Incidence response support system and incident response support method

Abstract

To share records of response to incidents occurred in each organization, among a plurality of organizations while absorbing a difference in an information system of each organization and allowing for protection of sensitive and confidential information.SOLUTION: An incident response support system 1 performs leakage prevention processing on confidential information included in a record of an incident and a response record and performs structuring to generate a general-purpose playbook indicating response procedures to the incident from structured data independently of an information use organization. In addition, the incident response support system 1 generates a local playbook indicating one response procedure executable in the information use organization from the general-purpose playbook on the basis of information of information assets included in an information processing system of the information use organization.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an incident response support system and an incident response support method. [Background technology]

[0002] In recent years, the spread and use of information systems in organizations such as companies, government agencies, and public organizations has been progressing. As information systems become more widespread, cyber attacks have become more sophisticated and active. Attackers use various methods, such as unauthorized access, malware infection, phishing, and ransomware, to cause incidents that threaten the confidentiality, integrity, and availability of an organization's information assets. To deal with such incidents, organizations set up security operation centers that monitor information systems and detect attacks, and incident response centers that analyze attacks that have occurred and take measures such as containment and recovery.

[0003] However, with cyber attacks increasing daily, there is a lack of personnel and expertise to respond, and so various technologies have been devised to support incident response.

[0004] Patent Document 1 discloses a technology for supporting responses to incidents, which includes "a storage means for storing information about incidents that have occurred in the past in a computer system and a procedure for responding to the incident in association with each other, a first acquisition means for acquiring information about a new incident that has occurred in the computer system from a user, a second acquisition means for acquiring from the storage means a procedure for responding to the past incident that corresponds to the new incident based on the information acquired by the first acquisition means, and an update means for updating the procedure for responding acquired by the second acquisition means based on the acquired information." In other words, the technology disclosed in Patent Document 1 converts parts of the procedure for responding to similar incidents, such as the host name to be responded to, that differ for each incident into variables, making it possible to reuse the procedure for responding to similar past incidents when responding to a new incident.

[0005] Patent Document 2 also discloses that "By providing a method for separating knowledge for solving problems related to events and knowledge specific to an information system and linking the two, it becomes possible to generate a response procedure (playbook) in a format that is independent of the information system environment. This invention makes it possible to use the generated response procedure in various information systems." In other words, the technology disclosed in Patent Document 2 links response procedures for different information system environments and provides a response procedure in a format that is independent of the information system environment. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent Publication No. 2021-077220 [Patent Document 2] Patent Publication No. 2021-082083 Summary of the Invention [Problem to be solved by the invention]

[0007] In incident response support using procedures for handling past incidents, as in the above-mentioned conventional technology, by accumulating procedures for handling a variety of past incidents, it becomes easier to obtain procedures for handling incidents similar to a new incident. Attackers may carry out similar attacks on multiple organizations, and by accumulating the procedures for handling incidents of an organization that was attacked first, it is believed that other organizations can use the procedures for handling incidents when they are attacked later. In this way, it is believed that it is effective to accumulate procedures for handling past incidents among multiple organizations, rather than among a single organization.

[0008] On the other hand, different organizations have different information system environments, so it is difficult to apply the response procedures of one organization to other organizations in the same form. In addition, the response procedures may contain sensitive confidential information of the organization, making it difficult to share them easily.

[0009] For example, the technology disclosed in the above-mentioned Patent Document 1 cannot create a response procedure that corresponds to the information system environment that differs from organization to organization. Also, the technology disclosed in the above-mentioned Patent Document 2 does not have a function for protecting sensitive confidential information when sharing a response procedure.

[0010] In consideration of the above, the present invention aims to enable information sharing among multiple organizations of records of responses to incidents that occur in each organization while absorbing differences in the information systems of each organization and enabling the protection of sensitive confidential information. [Means for solving the problem]

[0011] As one aspect for solving the above problem, an incident response support system for sharing a response record for an incident related to an information processing system of an information providing organization, which is recorded by an incident management department of the information providing organization, as a response procedure for an incident related to the information processing system of the information using organization, which is recorded by an incident management department of the information using organization, is characterized in that the system has the following features: a first information processing unit that processes confidential information contained in the incident record and the response record to prevent leakage to the information using organization, and generates first processed information by adding additional information to the record and the response record based on information on information assets held by the information processing system of the information providing organization; a second information processing unit that processes the record and the response record contained in the first processed information in a different manner for each information using organization, and generates second processed information that has been structured; a general-purpose playbook creation unit that creates a general-purpose playbook indicating a response procedure for the incident from the record and the response record contained in the second processed information, independent of the information processing system of the information using organization; and a local playbook creation unit that generates a local playbook indicating the response procedure that can be executed by the information using organization from the general-purpose playbook, based on information on information assets held by the information processing system of the information using organization. Effect of the Invention

[0012] According to the present invention, records of responses to incidents that occur in each organization can be shared among a plurality of organizations while absorbing differences in the information systems of each organization and enabling the protection of sensitive confidential information. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of an incident response support system according to a first embodiment. [Diagram 2] FIG. 4 is a diagram showing an example of an information asset table according to the first embodiment. [Diagram 3] FIG. 4 is a diagram showing an example of an incident response record table according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of an incident table according to the first embodiment. [Diagram 5] FIG. 1 is a diagram showing an example of a general-purpose playbook table according to the first embodiment. [Figure 6] FIG. 2 is a diagram showing an example of a general-purpose playbook according to the first embodiment. [Figure 7] FIG. 11 is a flowchart showing an incident response information recording process according to the first embodiment. [Figure 8] FIG. 1 is a diagram showing a general-purpose playbook creation processing flow according to the first embodiment. [Figure 9] FIG. 4 is a diagram showing an incident response information utilization processing flow according to the first embodiment. [Figure 10] FIG. 13 is a diagram showing an example of an incident response information viewing screen according to the first embodiment. [Figure 11] FIG. 2 is a diagram for explaining an example of a method for presenting incident response support information according to the first embodiment. [Figure 12] FIG. 11 is a diagram showing an example of the configuration of an incident response support system according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are generally designated by the same reference numerals, and repeated explanations will be omitted. Note that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention.

[0015] In the following explanation, various information is explained in table format, but various information may be expressed in data structures other than tables. "XXX table" can be called "XXX information" because it does not depend on the data structure. The expression "ID" is used as information to identify records of various information, but "ID", "number", "identification information", "identifier", "name", etc. are interchangeable.

[0016] In the following explanation, the processing performed by a program may be described. A computer performs processing defined by a program using a processor (e.g., a CPU (Central Processing Unit), a GPU (Graphics Processing Unit)) while using memory in a main storage device, etc. Therefore, the processor may be the entity that performs processing by executing a program. The processor executes a program to realize a functional unit that performs processing.

[0017] Similarly, the subject of the processing performed by executing the program may be a controller, device, system, computer, or node having a processor. The subject of the processing performed by executing the program may be a computing unit, and may include a dedicated circuit that performs specific processing. The dedicated circuit is, for example, an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit).

[0018] In the following description, a program may be installed in a computer from a program source. The program source may be, for example, a program distribution server or a non-transitory storage medium readable by a computer. When the program source is a program distribution server, the program distribution server may include a processor and a storage resource (storage) for storing a program to be distributed, and the processor of the program distribution server may distribute the program to be distributed to other computers. In addition, in an embodiment, two or more programs may be realized as one program, and one program may be realized as two or more programs.

[0019] In the following embodiment, the system targets threat information as an example of information managed by the system, evaluates the threat information based on the trustworthiness of the information provider or information providing organization, and controls the settings of the security appliance as a process based on the content indicated by the threat information.

[0020] [Embodiment 1] (Configuration of Incident Response Support System 1) 1 is a diagram showing an example of a configuration of an incident response support system 1 according to embodiment 1. The incident response support system 1 is an information sharing system that supports the sharing of information related to incidents among a plurality of organizations.

[0021] The incident response support system 1 includes an information sharing platform 101, an information providing organization 102, and an information using organization 103. In this embodiment, the information providing organization 102 refers to an organization that provides information, members belonging to this organization, terminals operated by these members, and a system owned by this organization. The information using organization 103 refers to an organization that uses information provided by the information providing organization 102, members belonging to this organization, terminals operated by these members, and a system owned by this organization.

[0022] In this embodiment, the information providing organization 102 is described as an organization, terminal, and system to which the information is provided, and the information using organization 103 is described as an organization, terminal, and system that uses the provided information. However, the information using organization 103 may provide information, and the information providing organization 102 may use the provided information. There may be multiple information providing organizations 102 and multiple information using organizations 103. Furthermore, the various functions provided by the information sharing platform 101 and the data held by it may be possessed by each of the information providing organization 102 and the information using organization 103.

[0023] The incident response support system 1 is a system for efficiently sharing between organizations (organizations or individuals such as companies or public organizations) the response records of incidents that occur daily within the organization, such as identifying the cause, taking measures to prevent damage from spreading, or taking preventive measures. By sharing the response records, each organization can utilize the incident response know-how of other organizations, making it possible to prevent similar incidents and implement efficient responses.

[0024] The information sharing platform 101 consolidates, structures, and stores incident response records accumulated by an organization. Structuring the incident response records means extracting information on items with high importance as response records from the incident response records and organizing the information in a format such as a table.

[0025] The information sharing platform 101 also controls the information that can be accessed by each organization, and generates and stores a generic playbook, which is a response procedure related to the accumulated incident response records. A generic playbook is a common response procedure that does not depend on differences between organizations. In contrast to a generic playbook, a local playbook is a playbook that has been converted from the generic playbook into a format that can be used by each organization.

[0026] An information providing organization 102 transmits incident response records to the information sharing platform 101 for the purpose of reuse by other organizations.

[0027] When responding to an incident, the information using organization 103 uses the incident response records provided by the information providing organization 102 and stored in the information sharing platform 101, and general-purpose playbooks generated from the incident response records, to efficiently respond to the incident.

[0028] The information providing organization 102 includes functional units (programs) of an incident management unit 111, an information collection unit 112, and a first information processing unit 113, and an information asset table 131.

[0029] The incident management unit 111 is a program that records and manages incidents that occur in an organization. In general, an incident is raised in the form of a ticket by an operator who responds to the incident or by an alert function of a device that detects security threats. The operator then adds the corresponding exchanges to the ticket one by one as messages. This records who responded to a specific incident, when, and what kind of response was performed. The ticket also manages the status of the incident response, making it possible to manage whether or not the incident has been handled.

[0030] On the other hand, some organizations use simple chat applications to manage incidents. In such cases, the application generally does not have a function for managing the status of incident responses, so when the incident response is complete, the operator must explicitly leave a message indicating that the incident has been completed. In addition, some organizations may use other methods to manage incidents, but any method of managing incidents is acceptable.

[0031] The information collection unit 112 is a program that collects incident management records accumulated in the incident management unit 111. As described above, the incident management unit 111 may use different methods depending on the organization. Even if the same method (for example, a method using chat) is used, different applications may be used. The information collection unit 112 collects, from the incident response records, the incident ID, the message ID which is the exchange of responses to the incident, the posting time of the message, the ID of the message poster or system, the message body, etc.

[0032] The information collected by the information collecting unit 112 may include other items in addition to the above items, or may be partially missing. In addition, in the case of incident management by free description, information necessary for creating a general-purpose playbook, which will be described later, may be missing. The information collecting unit 112 may supplement the missing information with information specified by the incident management unit 111, or may send a message prompting the operator to input information and supplement the information with the contents input by the operator.

[0033] As described above, the information collection unit 112 absorbs the difference in the incident management method of the incident management unit 111 and collects necessary information.

[0034] The first information processing unit 113 is a program for generating first processed information obtained by processing the incidents and response records collected by the information collecting unit 112 from two perspectives.

[0035] The first viewpoint of information processing by the first information processing unit 113 is the viewpoint of preventing information leakage. The information output from the first information processing unit 113 is sent to the information sharing platform 101, and therefore is sent outside the organization. Therefore, the first information processing unit 113 performs processing such as deletion or masking on confidential information, such as company secret information, so as to prevent the information from leaking to other organizations. The processing can be performed by making a list of information that should not be leaked outside the company in advance and performing the processing only when the information matches the list, or by using regular expressions to perform the processing on data in a specific format.

[0036] The second viewpoint of information processing by the first information processing unit 113 is the viewpoint of generalizing expression. The first information processing unit 113 converts data expressed in an expression specific to the information providing organization 102, which is difficult for other organizations to understand, into an understandable form for the information using organization 103, using an information asset table 131 described later. For example, in an incident response record in which only the IP address of a device is recorded, the specific name of the device is added as additional information, so that the expression of the device is generalized and can be understood by other organizations.

[0037] The information asset table 131 stores information on devices owned by each of the information providing organization 102 and the information using organization 103. The information asset table 131 is information for each of the information providing organization 102 and the information using organization 103.

[0038] The information sharing platform 101 includes functional units (programs) of a second information processing unit 114, a similar incident search unit 115, a general-purpose playbook creation unit 116, and an access control unit 117. The information sharing platform 101 also includes table units of an incident response record table 132, an incident table 133, and a general-purpose playbook table 134.

[0039] The second information processing unit 114 is a program for generating second processed information by processing the incident and response record contained in the first processed information generated by the first information processing unit 113 from two perspectives.

[0040] The first viewpoint of information processing by the second information processing unit 114 is the viewpoint of creating data for each information using organization 103. The second information processing unit 114 creates data for each information using organization 103. This allows the second information processing unit 114 to provide different data to each information using organization 103, and by reducing the amount of information provided to a specific information using organization 103, for example, the concern of information leakage from the information providing organization 102 can be reduced.

[0041] The second viewpoint of information processing by the second information processing unit 114 is structuring of information. The second information processing unit 114 extracts data that is useful for other organizations to refer to from the incident response records and data necessary to enable processing performed by the similar incident search unit 115 and the general-purpose playbook creation unit 116, which will be described later. The second information processing unit 114 then creates an incident response record table 132 and an incident table 133 based on the extracted data.

[0042] The similar incident search unit 115 is a program that searches for similar incidents.

[0043] The general-purpose playbook creation unit 116 is a program that creates a general-purpose playbook using data from the incident response record table 132 described below.

[0044] The access control unit 117 is a program that controls access to the incident response record table 132 and the incident table 133 for the information user organization 103. Access control may be performed on an incident-by-incident basis, or on a specific attribute-by-specific basis within an incident.

[0045] The access control level, such as the content or range of permitted access to the incident response record table 132 and the incident table 133, is determined as follows: That is, the access control unit 117 performs access control using indices such as the impact of the incident, the likelihood (occurrence probability) of an incident occurring by each organization, and the reliability between the organizations.

[0046] Specifically, the access control unit 117 controls access to provide more information when the impact of the incident on other organizations is large, the likelihood of a similar incident occurring in a specific organization is high, or the information providing organization 102 trusts a specific information using organization 103. In contrast, the access control unit 117 controls access to restrict the provision of information when the impact of the incident on other organizations is small, the likelihood of a similar incident occurring in a specific organization is low, or the information providing organization 102 does not trust a specific information using organization 103.

[0047] The incident response record table 132 is a table for storing the response records included in the second processed information generated by the second information processing unit 114.

[0048] The incident table 133 is a table that stores data obtained by tallying up records relating to incidents included in the second processed information generated by the second information processing unit 114 for each incident.

[0049] The general-purpose playbook table 134 is a table that stores general-purpose playbooks created by the general-purpose playbook creation unit 116.

[0050] The information using organization 103 includes functional units (programs) of an incident management unit 111 and a local playbook creation unit 118, an incident response system 119 and a monitored system 120, and an information asset table 131.

[0051] The incident management unit 111 is a program that records and manages incidents that occur in an organization. When an incident occurs, an operator of the information using organization 103 manages the incident using the incident management unit 111. When dealing with the incident, the information using organization 103 refers to incidents that have occurred in other organizations in the past and uses a local playbook created by a local playbook creation unit 118, which will be described later, to deal with the incident efficiently.

[0052] The local playbook creation unit 118 is a program that uses the information asset table 131 to create a local playbook, which is a procedure that can be executed in each organization's information system, from the general-purpose playbook created by the general-purpose playbook creation unit 116.

[0053] The incident response system 119 is a system that executes the local play created by the local playbook creation unit 118. The incident response system 119 is generally a Security Orchestration, Automation and Response (SOAR).

[0054] The monitored system 120 is a group of devices that are the target of an incident response. The monitored system 120 may be a device in which an incident has occurred, or may include a security product or the like that is used to respond to the incident.

[0055] (Information Asset Table 131) FIG. 2 is a diagram showing an example of the information asset table 131 according to the first embodiment.

[0056] The information asset table 131 has fields for ID 201 , URL 202 , IP address 203 , host name 204 , vendor information 205 , category 206 , device name 207 , account 208 , and password 209 .

[0057] An ID 201 stores an identifier that uniquely identifies an information asset. A URL 202 stores a uniform resource locator (URL) for executing processing on each information asset. An IP address 203 stores an Internet Protocol address (IP address) of each information asset. A host name 204 stores a host name of each information asset. Vendor information 205 indicates the vendor of the device of the record identified by ID 201.

[0058] The category 206 stores the category of each information asset. The category 206 is determined based on the role of each information asset. The device name 207 stores the name used within an organization for each information asset. The device name 207 may be the role of each information asset, or may be a unique name used within an organization, such as "Product Y made by Company X."

[0059] An account for managing each information asset is stored in the account 208. A password required for managing each information asset using the account 208 is stored in the password 209. By using the URL 202, the account 208, and the password 209, it becomes possible to operate each information asset.

[0060] The information asset table 131 is also used to determine whether an incident that occurred in a certain organization is likely to occur in a specific organization. This is because there is a high probability that a similar attack will occur if the information asset configuration is the same. This probability is used as input information when the access control unit 117, which will be described later, performs access control.

[0061] (Incident Response Record Table 132) 3 is a diagram illustrating an example of the incident response record table 132 according to the embodiment 1. The incident response record table 132 stores each record of the incident response record included in the second processed information generated by the second information processing unit 114.

[0062] The incident response record table 132 has fields for ID 301, timestamp 302, poster 303, text 304, masked text 305, incident ID 306, and category 307. The incident response record table 132 also has fields for lifecycle 308, granularity 309, impact 310, reliability 311, action 312, attacked vulnerability 313, attack strategy 314, attack tactics 315, and IOC 316.

[0063] The ID 301 stores an identifier that uniquely identifies each message in the incident response record.

[0064] The time stamp 302 stores the date and time when each message was recorded in the incident management unit 111. The poster 303 stores an identifier that uniquely identifies the person or device that recorded each message in the incident management unit 111.

[0065] Text 304 stores the body of each message. Masked text 305 stores information in which part of the message body of each text 304 is masked. Masked text 305 is data that is stored in advance when different data is provided for each information using organization 103. In this embodiment, "Terminal A" in the message in text 304 is masked to become more general information, "Client terminal," but other data items in the message may be masked. Also, the target of masking may be something other than text 304. Also, there may be multiple columns in which the same masked column is masked to different degrees.

[0066] The incident ID 306 stores the value of ID 401 in the incident table 133, which will be described later. The category 307 stores the category of the incident being handled. The lifecycle 308 stores a value indicating which phase of incident response each message is in. The incident response phases may be classified using "preparation," "identification," "containment," "eradication," "recovery," and "lessons learned," as proposed by the SANS Institute, a U.S. company that specializes in the sale of information security training and the like, or other classification methods may be used.

[0067] Granularity 309 stores a value indicating the degree to which each message has sufficient specificity when used by other organizations in response to the lifecycle 308. The granularity value is set high when it is clear what was done, why, and how the response was made. The granularity value is also set high when the response method is described in machine-readable commands.

[0068] Impact 310 stores a value indicating the degree of impact when the impact of an incident is determined from each message. There are incidents that occur only in a specific organization and incidents that affect a variety of organizations. In this case, incidents related to the latter are considered to have a higher impact. Also, when dealing with an incident, for example, if only a terminal infected with malware needs to be isolated, and if the entire network of the organization needs to be shut down, the latter is considered to have a higher impact.

[0069] The reliability 311 stores the reliability of the message. For example, a method can be considered in which the reliability of a message recorded by an experienced operator is set high. The action taken by the operator is stored in the action 312. The vulnerability exploited 313 is stored as the vulnerability exploited by the attacker. The method of describing the vulnerability may use Common Vulnerabilities and Exposures (CVE) proposed by the US non-profit organization MITRE, or may be described in another method.

[0070] The attack strategy 314 stores the strategy used by the attacker. The attack tactics 315 stores the tactics used by the attacker. The attack strategy 314 and the attack tactics 315 may use the items of the ATT&CK matrix proposed by MITRE described above, or may be described in other ways. The IOC 316 stores an Indicator of Compromise (IOC), which is an indicator of an observed attack.

[0071] The values ​​of each item in the incident response record table 132 may be input by an operator in the incident management unit 111, or may be calculated mechanically from the contents of the text 304, for example.

[0072] (Incident Table 133) 4 is a diagram showing an example of the incident table 133 according to embodiment 1. The incident table 133 stores each record of the record related to the incident included in the second processed information generated by the second information processing unit 114.

[0073] The incident table 133 has fields for ID 401, incident flag 402, organization name 403, title 404, summary 405, masked summary 406, usefulness 407, category 408, lifecycle number 409, granularity 410, and impact 411. The incident table 133 also has fields for reliability 412, number of actions 413, attacked vulnerability 414, number of attack strategies 415, number of attack tactics 416, number of IOCs 417, and general-purpose playbook ID 418.

[0074] The ID 401 stores an identifier that uniquely identifies an incident. The incident flag 402 stores a value indicating whether each incident is an incident or not. The incident management unit 111 basically records incident responses, but depending on the organization, content other than incident responses may be recorded. The incident flag 402 is used to exclude anything other than incident responses. The organization name 403 stores the organization that handled each incident. The title 404 stores the title of each incident. The summary 405 stores a summary of each incident.

[0075] The masked summary 406 stores the summary 405 with part of the data masked. As with the masked text 305, it is stored in advance when the data to be provided to each information user organization 103 is changed. The usefulness 407 stores a value indicating whether each incident is useful to other organizations. The usefulness 407 is calculated based on the number of life cycles 409, granularity 410, impact 411, reliability 412, number of actions 413, number of attack strategies 415, number of attack tactics 416, and number of IOCs 417, which will be described later. The calculation method may treat each value equally, or may weight them.

[0076] The category 408 stores the category of the handled incident. The number of lifecycles 409 stores the number of types of phases stored in the lifecycle 308 of the incident response record corresponding to each incident. The granularity 410 stores the maximum value of the granularity 309 of the incident response record corresponding to each incident. The impact 411 stores the maximum value of the impact 310 of the incident response record corresponding to each incident.

[0077] The maximum value of the reliability 311 of the incident response record corresponding to each incident is stored in the reliability 412. The number of actions 413 stores the number of types stored in the action 312 of the incident response record corresponding to each incident. The attacked vulnerability 414 stores the value stored in the attacked vulnerability 313 of the incident response record corresponding to each incident.

[0078] The number of attack strategies 415 stores the number of types stored in the attack strategies 314 of the incident response record corresponding to each incident. The number of attack tactics 416 stores the number of types stored in the attack tactics 315 of the incident response record corresponding to each incident. The number of IOCs 417 stores the number of types stored in the IOCs 316 of the incident response record corresponding to each incident. The general-purpose playbook ID 418 stores the ID 501 of the general-purpose playbook table 134 described later.

[0079] (Generic Playbook Table 134) FIG. 5 is a diagram illustrating an example of the general-purpose playbook table 134 according to the first embodiment.

[0080] The general-purpose playbook table 134 has the following fields: ID 501, title 502, number of uses 503, usefulness 504, and handled incident ID 505.

[0081] ID 501 stores an identifier that uniquely identifies a general-purpose playbook. Title 502 stores the title of each general-purpose playbook. Number of uses 503 stores the number of times each general-purpose playbook has been used. Helpfulness 504 stores the degree to which each general-purpose playbook is useful. Helpfulness 504 can be calculated from feedback from users who have used each general-purpose playbook. Response incident ID 505 stores the value of ID 401 of the corresponding incident table 133.

[0082] (Generic Playbook 134PB) 6 is a diagram showing an example of a general-purpose playbook 134PB according to embodiment 1. The general-purpose playbook 134PB is generated from the incident table 133 and the incident response record table 132 generated by the second information processing unit 114. The general-purpose playbook 134PB shows a response procedure to an incident in a form independent of the information processing systems of the information providing organization 102 and the information using organization 103.

[0083] The general-purpose playbook 134PB lists the steps to take in response to an incident in the order in which they should be performed. The following items can be registered for each response step: [Application], [Action], and [Variable]. [Application] is used to register the application for which the procedure is to be executed. [Application] is registered by abstracting it at the granularity of category 206 in the information asset table 131. [Action] is used to register the function that the [Application] will execute. [Variable] is used to register the item that will be the input variable when executing the [Action]. If there is no applicable item, [Variable] will be "n / a".

[0084] Below, we will explain a generic playbook 134PB for a specific malware infection, as shown as an example in Figure 6.

[0085] In step S601 of the general-purpose playbook 134PB, devices infected with X malware are identified using Security Information Event Management (SIEM), a tool capable of aggregating log data from information systems and performing statistical processing.

[0086] In step S602 of the general-purpose playbook 134PB, the sites accessed by the infected device are listed using SIEM. This is because one of the attacker's procedures is to have the infected device communicate with a server prepared by the attacker on the Internet and control the infected device, and the sites accessed by the infected device may include malicious sites prepared by the attacker.

[0087] In step S603 of the general-purpose playbook 134PB, the maliciousness of the websites listed in step S602 is obtained using a threat intelligence service that provides services such as the maliciousness of sites on the Internet.

[0088] In step S604 of the general-purpose playbook 134PB, a setting is made to the FireWall (FW) device to block communication to highly malicious websites.

[0089] In this way, the general-purpose playbook 134PB is created by chronologically arranging the response records stored in the incident response record table 132 for each incident that is determined to be similar in the incident table 133 and the incident response record table 132.

[0090] (Incident response information recording processing) 7 is a diagram showing a flow of the incident response information recording process according to embodiment 1. The incident response information recording process is a process in which the information providing organization 102 records incident response information.

[0091] First, in step S701, when an incident occurs in an organization, the incident management unit 111 accepts the registration of the incident by an operator of the organization or a security product that detects the incident. Next, in step S702, the incident management unit 111 records a message such as the contents of the response to the incident by the operator of the organization or the security product.

[0092] Next, in step S703, the information collection unit 112 collects the incident response messages recorded in the incident management unit 111. The information collection unit 112 may collect the incident response messages from the incident management unit 111 every time an incident response message is recorded in the incident management unit 111 in step S702. Alternatively, the information collection unit 112 may collect the incident response messages from the incident management unit 111 periodically.

[0093] Next, in step S704, the first information processing unit 113 processes the incident response message collected by the information collecting unit 112 in step S703, by using the data in the information asset table 131. Next, in step S705, the first information processing unit 113 transmits the processed incident response message to the second information processing unit 114 of the information sharing platform 101.

[0094] Next, in step S706, the second information processing unit 114 processes the incident response message transmitted in step S705 by the first information processing unit 113. Next, in step S707, the second information processing unit 114 writes the incident response message processed in step S706 into the incident response record table 132.

[0095] Next, in step S708, the second information processing unit 114 aggregates the data recorded in the incident response record table 132 and writes the result to the incident table 133. Next, in step S709, the second information processing unit 114 determines whether the incident response has been completed. If the incident response has not been completed (step S709: No), the second information processing unit 114 returns the process to step S702. On the other hand, if the incident response has been completed (step S710: Yes), the second information processing unit 114 ends the incident response information recording process.

[0096] (General purpose playbook creation process) 8 is a diagram showing a general-purpose playbook creation processing flow according to embodiment 1. The general-purpose playbook creation processing is started after the incident response information recording processing flow (FIG. 7) ends.

[0097] First, in step S801, the similar incident search unit 115 calculates the similarity between an incident stored in the incident table 133 and a handled incident stored in the incident response record table 132. One method for calculating the similarity is to vectorize the text of the incident response record and find the cosine distance between the vectors of the new incident and the past incident.

[0098] Next, in step S802, the general-purpose playbook creation unit 116 determines whether a similar incident exists based on the similarity calculated in step S801 and whether a general-purpose playbook exists to deal with the similar incident. If a similar incident exists and a general-purpose playbook exists (step S802: Yes), the general-purpose playbook creation unit 116 ends the general-purpose playbook creation process. On the other hand, if a general-purpose playbook does not exist (step S802: No), the general-purpose playbook creation unit 116 proceeds to step S803.

[0099] In step S803, the general-purpose playbook creation unit 116 creates a general-purpose playbook 134PB by chronologically arranging the response records for similar incidents in the incident table 133 and the incident response record table 132. The response records are obtained from the incident response record table 132.

[0100] (Incident response information processing) 9 is a diagram showing a flow of incident response information utilization processing according to embodiment 1. In the incident response information utilization processing, the processing from steps S901 to S907 in the information utilization organization 103 is similar to the processing from steps S702 to S708 (FIG. 7) in the information providing organization 102.

[0101] Next, in step S908, the similar incident search unit 115 searches whether an incident similar to the incident that occurred in the information user organization 103 and was written to the incident table 133 in step S907 already exists in the incident table 133. The search for similar incidents is based on the degree of similarity similar to that in step S801.

[0102] Next, in step S909, the similar incident search unit 115 determines whether a similar incident exists. If a similar incident does not exist (step S909: No), the similar incident search unit 115 ends the incident response information usage process. On the other hand, if a similar incident exists (step S909: Yes), the similar incident search unit 115 proceeds to step S910.

[0103] In step S910, the access control unit 117 performs access control (authentication and authorization) from the first information processing unit 113 of the information using organization 103. Next, in step S911, the incident management unit 111 of the information using organization 103 acquires the general-purpose playbook 134PB of similar incidents and data of similar incidents for which access has been permitted from the information sharing platform 101. The incident management unit 111 presents the acquired data of similar incidents to the operator of the information using organization 103 via a terminal (not shown). Here, the data of similar incidents refers to the incident response record table 132, the incident table 133, the general-purpose playbook table 134, and the general-purpose playbook 134PB.

[0104] Next, in step S912, the local playbook creation unit 118 of the information using organization 103 creates a local playbook (not shown) from the general-purpose playbook 134PB acquired in step S911 and the information asset table 131 of the information using organization 103. The local playbook creation unit 118 localizes expressions generalized in the general-purpose playbook 134PB so that they can be used in the information using organization 103, using information on the information assets (information asset table 131) held by the information processing system of the information using organization 103. The local playbook creation unit 118 creates a local playbook in this manner.

[0105] Next, in step S913, the incident response system 119 refers to the local playbook created in step S912 and handles the incident either manually by an operator or automatically.

[0106] (Incident response information viewing screen 1001) 10 is a diagram showing an example of an incident response information viewing screen 1001 according to embodiment 1. The incident response information viewing screen 1001 is a screen displayed on a terminal (not shown) when an operator of the information using organization 103 searches for similar incidents in step S908 of the incident response information using process (FIG. 9).

[0107] An incident response information viewing screen 1001 includes a search window 1002 , an incident display section 1003 , and an incident response record display section 1004 .

[0108] The search window 1002 is used to input a search expression for filtering the contents to be displayed in an incident display field 1003 and an incident response record display field 1004. The incident display field 1003 displays the contents of the incident table 133. The incident response record display field 1004 displays the contents of the incident response record table 132.

[0109] (Method of presenting information to support incident response 1101) Fig. 11 is a diagram for explaining an example of an incident response support information presentation method 1101 according to the first embodiment. As the incident response support information presentation method 1101 in the incident response support system 1, there is a method as shown in Fig. 11. That is, when the incident management unit 111 records an exchange between the operator OP and an incident, the bot BT converts a general-purpose playbook for a similar incident into a local playbook for dealing with the incident and presents it as a chat.

[0110] (Effects of the First Embodiment) In the above embodiment, confidential information included in the incident record and the response record is processed to prevent leakage to the information using organization. Then, first processed information is generated by adding additional information to the incident record and the response record based on information on the information assets held by the information processing system of the information providing organization. Also, second processed information is generated by processing the incident record and the response record included in the first processed information differently for each information using organization and structuring the same. Then, a general-purpose playbook showing the response procedure for the incident is created from the incident record and the response record included in the second processed information, independent of the information processing system of the information using organization. Then, a local playbook showing the response procedure that can be executed by the information using organization is generated from the general-purpose playbook based on information on the information assets held by the information processing system of the information using organization.

[0111] Therefore, according to the first embodiment, records of responses to incidents that occur in each organization can be shared among multiple organizations while absorbing the differences between the information systems of each organization and enabling the protection of sensitive confidential information.

[0112] In the above-mentioned first embodiment, the content or range of the second processed information and the general-purpose playbook that can be viewed by the information using organization is determined according to the impact or occurrence probability of the incident in the information using organization. Then, the access by the information using organization to the second processed information and the general-purpose playbook is controlled according to the determined content or range. Therefore, according to the first embodiment, the access by each information using organization to the incident records, response records, and the general-purpose playbook can be appropriately controlled according to the usefulness of the incident records and response records for each information using organization, thereby reducing the risk of information leakage.

[0113] In the above-mentioned first embodiment, the information providing organization's system has a first information processing unit, the information sharing platform system has a second information processing unit and a general-purpose playbook creation unit, and the information using organization's system has a local playbook creation unit. Therefore, according to the first embodiment, the information sharing platform is independent of the information providing organization and the information using organization, thereby reducing the load of system construction and processing on the information providing organization and the information using organization. In addition, the handling of confidential information, etc. is closed on the information sharing platform, thereby efficiently reducing the risk of information leakage.

[0114] In the above-mentioned first embodiment, information required for creating a general-purpose playbook is collected from the response records and supplemented so as to absorb the difference in the incident management methods of each incident management department of the information providing organization and the information using organization. Therefore, even if the item names of the incident response records are different in each incident management department, information of substantially the same items is obtained, and if there is an item in the incident response record that is necessary but missing information, it is supplemented with an appropriate value. As a result, according to the first embodiment, the item values ​​of the response records required for creating a general-purpose playbook can be obtained from each incident management department that has a different method of managing the incident response records.

[0115] Moreover, the above-mentioned first embodiment includes an incident response system that responds to incidents recorded in an information using organization based on a local playbook. Therefore, according to the first embodiment, when an incident is input, the incident can be quickly and automatically or semi-automatically resolved using a local playbook created from a general-purpose playbook created based on the response records of similar incidents at the information providing organization. This reduces the burden on the system administrator of the information using organization when an incident occurs.

[0116] [Embodiment 2] 12 is a diagram showing an example of the configuration of an incident response support system 1B according to embodiment 2. In the incident response support system 1 of embodiment 1, the information sharing platform 101 is a system independent of the information providing organization 102 and the information using organization 103.

[0117] However, the present invention is not limited to this, and as in the second embodiment, the information providing organization 102B may include the functions of the information sharing platform 101. That is, the information providing organization 102B includes an incident management unit 111, an information collection unit 112, a first information processing unit 113, an information asset table 131, a second information processing unit 114, a similar incident search unit 115, a general-purpose playbook creation unit 116, and an access control unit 117. The information providing organization 102B also includes an incident response record table 132, an incident table 133, and a general-purpose playbook table 134.

[0118] In this embodiment, information providing organization 102B is an organization and system that provides information, and information using organization 103 is a system owned by an organization that uses the provided information. However, this is not limited to the above, and information using organization 103 may provide information by incorporating the functions of information sharing platform 101, and information providing organization 102B may use the provided information.

[0119] (Effects of the second embodiment) In the above-mentioned embodiment 2, the system of the information providing organization has a first information processing unit, a second information processing unit, and a general-purpose playbook creation unit, and the system of the information using organization has a local playbook creation unit. Therefore, according to embodiment 2, each organization accumulates incident information, and the information using organization processes the incident information when a general-purpose playbook is needed and sends it to the information providing organization, and receives the general-purpose playbook from the information providing organization. Then, a distributed form can be realized in which each organization has a general-purpose playbook that creates a local playbook that can be applied by the information using organization. In this way, by the information providing organization (and the information using organization) having the function of an information sharing platform, confidential information such as a general-purpose playbook is not aggregated in a single information sharing platform, so that the risk of sensitive information of all organizations being leaked by a single attack can be avoided.

[0120] Although one embodiment of the present disclosure has been described above in detail, the present disclosure is not limited to the above embodiment and can be modified in various ways without departing from the gist of the present disclosure. For example, the above embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all of the configurations described. In addition, it is possible to add, delete, or replace part of the configuration of the above embodiment with other configurations.

[0121] Furthermore, the above-mentioned configurations, functional units, processing units, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. The above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), an IC card, an SD card, a DVD, or other recording medium.

[0122] In addition, in each of the above figures, the control lines and information lines are shown as those considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the actual implementation. For example, it may be considered that almost all the components are actually connected to each other.

[0123] The above-mentioned arrangement of the functions and data of the information sharing platform 101, the information providing organizations 102 and 102B, and the information using organization 103 is merely an example. The arrangement of the functions and data may be changed to an optimal arrangement in terms of the performance of the hardware and software, processing efficiency, communication efficiency, and the like. [Explanation of symbols]

[0124] 1: Incident response support system, 101: Information sharing platform, 102: Information providing organization, 103: Information using organization, 111: Incident management department, 112: Information collection department, 113: First information processing department, 114: Second information processing department, 115: Similar incident search department, 116: General-purpose playbook creation department, 117: Access control department, 118: Local playbook creation department, 119: Incident response system, 120: Monitored system, 131: Information asset table, 132: Incident response record table, 133: Incident table, 134: General-purpose playbook table, 134PB: General-purpose playbook.

Claims

1. An incident response support system for sharing a response record for an incident related to an information processing system of an information providing organization, the response record being recorded by an incident management department of the information providing organization, as a response procedure for an incident related to an information processing system of the information using organization, the incident management department of the information using organization, the incident response support system comprising: a first information processing unit that processes confidential information included in the incident record and the response record to prevent leakage to the information using organization, and generates first processed information by adding additional information to the record and the response record based on information regarding information assets held by the information processing system of the information providing organization; a second information processing unit that processes the records and the corresponding records included in the first processed information in a different manner for each information using organization to generate structured second processed information; A general-purpose playbook creation unit that creates a general-purpose playbook indicating a response procedure for the incident from the record and the response record included in the second processed information, without relying on the information processing system of the information user organization; a local playbook creation unit that creates a local playbook indicating the response procedure that can be executed by the information user organization from the general-purpose playbook based on information on information assets held by the information processing system of the information user organization; An incident response support system comprising:

2. 2. The incident response support system according to claim 1, An access control unit that determines the content or range of the second processed information and the general-purpose playbook that can be viewed by the information using organization according to the impact or occurrence probability of the incident in the information using organization, and controls access to the second processed information and the general-purpose playbook by the information using organization according to the determined content or range. An incident response support system comprising:

3. 2. The incident response support system according to claim 1, The incident response support system includes: The information providing organization system, the information using organization system, and an information sharing platform system, The information providing organization system includes the first information processing unit, The information sharing platform system includes the second information processing unit and the general-purpose playbook creation unit, The information using organization system has the local playbook creation unit. An incident response support system characterized by:

4. 2. The incident response support system according to claim 1, The incident response support system includes: A system of the information providing organization and a system of the information using organization, The information providing organization system has the first information processing unit, the second information processing unit, and the general-purpose playbook creation unit, The information using organization system has the local playbook creation unit. An incident response support system characterized by:

5. 2. The incident response support system according to claim 1, An information collection unit that collects and supplements information necessary for creating the general-purpose playbook from the response records so as to absorb the difference in the incident management methods of the incident management units of the information providing organization and the information using organization. An incident response support system comprising:

6. 2. The incident response support system according to claim 1, An incident response system that implements a response to the incident recorded in the information using organization based on the local playbook. An incident response support system comprising:

7. 2. The incident response support system according to claim 1, The general-purpose playbook creation unit is The record included in the second processed information and the response record for the similar incident are arranged in chronological order to create the general-purpose playbook. An incident response support system characterized by:

8. 2. The incident response support system according to claim 1, The local playbook creation unit, The local playbook is created by localizing the expressions generalized in the general-purpose playbook so that they can be used in the information user organization by using information on information assets owned by the information processing system of the information user organization. An incident response support system characterized by:

9. An incident response support method executed by an incident response support system for sharing a response record for an incident related to an information processing system of an information providing organization, the response record being recorded by an incident management department of the information providing organization, as a response procedure for an incident related to the information processing system of the information using organization, the incident management department of the information using organization, the incident response support method comprising: a first information processing step of processing confidential information included in the incident record and the response record to prevent leakage to the information using organization, and generating first processed information by adding additional information to the incident and the response record based on information regarding information assets held by the information processing system of the information providing organization; a second information processing step of processing the records and the corresponding records included in the first processed information in a different manner for each information user organization to generate structured second processed information; A general-purpose playbook creation step of creating a general-purpose playbook indicating a response procedure for the incident from the record and the response record included in the second processed information without relying on the information processing system of the information user organization; a local playbook creation step of generating a local playbook indicating the response procedure executable by the information user organization from the general-purpose playbook based on information on information assets held by the information processing system of the information user organization; 1. An incident response support method comprising:

10. The incident response support method according to claim 9, An access control step of determining the content or range of the second processed information and the general-purpose playbook that can be viewed by the information using organization according to the impact or occurrence probability of the incident in the information using organization, and controlling access to the second processed information and the general-purpose playbook by the information using organization according to the determined content or range.

1. An incident response support method comprising:

11. The incident response support method according to claim 9, An information gathering step of collecting and supplementing information required for creating the general-purpose playbook from the response records so as to absorb differences in the incident management methods of the incident management departments of the information providing organization and the information using organization.

1. An incident response support method comprising:

12. The incident response support method according to claim 9, An incident response step of taking action against the recorded incident in the information using organization based on the local playbook.

1. An incident response support method comprising:

13. The incident response support method according to claim 9, In the generic playbook creation step, The record included in the second processed information and the response record for the similar incident are arranged in chronological order to create the general-purpose playbook.

13. An incident response support method comprising:

14. The incident response support method according to claim 9, In the local playbook creation step, The local playbook is created by localizing the expressions generalized in the general-purpose playbook so that they can be used in the information user organization by using information on information assets owned by the information processing system of the information user organization.

13. An incident response support method comprising:

Images