Internal fraud countermeasure

Abstract

To provide an internal fraud countermeasure system which prevents leakage of confidential information where a person with access rights to confidential information takes out confidential information in an unauthorized manner, since a huge loss will be suffered when confidential information is leaked to a competitor.SOLUTION: In an internal fraud countermeasure system, a monitoring system comprises: an access detection part for detecting an access to a folder in a storage; an account classification part for classifying an account having accessed a folder, into a system account, a system administrator or a user account, when an access to a folder is detected by the access detection part; and an access determination part which determines that an access is normal if the account classification part has classified the access into a system account, determines an access as normal if file recovery work has been carried out when the access has been classified into a system administrator, determines an access to be a fraudulent act if an operation excluding recovery work of the file has been conducted, and determines that a detailed investigation is necessary if an access has been classified as a user account.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention provides a technique for preventing leakage of confidential information due to internal fraud. [Background technology]

[0002] Patent Document 1 describes a technique for defining and protecting confidential information for each word or substring, and Patent Document 2 describes a technique for identifying files containing confidential information in an image format. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Application No. 2013-557322 [Patent Document 2] Special Publication No. 2017-531249 Summary of the Invention [Problem to be solved by the invention]

[0004] Information security incidents can be broadly categorized into those caused by system vulnerabilities / human vulnerabilities and those caused by an individual with access rights to information illegally taking out the information (internal fraud). If confidential information is leaked to a rival company, it can result in significant losses.

[0005] Patent Document 1 is a technology similar to DLP, which is in practical use as a measure against leaks of confidential information, but DLP is difficult to operate because it is difficult to define words and character strings that should be classified as confidential information. In addition, DLP can be circumvented by taking a screenshot of a file containing confidential information and saving it as an image.

[0006] For this reason, Patent Document 2 presents a technology for identifying confidential information by identifying files using images. However, there is a problem that if the accuracy of image identification is increased, this can be avoided by modifying the image, while if the accuracy of image identification is decreased, there is a high incidence of false positives. Therefore, a technology is needed that makes it easy to define confidential information, can detect images, has few false positives, and is resistant to file modification. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, the internal fraud prevention system of the present invention comprises a storage capable of granting access rights to folders for each account, and a monitoring system for monitoring the logs of the storage, the monitoring system comprising an access detection unit for detecting access to the folder of the storage, and an account classification unit for classifying the account accessing the folder of the storage into a system account, a system administrator, or a user account when the access detection unit detects access to the folder of the storage, and an access determination unit for determining that the access is normal if the account classification unit classifies the account as a system account, that the access is normal if the account classification unit classifies the account as a system administrator and performs file recovery work, and that the access is fraudulent if an operation other than file recovery work is performed, and that a detailed investigation is necessary if the account classification unit classifies the account as a user account.

[0008] The internal fraud prevention system includes an endpoint operated by a user, a network device that controls communication between an organization's network and the Internet, and a mail server. The monitoring system monitors the logs of the endpoints, the logs of the network devices, and the logs of the mail server. When the access determination unit determines that a detailed investigation is necessary, the monitoring system includes a file name recording unit that obtains and records from the endpoint logs the file name when a file in a folder of the storage is saved to the endpoint, the file name when data copied from a file in the folder of the storage is pasted into a file on the endpoint, and the file name when a screenshot taken while accessing the folder of the storage is saved to the endpoint.

[0009] The monitoring system is provided with a change history recording unit which acquires and records, from the log of the endpoint, the changed file name if the file name recorded in the file name recording unit is changed, the copied file name if the file is copied, the file name into which the data is pasted if data within a file is copied and pasted, the compressed / encrypted file name if the file is compressed / encrypted, and the file name into which the screenshot is saved if a screenshot is taken while the file is open.

[0010] The device is provided with an external take-out detection unit which detects, from the endpoint log, the network device log, and the mail server log, that a file with a file name recorded in the file name recording unit or the change history recording unit has been saved to a medium, uploaded to a website, or attached to an email.

[0011] The monitoring system includes a whitelist registration unit that registers website URLs and email addresses that are permitted as legitimate destinations for storing files for business purposes, and if the destination of a file detected by the external take-out detection unit is a website that is not registered in the whitelist registration unit, or an email or media that includes an unregistered email address in its destination, the monitoring system determines that the activity is fraudulent.

[0012] The internal fraud prevention system includes a storage device having a confidentiality level setting unit that sets a high confidentiality level for a folder that stores confidential information and a low confidentiality level for a folder that does not store confidential information, and a movement restriction unit that prohibits the movement of a file from a folder to which a high confidentiality level has been set by the confidentiality level setting unit to a folder to which a low confidentiality level has been set. Effect of the Invention

[0013] According to the internal fraud prevention system of the present invention, it is possible to prevent leakage of confidential information due to internal fraud. [Brief description of the drawings]

[0014] [Figure 1] 1 is a diagram illustrating a schematic configuration of an internal fraud prevention system according to an embodiment of the present invention. [Diagram 2] 11 is a flowchart illustrating an example of processing by the internal fraud prevention system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of an internal fraud prevention system according to the present invention will be described with reference to the drawings.

[0016] FIG. 1 is a diagram illustrating an outline of an internal fraud prevention system.

[0017] The internal fraud prevention system 100 is composed of a storage 1 , a monitoring system 2 , an endpoint 3 , a network device 4 , and a mail server 5 .

[0018] The storage 1 includes a security level setting unit 6 and a movement restriction unit 7 .

[0019] The monitoring system 2 includes an access detection unit 8, an account classification unit 9, an access determination unit 10, a file name recording unit 11, an update history recording unit 12, an external take-out detection unit 13, and a whitelist recording unit 14.

[0020] The internal fraud prevention system 100 includes a storage 1 capable of granting access rights to folders on an account-by-account basis, and a monitoring system 2 monitoring the logs of the storage 1, in order to prevent internal fraud by monitoring operations performed when a user is accessing a folder. The monitoring system 2 includes an access detection unit 8 that detects access to the folder of the storage 1, and an account classification unit 9 that classifies the account that accessed the folder of the storage 1 into a system account, a system administrator, or a user account when the access detection unit 8 detects access to the folder of the storage 1. The account classification unit 9 is further configured to determine that the access is normal if the account is classified as a system account, determine that the access is normal if the account is classified as a system administrator and performs file recovery operations, and determine that the access is fraudulent if operations other than file recovery operations are performed, and determine that a detailed investigation is necessary if the account is classified as a user account.

[0021] As an example of a method for classifying accounts by the account classification unit 9 of the monitoring system 2, there is a method of adding account type information in a database that manages account information and referencing this. Alternatively, there is a method of determining a naming rule for account names that can identify the account type and judging the account type from the account name.

[0022] Since there is a possibility that user accounts may illegally take out information, the internal fraud prevention system 100 includes an endpoint 3 operated by the user, a network device 4 that controls communication between the organization's internal network and the Internet, and a mail server 5. The monitoring system 2 monitors the logs of the endpoint 3, the logs of the network device 4, and the logs of the mail server 5. When the access determination unit 10 determines that a detailed investigation is necessary, the system is provided with a file name recording unit 11 that obtains from the log of the endpoint 3 and records the file name when a file in a folder of storage 1 is saved to endpoint 3, the file name when data copied from a file in a folder of storage 1 is pasted into a file on endpoint 3, and the file name when a screenshot taken while accessing the folder of storage 1 is saved to endpoint 3.

[0023] It is desirable that the monitoring of accesses to folders in the storage 1 by the access detection unit 8 of the monitoring system 2 be limited to folders in which confidential information is saved.

[0024] Since there is a possibility that a user account may perform operations such as changing the file name to make tracking difficult after downloading a file from the storage 1 to the endpoint 3, the monitoring system 2 is provided with a change history recording unit 12 which acquires and records, from the log of the endpoint 3, the changed file name if the file name recorded in the file name recording unit 11 has been changed, the copied file name if the file has been copied, the file name to which the data has been pasted if data in the file has been copied and pasted, the compressed / encrypted file name if the file has been compressed / encrypted, and the file name to which a screenshot taken while the file is opened is saved, and is provided with an external take-out detection unit 13 which detects, from the log of the endpoint 3, the log of the network device 4, and the log of the mail server 5, that a file with a file name recorded in the file name recording unit 11 or the change history recording unit 12 has been saved to a medium, uploaded to a website, or attached to an email.

[0025] The above-mentioned media refers to portable USB-connected devices and media used as external recording media on computers, such as CDs / DVDs / BDs, and the above-mentioned websites include web services that allow files to be uploaded, such as cloud storage, SNS, and FTP servers.

[0026] Since uploading confidential information to a website or sending it as an attachment to an e-mail is an essential business activity, the monitoring system 2 is provided with a whitelist registration unit 14 in which website URLs and e-mail addresses permitted as destinations for legitimate business data are registered, and if the destination of a file detected by the external take-out detection unit 13 is a website not registered in the whitelist registration unit 14, or e-mail or media whose destination includes an unregistered e-mail address, it is determined to be a fraudulent activity.

[0027] The endpoints 3 operated by users are personal computers such as PCs, tablets, and smartphones that may be used for work. The network devices 4 that control communication between the organization's network and the Internet are devices with functions such as firewalls, proxies, L3 switches, and VPN gateways, but since they are called by a wide range of names, they are referred to as network devices. The mail servers 5 are not limited to on-premise servers, but include servers running mail services provided by the cloud.

[0028] Since the confidential information that can be accessed depending on the user's job and the extent to which the confidential information is shared vary depending on the user's job, the websites and email addresses registered in the whitelist registration unit 14 of the monitoring system 2 are set for each account, and when they are no longer needed, it is preferable to delete the registration as soon as possible, and a regular inventory should be conducted to keep them up to date.

[0029] Folders in storage 1 must be classified into folders that store confidential information and are subject to monitoring by monitoring system 2, and folders that do not store confidential information and are not subject to monitoring by monitoring system 2, and restrictions must be put in place to prevent files from being moved between monitored folders and non-monitored folders.

[0030] For this reason, the storage 1 is provided with a confidentiality level setting unit 6 that sets a high confidentiality level for folders that store confidential information and a low confidentiality level for folders that do not store confidential information, and a movement restriction unit 7 that prohibits the movement of a file from a folder to which a high confidentiality level has been set by the confidentiality level setting unit 6 to a folder to which a low confidentiality level has been set.

[0031] This concludes the description of the configuration of the internal fraud prevention system 100. Below, the operation of the internal fraud prevention system 100 will be described with reference to the flowchart in FIG.

[0032] In step S1, the access detection unit 8 of the monitoring system 2 detects an access to a folder in the storage 1.

[0033] In step S2, the account classification unit 9 of the monitoring system 2 classifies the account that has accessed the folder in the storage 1. If the account is a system account, the process proceeds to step S3, if the account is a system administrator account, the process proceeds to step S4, and if the account is a user account, the process proceeds to step S6.

[0034] In step S3, the monitoring system 2 determines that the access to the folder in the storage 1 is normal.

[0035] In step S4, if the operation performed when the folder was accessed was a file recovery operation, the process proceeds to step S3, and if the operation was other than a file recovery operation, the process proceeds to step S5.

[0036] In step S5, the monitoring system 2 determines that the access to the storage 1 is an unauthorized act.

[0037] In step S6, the file name recording unit 11 of the monitoring system 2 obtains and records, from the log of the endpoint 3, the file name when the file in the folder of storage 1 is saved to the endpoint, the file name when data copied from the file in the folder of storage 1 is pasted into the file on the endpoint 3, and the file name when the screenshot taken while accessing the folder of storage 1 is saved to the endpoint.

[0038] In step S7, the change history recording unit 12 of the monitoring system 2 records, from the log of the endpoint 3, the changed file name if the file name of the file recorded in the file name recording unit 11 has been changed, the copied file name if the file has been copied, the pasted file name if data within the file has been copied and pasted, the compressed / encrypted file name if the file has been compressed / encrypted, and the destination file name for the screenshot if a screenshot was taken while the file was open.

[0039] In step S8, the external take-out detection unit 13 of the monitoring system 2 detects from the logs of the endpoint 3, the logs of the network device 4, and the logs of the mail server 5 that a file with a file name recorded in the file name recording unit 11 and the change history recording unit 12 has been uploaded to a website, attached to an email, or saved to media.

[0040] In step S9, if the destination of the file detected by the external take-out detection unit 13 of the monitoring system 2 is a website registered in the whitelist registration unit 14, or an email whose destination includes an email address, the process proceeds to step S10; if the destination is a website not registered in the whitelist registration unit 14, or an email or media whose destination includes an email address, the process proceeds to step S11.

[0041] In step S10, the take-out detection unit 13 of the monitoring system 2 determines that the take-out of the file detected is a normal operation.

[0042] In step S11, the person who manages the person who saved the file confirms whether the website where the file was saved or the destination email address of the email detected by the external take-out detection unit 13 of the monitoring system 2 is a legitimate destination for business purposes. If it is a legitimate website or email address, the process proceeds to step S12, and if it is an illegitimate website or email address, or if the destination of the file is media, the process proceeds to step S5.

[0043] In step S12, the URL or email address of the website detected by the external take-out detection unit 13 of the monitoring system 2 is registered in the whitelist registration unit 14. [Industrial Applicability]

[0044] The internal fraud prevention system according to the present invention is suitable for preventing the leakage of confidential information due to internal fraud. [Explanation of symbols]

[0045] 1. Storage 2. Surveillance System 3. Endpoints 4. Network Devices 5. Mail Server 6. Confidentiality Level Setting Section 7. Movement restriction section 8 Access detection unit 9 Account Classification Section 10 Access Judgment Unit 11 File name recording section 12 Change History Record Section 13. External Removal Detection Unit 14 Whitelist Recording Section

Claims

1. A storage device capable of granting access rights to folders for each account and a monitoring system for monitoring the logs of the storage device are provided. the monitoring system includes an access detection unit that detects access to a folder in the storage; and an account classification unit that classifies an account that has accessed the folder of the storage into a system account, a system administrator, or a user account when the access detection unit detects an access to the folder of the storage. An internal fraud prevention system characterized by the above.

2. The monitoring system further includes an access determination unit which determines that the access is normal when the account classification unit classifies the account as a system account, determines that the access is normal when a file recovery operation is performed when the account classification unit classifies the account as a system administrator, determines that an unauthorized act is performed when an operation other than a file recovery operation is performed, and determines that a detailed investigation is necessary when the account classification unit classifies the account as a user account. The internal fraud prevention system according to claim 1 .

3. The internal fraud prevention system includes an endpoint operated by a user, a network device that controls communication between an internal network and the Internet, and a mail server; The monitoring system monitors the logs of the endpoints, the logs of the network devices, and the logs of the mail server, and when the access determination unit determines that a detailed investigation is necessary, the monitoring system includes a file name recording unit that obtains and records, from the logs of the endpoints, the file names of files in the folders of the storage when the files are saved in the endpoints, the file names of files when data copied from the files in the folders of the storage are pasted in the files of the endpoints, and the file names of screenshots taken while accessing the folders of the storage when saved in the endpoints. The internal fraud prevention system according to claim 2 .

4. The monitoring system includes a change history recording unit which acquires and records, from the log of the endpoint, the changed file name when the file name recorded in the file name recording unit is changed, the copied file name when the file is copied, the file name where the data is pasted when data in the file is copied and pasted, the compressed / encrypted file name when the file is compressed / encrypted, and the file name where the screenshot is saved when a screenshot is taken while the file is opened. The internal fraud prevention system according to claim 3,

5. and an external take-out detection unit that detects, from the log of the endpoint, the log of the network device, and the log of the mail server, that a file having a file name recorded in the file name recording unit or the change history recording unit has been saved to a medium, uploaded to a website, or attached to an email. The internal fraud prevention system according to claim 4,

6. The monitoring system includes a whitelist registration unit that registers URLs and email addresses of websites that are permitted as legitimate file storage destinations for business purposes, When the destination of the file detected by the external take-out detection unit is a website not registered in the whitelist registration unit, an email address that includes an unregistered email address as a destination, or media, it is determined to be an illegal act. The internal fraud prevention system according to claim 5 .

7. a storage device including a confidentiality level setting unit that sets a high confidentiality level for a folder that stores confidential information and sets a low confidentiality level for a folder that does not store confidential information; A transfer restriction unit is provided for prohibiting the transfer of a file from a folder to which a high security level is set by the security level setting unit to a folder to which a low security level is set. An internal fraud prevention system characterized by the above.

Images