Incident response support system

Abstract

To provide an incident response support system that can provide highly accurate judgments and appropriate responses to engineers when an incident occurs.SOLUTION: An incident response support system 100 includes an instrumentation control system 10 having a terminal PC that monitors and controls equipment 10D installed in a plant, a security monitoring system 20, an audit support system 30, and an information linking server 40 that links the security monitoring system 20 and the audit support system 30. The information linking server 40 includes an external data acquisition unit 45, an incident response linking unit 41 that links and integrates the data acquired by the external data acquisition unit 45 to generate an incident response flow 40F1, and a display unit 42 that selects a procedure that an engineer should take from an incident response procedure manual 40M and displays it on the screen.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present disclosure relates to an incident response support system. [Background technology]

[0002] Conventionally, a plant security response support system has been proposed as a system for displaying responses to events that occur in a plant, which includes an abnormality determination means for determining whether an abnormality in data acquired from a plant control device or a monitoring operation device is due to a cyber-attack, an impact determination means for analyzing parameter information of data determined by this abnormality determination means to be due to a cyber-attack based on the cyber-attack scenario, the risk of the cyber-attack, and the vulnerability of the plant equipment to the cyber-attack, and calculating the possibility of the cyber-attack spreading to the plant equipment, and a display means for displaying responses to the plant equipment based on the determination results (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-46207 Summary of the Invention [Problem to be solved by the invention]

[0004] The technology of Patent Document 1 does not take into account audit records, and has the problem of being unable to provide highly accurate judgments and appropriate responses to engineers when an incident occurs.

[0005] The present disclosure discloses technology for solving the above-mentioned problems, and aims to provide an incident response support system that can make highly accurate judgments and provide appropriate responses to engineers when an incident occurs. [Means for solving the problem]

[0006] The incident response support system of the present disclosure includes: an instrumentation control system having a terminal for monitoring and controlling equipment installed in a plant; a security monitoring system that collects logs from the instrumentation control system, detects incidents that occur in the instrumentation control system, and issues alerts; an audit support system having an audit execution unit that collects and audits the setting values ​​of the equipment and the terminal from the instrumentation control system, and an audit log that stores audit results; an information linking server that links the security monitoring system and the audit support system; The information sharing server comprises: an external data acquisition unit that acquires the log, the alert, and the audit log; an incident response linking unit that links and associates the data acquired by the external data acquisition unit with an incident response flow template, which is a template of a flowchart in which an engineer responds to the alert, to generate an incident response flow; The incident response flow and a display unit that selects from an incident response procedure manual the procedures that the engineer should take for individual operations in the incident response flow and displays them on a screen. [Effects of the Invention]

[0007] The incident response support system disclosed herein can support highly accurate judgments and appropriate responses when an incident occurs. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a block diagram showing a schematic configuration of an incident response support system according to a first embodiment. [Figure 2] 1 is a block diagram showing a detailed configuration of an incident response support system according to a first embodiment. [Figure 3] FIG. 3 is a diagram showing the structure of a security log according to the first embodiment. [Figure 4] FIG. 3 is a diagram showing the configuration of an alert log according to the first embodiment. [Figure 5] FIG. 3 is a diagram showing a configuration of inspection items according to the first embodiment. [Figure 6] FIG. 3 is a diagram showing the structure of an audit log according to the first embodiment. [Figure 7] 2 is a block diagram showing a configuration of an information linking server according to the first embodiment. FIG. [Figure 8] 6 is a flowchart showing the operation of the information linking server according to the first embodiment. [Figure 9] FIG. 1 is a diagram showing a configuration of an alert response list according to the first embodiment; [Figure 10] FIG. 2 is a diagram showing the structure of an incident response procedure manual according to the first embodiment. [Figure 11] FIG. 10 is a diagram showing the configuration of an incident response flow when alert ID3 (unauthorized access) occurs on terminal PC3 of the instrumentation control system according to the first embodiment. [Figure 12] FIG. 10 is a diagram showing one configuration of an incident response flow when an alert ID3 (unauthorized access) occurs on a terminal PC3 of the instrumentation control system according to the first embodiment. [Figure 13] FIG. 10 is a diagram showing the configuration of an incident response flow when alert ID3 (unauthorized access) occurs on terminal PC3 of the instrumentation control system according to the first embodiment. [Figure 14] 5 is a diagram showing the analysis results of the health of each terminal of the instrumentation control system according to the first embodiment. FIG. [Figure 15] The servers, terminals, and the like that constitute the instrumentation control system, security monitoring system, audit support system, and information linkage server according to the first embodiment are diagrams illustrating an example of hardware. DETAILED DESCRIPTION OF THE INVENTION

[0009] Embodiment 1 The incident response support system according to the first embodiment will be described below with reference to the drawings. FIG. 1 is a block diagram showing a schematic configuration of an incident response support system 100 according to the first embodiment. FIG. 2 is a block diagram showing a detailed configuration of the incident response support system 100. As shown in FIG.

[0010] The incident response support system 100 includes an instrumentation control system 10, a security monitoring system 20, an audit support system 30, an information sharing server 40, and a network 50 connecting these systems.

[0011] The instrumentation control system 10 is a system that monitors and controls various types of equipment installed in a plant or the like, and includes terminals PC1 to PC4 that monitor and control various types of equipment 10D connected via a network 50.

[0012] FIG. 3 is a diagram showing the configuration of the security log 20LB. FIG. 4 is a diagram showing the configuration of the alert log 20LD. 2, the security monitoring system 20 collects a communication log 20LA within the instrumentation control system 10, a security log 20LB for each piece of equipment 10D and terminals PC1-PC4, and an equipment log 20LC for the equipment 10D. The security monitoring system 20 also includes an anomaly detection unit 21 that detects anomalies (incidents) such as threats to the safety of the instrumentation control system 10 from the various logs described above. When the anomaly detection unit 21 detects the anomaly, it issues an alert to the information linkage server 40 and stores the alert log 20LD. The communication log 20LA, security log 20LB, equipment log 20LC, and alert log 20LD are stored in a database 20DB of the security monitoring system.

[0013] FIG. 5 is a diagram showing the configuration of the inspection item 30LB. FIG. 6 is a diagram showing the configuration of the audit log 30LA. 2, the audit support system 30 has a database 30DB and an audit execution unit 31. The audit support system 30 collects logs that are the subject of a security setting audit to audit the safety and vulnerability of each piece of equipment 10D and terminals PC1-PC4, as well as the setting values ​​of each piece of equipment 10D and terminals PC1-PC4, from the instrumentation control system 10. The audit execution unit 31 then performs an audit on the logs and setting values ​​listed in the audit items 30LB, and saves the audit results in the database 30DB as an audit log 30LA.

[0014] FIG. 7 is a block diagram showing the configuration of the information linking server 40. As shown in FIG. The information sharing server 40 has an incident response procedure manual registration unit 43, an incident response flow template registration unit 44, a database 40DB, an external data acquisition unit 45 that acquires various logs, alerts, audit results, etc. from external databases, an incident response flow linking unit 41, and a display unit 42.

[0015] The database 40DB stores a plurality of incident response flow templates 40F, an electronic incident response procedure manual 40M, and an alert response list 40A.

[0016] When an incident occurs in the instrumentation control system 10 and an alert is received from the security monitoring system 20, the incident response linking unit 41 of the information sharing server 40 selects an incident response flow template 40F, which is a template for a flowchart in which an engineer responds to the alert, and links the selected incident response flow template 40F with data acquired by the external data acquisition unit 45 from the security monitoring system 20 and the audit support system 30. This generates an incident response flow 40F1, which is a flowchart in which an engineer responds to an incident that has occurred in the instrumentation control system 10. The incident response flow 40F1 and the procedures that the engineer should take for individual operations can be selected from the incident response procedure manual 40M and displayed on the screen, thereby supporting the engineer's incident response operations.

[0017] 7 refers to the database 20DB of the security monitoring system 20 and the database 30DB of the audit support system 30. In FIG.

[0018] FIG. 8 is a flowchart showing the operation of the information linking server 40. First, for incidents that may occur in the instrumentation control system 10 during normal times, an incident response flow template 40F, which records the flow of processing to be performed when the incident occurs, and an incident response procedure manual 40M, which records the procedures that engineers should take in accordance with the incident response flow template 40F, are registered in advance in the database 40DB (step S001). For example, since there are many attack patterns for cyber attacks, there are also many incident response flows.

[0019] FIG. 9 is a diagram showing the configuration of the alert response list 40A. The process then waits until an alert is input from the security monitoring system 20 (step S002-NO). When an alert is input from the security monitoring system 20 (step S002-YES), the incident response flow associating unit 41 selects a corresponding incident response flow template 40F from the alert ID of the input alert using the alert response list 40A (step S003).

[0020] Next, the incident response flow associating unit 41 requests the external data acquiring unit 45 to collect the logs and audit logs that are required to be investigated in the selected incident response flow template 40F (step S004).

[0021] The external data acquisition unit 45 collects log information such as the communication log 20LA, security log 20LB, equipment log 20LC, and alert log 20LD from the database 20DB of the security monitoring system 20, and further collects the audit log 30LA, which is the audit results of the equipment 10D and the terminals PC1-PC4, from the database 30DB of the audit support system 30, and passes them to the incident response flow linking unit 41 (step S005). Upon receiving this data, the incident response flow linking unit 41 automatically assigns the various acquired data to the necessary parts of the selected incident response flow template 40F (step S006).

[0022] After the various data have been substituted, the incident response flow template 40F is displayed on the screen by the display unit 42 as an incident response flow 40F1.

[0023] The engineer executes the process for the incident that has occurred in accordance with the incident response flow 40F1 displayed on the screen. The engineer can refer to a procedure selected from the incident response procedure manual 40M depending on the process.

[0024] Next, the operation of the information linking server 40 will be described using a specific example. FIG. 10 is a diagram showing the configuration of the incident response procedure manual 40M. 11 to 13 are diagrams showing the configuration of an incident response flow 40F1 when an alert ID3 (unauthorized access) occurs on the terminal PC3 of the instrumentation control system 10. FIG.

[0025] The process of generating an incident response flow 40F1 from the incident response flow template 40F when an alert ID3 (unauthorized access) occurs on terminal PC3 of instrumentation control system 10 will be described below with reference to FIGS. The abnormality detection unit 21 of the security monitoring system 20 constantly monitors the security log 20LB, and when it detects unauthorized access (incident) from terminal PC3 that has occurred in the instrumentation control system 10, the abnormality detection unit 21 outputs alert ID3 to the information linkage server 40 as an alert ID that identifies the unauthorized access.

[0026] Next, the incident response flow linking unit 41 of the information linkage server 40 that has received the alert ID 3 selects flow ID 3, which is the incident response flow template 40F that corresponds to the alert ID 3, based on the alert response list 40A shown in Fig. 9 that is stored in the database 20DB. As shown in Fig. 6, an incident response flow template 40F is prepared for each alert ID.

[0027] The area below line AA in Figure 11 to Figure 13 is the incident response flow 40F1 corresponding to alert ID 3. The incident response flow 40F1 reflects various data automatically acquired by the external data acquisition unit 45 for flow ID 3 of the incident response flow template 40F. The engineer proceeds with the incident response process while looking at this incident response flow 40F1 displayed on the screen.

[0028] When the technician clicks on "Procedure ID1" (see Figure 11, step A01) displayed on the screen, procedure ID1, "Procedure for isolating terminal," from the incident response procedure manual 40M shown in Figure 10 is displayed on the screen, and the technician can isolate terminal PC3 that is the subject of the alert by following the procedure. The procedures marked "AUTO" in the incident response procedure manual shown in Fig. 10 are procedures that allow the external data acquisition unit 45 to automatically acquire information corresponding to the alert ID. Therefore, when an engineer clicks on this procedure, the acquired target data is displayed on the screen and the details can be confirmed.

[0029] For example, it is known from the received alert ID3 that the terminal where unauthorized access occurred is PC3. Therefore, the incident response linking unit 41 automatically collects the resources of terminal PC3, which should be done in procedure ID10. Therefore, when this "Procedure ID10" (see step A01 in Figure 11) is clicked, the resource status is displayed on the screen. Similarly, when "Terminal audit log (procedure ID14)" is clicked, only the audit log of the target terminal PC3 is displayed on the screen from the audit log 30LA shown in Figure 6.

[0030] Regarding the analysis of the collected information (step A02 in Figure 11), the analysis can be performed automatically based on the collected data, or the data can be provided as information for the engineer to use in making a decision, and the decision itself can be made by the engineer using the data as a reference and selecting from the incident response procedure manual 40M and following the procedure displayed on the screen.

[0031] Furthermore, for example, if the engineer determines from step A03 in FIG. 12 that it is necessary to investigate other terminals PC1, PC2, and PC4, by selecting other specific terminals, the communication log 20LA, security log 20LB, and audit log 30LA for terminals other than terminal PC3 to which the alert was directly notified can also be automatically collected and investigated.

[0032] 14 is a diagram showing the analysis results of the health of each of the terminals PC1 to PC4 of the instrumentation control system 10. The states of the terminals PC1 to PC4 are evaluated automatically or semi-automatically as described above, as shown in FIG.

[0033] Furthermore, the engineer performs steps such as containing the terminal PC3 from step A04 onward shown in FIG. 13, following the incident response flow 40F1 and referring to the incident response procedure manual.

[0034] According to the incident response support system according to the first embodiment, an instrumentation control system having a terminal for monitoring and controlling equipment installed in a plant; a security monitoring system that collects logs from the instrumentation control system, detects incidents that occur in the instrumentation control system, and issues alerts; an audit support system having an audit execution unit that collects and audits the setting values ​​of the equipment and the terminal from the instrumentation control system, and an audit log that stores audit results; an information linking server that links the security monitoring system and the audit support system; The information sharing server comprises: an external data acquisition unit that acquires the log, the alert, and the audit log; an incident response linking unit that links and associates the data acquired by the external data acquisition unit with an incident response flow template, which is a template of a flowchart in which an engineer responds to the alert, to generate an incident response flow; The incident response flow and a display unit that selects from the incident response procedure manual the procedures that the engineer should take for individual operations in the incident response flow and displays them on a screen. When an incident occurs, it is possible to make highly accurate judgments and provide appropriate responses to engineers.

[0035] Furthermore, the logs are a communication log of the instrumentation control system, a security log of the instrumentation control system, an equipment log of the instrumentation control system, and an alert log of the alert that occurred in the instrumentation control system. Data collected by security monitoring systems can be easily reflected in incident response flows.

[0036] Furthermore, the communication log, security log, and equipment log are automatically substituted into the incident response flow template corresponding to the alert, thereby reducing the workload of engineers and shortening the time required to respond to incidents.

[0037] Furthermore, since the incident response flow includes a corresponding flow for the terminal or facility of the same type related to the alert, adverse effects on other facilities or terminals can be prevented in advance.

[0038] Furthermore, the incident response flow includes a containment flow that prevents the incident corresponding to the alert from spreading within the instrumentation control system, thereby preventing adverse effects on other equipment and terminals.

[0039] The servers, terminals, etc. that make up the instrumentation control system 10, security monitoring system 20, audit support system 30, and information linkage server 40 are configured with a processor 90 and a storage device 91, as shown in FIG. 15, which is an example of hardware. The storage device 91 includes a volatile storage device such as random access memory and a non-volatile auxiliary storage device such as flash memory, both not shown. Alternatively, a hard disk auxiliary storage device may be provided instead of flash memory. The processor 90 executes a program input from the storage device 91. In this case, the program is input to the processor 90 from the auxiliary storage device via the volatile storage device. The processor 90 may output data such as calculation results to the volatile storage device of the storage device 91, or may store the data in the auxiliary storage device via the volatile storage device.

[0040] Although the present disclosure describes exemplary embodiments, the various features, aspects, and functions described in the embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless variations not illustrated are contemplated within the scope of the technology of the present disclosure, including, for example, modifying, adding, or omitting at least one component.

[0041] Various aspects of the present disclosure are summarized below as appendices.

[0042] (Appendix 1) an instrumentation control system having a terminal for monitoring and controlling equipment installed in a plant; a security monitoring system that collects logs from the instrumentation control system, detects incidents that occur in the instrumentation control system, and issues alerts; an audit support system having an audit execution unit that collects and audits the setting values ​​of the equipment and the terminal from the instrumentation control system, and an audit log that stores audit results; an information linking server that links the security monitoring system and the audit support system; The information sharing server comprises: an external data acquisition unit that acquires the log, the alert, and the audit log; an incident response linking unit that links and associates the data acquired by the external data acquisition unit with an incident response flow template, which is a template of a flowchart in which an engineer responds to the alert, to generate an incident response flow; An incident response support system comprising the incident response flow and a display unit that selects from an incident response procedure manual the procedures that the engineer should take for individual operations in the incident response flow and displays them on a screen. (Appendix 2) The incident response support system described in Appendix 1, wherein the logs are a communication log of the instrumentation control system, a security log of the instrumentation control system, an equipment log of the instrumentation control system, and an alert log of the alert that occurred in the instrumentation control system. (Appendix 3) 3. The incident response support system according to claim 2, wherein the communication log, the security log, and the equipment log are automatically substituted into the incident response flow template corresponding to the alert. (Appendix 4) 4. The incident response support system according to claim 1, wherein the incident response flow includes a corresponding flow for the terminal and the equipment of the same type related to the alert. (Appendix 5) 5. The incident response support system according to any one of Supplementary Note 1 to Supplementary Note 4, wherein the incident response flow includes a containment response flow that prevents the incident corresponding to the alert from spreading within the instrumentation control system. [Explanation of symbols]

[0043] 100 Incident response support systems, 10 Instrumentation and control systems, 10D equipment, PC1, PC2, PC3, PC4 terminals, 20 Security monitoring system, 20DB database, 20LA communication log, 20LB security log, 20LC equipment log, 20LD alert log, 21 Anomaly detection unit, 30 Audit support system, 30DB database, 30LA audit log, 31 audit execution unit, 40 information sharing server, 40A Alert Response List, 40DB Database, 40F1 Incident Response Flow, 40M Incident Response Procedures, 41 Incident response linking unit, 42 Display unit, 43 Incident response procedure manual registration section, 44 Incident response flow template registration section, 45 External data acquisition unit, 50 Network, 90 Processor, 91 Storage device.

Claims

1. an instrumentation control system having a terminal for monitoring and controlling equipment installed in a plant; a security monitoring system that collects logs from the instrumentation control system, detects an incident that has occurred in the instrumentation control system, and issues an alert; an audit support system including an audit execution unit that collects and audits setting values ​​of the equipment and the terminal from the instrumentation control system, and an audit log that stores audit results; an information linking server that links the security monitoring system and the audit support system; The information sharing server includes: an external data acquisition unit that acquires the log, the alert, and the audit log; an incident response linking unit that links and associates the data acquired by the external data acquisition unit with an incident response flow template, which is a template of a flowchart in which an engineer responds to the alert, to generate an incident response flow; An incident response support system comprising the incident response flow and a display unit that selects from an incident response procedure manual the procedures that the engineer should take for individual operations in the incident response flow and displays them on a screen.

2. 2. The incident response support system according to claim 1, wherein the logs are a communication log of the instrumentation control system, a security log of the instrumentation control system, an equipment log of the instrumentation control system, and an alert log of the alert that has occurred in the instrumentation control system.

3. The incident response support system according to claim 2 , wherein the communication log, the security log, and the equipment log are automatically substituted into the incident response flow template corresponding to the alert.

4. The incident response support system according to claim 1 , wherein the incident response flow includes a corresponding flow for the terminal or facility of the same type related to the alert.

5. The incident response support system according to claim 1 , wherein the incident response flow includes a containment response flow that prevents the incident corresponding to the alert from propagating within the instrumentation control system.

Images