds 1 to the variable i (step S305). The component identification unit 112 determines whether the value of the variable i is equal to or less than the number of records of the component information stored in the component information storage unit 122 (step S306).

[0094] If the variable i is equal to or less than the number of records (step S306: Yes), the process returns to step S303 and is repeated. If the variable i exceeds the number of records (step S306: No), AddChild ends.

[0095] Next, the subroutine SearchParent will be described in detail with reference to a flowchart of FIG 9.

[0096] The component identification unit 112 acquires the component type of the record corresponding to the component number c designated as an argument from the component information stored in the component information storage unit 122 (step S401).

[0097] The component identification unit 112 determines whether the acquired component type matches the component type specified as an argument (step S402). If they match (step S402: Yes), a component of the target component type has been found, so the component identification unit 112 outputs the value of the component number c as a return value (step S403) and ends SearchParent.

[0098] If there is no match (step S402: No), the component identification unit 112 judges whether the parent component number of the acquired record is blank (step S404). If it is blank (step S404: Yes), there is no higher-level component (parent component), so the component identification unit 112 outputs information indicating that a component of the targeted component type cannot be found (for example, "NotFound") and ends SearchParent.

[0099] If it is not blank (step S404: No), the component identification unit 112 designates the parent component number of the record as a new component number c (step S406), and returns to step S401 to repeat the process.

[0100] Next, the evaluation value calculation process in step S104 will be described in detail with reference to Fig. 10. Fig. 10 is a flowchart showing an example of the evaluation value calculation process.

[0101] The evaluation unit 114 initializes variables maxC, maxI, and maxA indicating evaluation values ​​to 0 (step S501). maxC is an evaluation value representing the maximum value of damage related to confidentiality. maxI is an evaluation value representing the maximum value of damage related to integrity. maxA is an evaluation value representing the maximum value of damage related to availability.

[0102] The asset identifying unit 113 acquires one component (component number) from the component list CLA (step S502). The asset identifying unit 113 acquires an asset corresponding to the acquired component number from the assessment information stored in the assessment information storage unit 123 (step S503). For example, the asset identifying unit 113 acquires assessment information (hereinafter, record RA) that includes the acquired component number in its storage location from the assessment information stored in the assessment information storage unit 123.

[0103] The asset identification unit 113 judges whether the assessment information (record RA) has been acquired (step S504). If the assessment information (record RA) has been acquired (step S504: Yes), the evaluation unit 114 refers to the vulnerability information (vulnerability information stored in the vulnerability information storage unit 121) corresponding to the vulnerability of the currently targeted component CB (component acquired in step S102 of FIG. 6) and judges whether the value of C (confidentiality) of the CVSS vector is N (no impact) (step S505).

[0104] If the value of C is not N (step S505: No), the evaluation unit 114 judges whether the current value of maxC is smaller than the value of the confidentiality impact of the record RA (step S506). If it is smaller (step S506: Yes), the evaluation unit 114 sets the value of the confidentiality impact of the record RA as the value of maxC (step S507).

[0105] After setting the value of maxC, or if it is determined in step S505 that the value of C is N (step S505: Yes), or if it is determined in step S506 that the value of maxC is equal to or greater than the value of the impact of confidentiality (step S506: No), the evaluation unit 114 performs similar processing on maxI.

[0106] That is, the evaluation unit 114 determines whether the value of I (integrity) of the CVSS vector is N (no impact) (Step S508). If the value of I is not N (Step S508: No), the evaluation unit 114 determines whether the current value of maxI is smaller than the value of the impact degree of the integrity of the record RA (Step S509). If it is smaller (Step S509: Yes), the evaluation unit 114 sets the value of the impact degree of the integrity of the record RA as the value of maxI (Step S510).

[0107] After setting the value of maxI, or if it is determined in step S508 that the value of I is N (step S508: Yes), or if it is determined in step S509 that the value of maxI is equal to or greater than the value of the impact of completeness (step S509: No), the evaluation unit 114 performs a similar process for maxA.

[0108] That is, the evaluation unit 114 determines whether the value of A (availability) of the CVSS vector is N (no impact) (step S511). If the value of A is not N (step S511: No), the evaluation unit 114 determines whether the current value of maxA is smaller than the value of the impact degree of the availability of the record RA (step S512). If it is smaller (step S512: Yes), the evaluation unit 114 sets the value of the impact degree of the availability of the record RA as the value of maxA (step S513).

[0109] After setting the value of maxA, or if it is determined in step S511 that the value of I is N (step S511: Yes), or if it is determined in step S512 that the value of maxA is greater than or equal to the value of the impact of availability (step S512: No), or if it is determined in step S504 that assessment information could not be obtained (step S504: No), the evaluation unit 114 determines whether or not all components included in the component list CLA have been processed (step S514).

[0110] If not all components have been processed (step S514: No), the process returns to step S502 and the process is repeated for the next component.

[0111] If all components have been processed (step S514: Yes), the evaluation unit 114 adds a set of the vulnerability ID of the vulnerability information corresponding to the vulnerability of the currently targeted component CB and the statistical values ​​(e.g., maximum values) of maxC, maxI, and maxA to the evaluation value list (step S515), and ends the evaluation value calculation process. Note that the evaluation value list is assumed to have been initialized, for example, at the start of the evaluation process (FIG. 6).

[0112] Next, a specific example of the evaluation process by the information processing device 100 of this embodiment will be described with reference to Figs. 11 to 13 in addition to the figures described above. Fig. 11 is a diagram showing an example of a component list CLB. Fig. 12 is a diagram showing an example of a component list CLA obtained based on the component list CLB of Fig. 11. Fig. 13 is a diagram showing an example of an evaluation value to be output.

[0113] 11, it is assumed that a component with a component number of "C00004" is detected as a component having a vulnerability (step S101 in FIG. 6). Note that the component with the component number of "C00004" is detected as a component corresponding to software with a software identifier of "cpe: / a:xxx:bbb" corresponding to the vulnerability ID "CVE-9999-0001."

[0114] Since the component list CLB is not empty, the detection unit 111 (component identification unit 112) extracts the component number "C00004" of the component CB from the component list CLB (step S102 in FIG. 6).

[0115] Next, the component identification unit 112 executes the component identification process (step S103 in FIG. 6, FIG. 7).

[0116] The component identification unit 112 refers to the component information as shown in Fig. 3, for example, and acquires the component type "program" corresponding to the acquired component number "C00004" (step S201 in Fig. 7). The component identification unit 112 initializes the component list CLA to be empty (step S202).

[0117] Since the component type is "program" (step S203: Yes), the component identification unit 112 calls AddChild (FIG. 8) with the component number "C00004" as an argument (step S204).

[0118] The component identification unit 112 adds the component number "C00004" specified by the argument to the component list CLA (step S301), and sets the variable i to 1 (step S302).

[0119] The component identification unit 112 compares the parent component number of the i record (the first record) with "C00004", which is the argument of AddChild (step S303). Since the parent component number of the first record is blank in the component information of FIG. 3, it is determined that there is a mismatch (step S303: No). Therefore, the component identification unit 112 adds 1 to the variable i (step S305) and determines whether the value of the variable i is equal to or less than the number of records in the component information (11 in the example of FIG. 3) (step S306). Since the value 2 of the variable i is equal to or less than 11, the process returns to step S303 and is repeated.

[0120] When the variable i is 5, it is determined in step S303 that the parent component number "C00004" of record 5 (the fifth record) matches the argument "C00004" of AddChild. Therefore, the component identification unit 112 calls AddChild with the component number "C00005" of record 5 as an argument (step S304).

[0121] In this call, "C00005" is added to the component list CLA in step S301. Since there is no record in the component information whose parent component number is "C00005", AddChild is not called again and AddChild ends.

[0122] After step S204 in Fig. 7, the component identification process ends. That is, step S103 in Fig. 6 also ends. At this point, the component list CLA becomes (C00004, C00005). Fig. 12 is a diagram showing an example of the component list CLA obtained in this manner.

[0123] After this, the evaluation value calculation process (step S104 in FIG. 6, FIG. 10) is executed. The evaluation unit 114 initializes the values ​​of maxC, maxI, and maxA to 0 (step S501). Since the component list CLA is not empty, the asset identification unit 113 obtains one component number, "C00004", from the component list CLA (step S502). The asset identification unit 113 searches for a record that includes "C00004" in the storage location of the assessment information. For the assessment information in FIG. 5, the record with asset number "A00001" is searched for as the corresponding record.

[0124] The evaluation unit 114 refers to the CVSS vector "AV:N / AC:L / PR:L / UI:N / S:C / C:H / I:N / A:N" corresponding to the vulnerability ID "CVE-9999-0001" in the vulnerability information shown in FIG. 2, for example, and determines that the value of "C" is "H", that is, not "N" (step S505: No). The evaluation unit 114 compares the confidentiality value 1 of the record of the asset number "A00001" in the assessment information with maxC (the value is 0 at this point) (step S506). Since maxC is smaller (step S506: Yes), the evaluation unit 114 assigns the confidentiality value 1 of the record to maxC (step S507).

[0125] Since the value of "I" is "N" (step S508: Yes) and the value of "A" is "N" (step S511: Yes), the values ​​of maxI and maxA are not updated.

[0126] It is determined whether all components have been processed (step S514), and it is determined that the component number "C00005" is unprocessed (step S514: No). For the component number "C00005", it is determined that there is no record containing "C00005" in the storage location of the assessment information (step S504: No).

[0127] After that, it is determined that all components have been processed (step S514: Yes), and the evaluation unit 114 adds the evaluation value to the evaluation value list (step S515). For example, the evaluation unit 114 adds 1, which is the maximum value among maxC=1, maxI=0, and maxA=0, to the evaluation value list as the evaluation value of the vulnerability ID (CVE-9999-0001).

[0128] In step S105 of Fig. 6, it is determined that all components CB (component number "C00004") have been processed, and the output control unit 115 outputs the evaluation value (step S106) and ends the evaluation process. Fig. 13 is a diagram showing an example of the evaluation value (impact degree) output by the output control unit 115. In this example, only the evaluation value for the vulnerability ID "CVE-9999-0001" is output.

[0129] In this way, the information processing device of the first embodiment uses the result of the risk assessment (assessment information) for the target system to evaluate the impact when the vulnerability of the system is attacked. This makes it possible to more efficiently evaluate the impact when the vulnerability of the system is attacked.

[0130] Second embodiment The information processing apparatus of the second embodiment has a function of correcting a component CA obtained as a result of a component identification process, in other words, the range of components affected by a vulnerability (the range of impact).

[0131] Fig. 14 is a block diagram showing an example of the configuration of an information processing device 100-2 according to the second embodiment. As shown in Fig. 14, the information processing device 100-2 includes a vulnerability information storage unit 121, a component information storage unit 122, an assessment information storage unit 123, a correction information storage unit 124-2, a reception unit 101, a detection unit 111, an asset identification unit 113, an evaluation unit 114, an output control unit 115, and a correction unit 116-2.

[0132] The second embodiment differs from the first embodiment in that a correction information storage unit 124-2 and a correction unit 116-2 are added. Other configurations and functions are the same as those in FIG. 1, which is a block diagram of the information processing device 100 of the first embodiment, so the same reference numerals are used and the description thereof is omitted here.

[0133] The modification information storage unit 124-2 stores modification information to be referred to when modifying the impact range. The modification information corresponds to a modification rule for modifying the component CA obtained by the component identification unit 112 for each vulnerability type. Fig. 15 is a diagram showing an example of the data structure of the modification information.

[0134] As shown in FIG. 15, the modification information includes three fields: vulnerability type, addition, and deletion. The vulnerability type indicates the type of vulnerability to which the modification rule is applied, and is expressed in the same manner as the vulnerability type in the vulnerability information storage unit 121. Addition indicates the impact scope including the component to be added. Deletion indicates the impact scope including the component to be deleted. If both addition and deletion are specified, addition takes precedence, and the impact scope to which the component written in the addition field is added is not affected by the deletion. Note that the following are possible specifications for addition and deletion: Entire OS: The entire OS to which the component belongs. DB: The entire DB to which the component belongs. If the component does not belong to a DB, this does not apply. API (Application Programming Interface): The access scope of WebAPI. User environment: The environment in which the user uses the target system.

[0135] The modification unit 116-2 performs at least one of adding a component to the component CA and deleting a component from the component CA, using the modification information stored in the modification information storage unit 124-2. For example, the modification unit 116-2 obtains a record having a vulnerability ID of the identified vulnerability from the vulnerability information storage unit 121, and obtains the vulnerability type included in the obtained record. The modification unit 116-2 obtains a record of modification information corresponding to the obtained vulnerability type from the modification information storage unit 124-2, and modifies the component CA according to the description of addition or deletion included in the obtained record.

[0136] The modifying unit 116-2 may further include a function of modifying the component CA by referring to the CVSS vector corresponding to the vulnerability ID. For example, the modifying unit 116-2 can obtain a record having the vulnerability ID of the identified vulnerability from the vulnerability information storage unit 121, and when the "S (scope)" of the CVSS vector included in the obtained record is "C (changed)", it is also possible to expand the scope of influence to the entire target system.

[0137] Next, the evaluation process by the information processing device 100-2 of the second embodiment will be described with reference to Fig. 16. Fig. 16 is a flowchart showing an example of the evaluation process in the second embodiment.

[0138] In this embodiment, step S604 is added after the component identification process, which is a process of correcting the component CA (scope of impact) obtained by the component identification process.

[0139] Steps S601 to S603 are similar to steps S101 to S103 in the information processing device 100 of the first embodiment, and therefore description thereof will be omitted.

[0140] In step SS604, the modification section 116-2 modifies the component CA obtained by the component identification process in accordance with the modification information stored in the modification information storage section 124-2.

[0141] Steps S605 to S607 are similar to steps S104 to S106 in the information processing apparatus 100 of the first embodiment, and therefore a description thereof will be omitted.

[0142] In this way, in the second embodiment, the range of components affected by a vulnerability (scope of impact) can be modified, making it possible to more accurately evaluate the impact of an attack on a system vulnerability.

[0143] As described above, according to the first and second embodiments, it is possible to more efficiently evaluate the impact when the vulnerability of a system is attacked.

[0144] Next, a hardware configuration of the information processing device according to the first or second embodiment will be described with reference to Fig. 17. Fig. 17 is an explanatory diagram showing an example of the hardware configuration of the information processing device according to the first or second embodiment.

[0145] The information processing device of the first or second embodiment includes a control device such as a CPU 51, a storage device such as a ROM (Read Only Memory) 52 or a RAM 53, a communication I / F 54 that connects to a network and communicates, and a bus 61 that connects each part.

[0146] The programs executed by the information processing device of the first or second embodiment are provided in a state that they are pre-installed in the ROM 52 or the like.

[0147] The program executed by the information processing device of the first or second embodiment may be configured to be provided as a computer program product by being recorded in an installable or executable format on a computer-readable recording medium such as a CD-ROM (Compact Disk Read Only Memory), a flexible disk (FD), a CD-R (Compact Disk Recordable), or a DVD (Digital Versatile Disk).

[0148] Furthermore, the program executed by the information processing device of the first or second embodiment may be configured to be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Also, the program executed by the information processing device of the first or second embodiment may be configured to be provided or distributed via a network such as the Internet.

[0149] The program executed by the information processing device of the first or second embodiment can cause the computer to function as each part of the information processing device described above. In this computer, the CPU 51 can read the program from a computer-readable storage medium onto the main storage device and execute the program.

[0150] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0151] 100, 100-2 Information processing device 101 Reception 111 Detection unit 112 Component Identification Section 113 Asset Identification Department 114 Evaluation Department 115 Output control section 116-2 Correction section 121 Vulnerability information storage unit 122 Component information storage unit 123 Assessment information storage unit 124-2 Correction information storage unit 201 Measurement System 202 User environment 300 Servers 400 Network

Claims

1. a detection unit that detects one or more first components affected by a vulnerability included in an information processing system to be evaluated from a plurality of target components included in the information processing system; an asset identification unit that identifies one or more assets corresponding to the detected one or more first components using assessment information that associates at least a portion of the plurality of target components, one or more assets included in the information processing system, and a degree of impact when the assets are attacked; an evaluation unit that calculates an evaluation value of damage when the vulnerability is attacked based on the impact degree corresponding to the identified asset; An information processing device comprising:

2. the impact level includes a confidentiality impact level, an integrity impact level, and an availability impact level; the evaluation unit obtains, as the evaluation value, a statistical value of the impact degree of the confidentiality, the impact degree of the integrity, and the impact degree of the availability. The information processing device according to claim 1 .

3. the statistical value being a maximum value of the confidentiality impact, the integrity impact, and the availability impact; The information processing device according to claim 2 .

4. The detection unit is a component identification unit that detects one or more components having the vulnerability from among the plurality of target components, and identifies one or more first components affected by the vulnerability of the detected component from among the plurality of target components; The information processing device according to claim 1 .

5. a modification unit that performs at least one of adding a component to one or more of the first components and deleting a component from one or more of the first components by using modification information that defines a component to be added or deleted for each type of vulnerability, The information processing device according to claim 4.

6. the component identification unit identifies, according to a type of the detected component, one or more first components affected by the vulnerability of the detected component; The information processing device according to claim 4.

7. the detection unit detects one or more first components from the plurality of target components by using vulnerability information indicating the vulnerability of one or more components; The information processing device according to claim 1 .

8. the detection unit detects the vulnerability of the information processing system and detects one or more of the first components having the detected vulnerability; The information processing device according to claim 1 .

9. An output control unit that outputs the evaluation value is further provided. The information processing device according to claim 1 .

10. An information processing method executed by an information processing device, a detection step of detecting one or more first components affected by a vulnerability included in an information processing system to be evaluated from a plurality of target components included in the information processing system; an asset identification step of identifying one or more assets corresponding to the detected one or more first components using assessment information that associates at least a portion of the plurality of target components, one or more assets included in the information processing system, and a degree of impact when the assets are attacked; an evaluation step of calculating an evaluation value of damage when the vulnerability is attacked based on the impact degree corresponding to the identified asset; An information processing method comprising:

11. On the computer, a detection step of detecting one or more first components affected by a vulnerability included in an information processing system to be evaluated from a plurality of target components included in the information processing system; an asset identification step of identifying one or more assets corresponding to the detected one or more first components using assessment information that associates at least a portion of the plurality of target components, one or more assets included in the information processing system, and a degree of impact when the assets are attacked; an evaluation step of calculating an evaluation value of damage when the vulnerability is attacked based on the impact degree corresponding to the identified asset; A program for executing.

Images