Cyber-security evaluation device, cyber-security evaluation method, and cyber-security evaluation program

Abstract

To accurately estimate damage and influence to a system when an attack scenario has occurred.SOLUTION: A cyber-security evaluation device 1 includes: a generation unit which generates, on the basis of system configuration information and system confidential information 23 held by a plurality of devices constituting the system, a pattern of cyber attack which can be implemented to a plurality of virtual devices simulating a plurality of devices, attacker confidential information 24 expected to be held by a plurality of virtual attacker devices, and an attack scenario 25 containing system confidential information 23 that can be acquired by cyber attack; an updating unit which performs update by adding the system confidential information 23 being acquired from any of the plurality of virtual devices by the cyber attack of the attack scenario 25 to the attacker confidential information 24; and an evaluation unit which evaluates influence to a business in the system on the basis of a state of each of virtual devices when the attack scenario 25 is implemented, and a system model 28 which reproduces an operation condition of the business in the virtual system.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a cybersecurity evaluation device, a cybersecurity evaluation method, and a cybersecurity evaluation program. [Background technology]

[0002] To counter advanced targeted attacks against control systems, it is effective to conduct risk assessment based on attack scenarios and take measures to prevent high-risk attack scenarios from occurring. The security of control systems requires three requirements: confidentiality, integrity, and availability.

[0003] Confidentiality refers to maintaining the confidentiality of control programs and systems. Integrity refers to ensuring that data is not tampered with. Availability refers to equipment continuing to operate normally. In order for attackers to violate integrity and availability, they often take steps to gather the necessary information by violating confidentiality in advance. The attacks that attackers can carry out vary depending on the confidentiality violation and collection phases they have gone through.

[0004] For example, Patent Document 1 describes a method for generating an attack scenario by evaluating attack tactics and techniques based on the characteristics of a target system and an attacker, and combining the attack tactics and techniques based on the evaluation. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2022-76159 A Summary of the Invention [Problem to be solved by the invention]

[0006] According to the invention of Patent Document 1, it is possible to reproduce an attack scenario from a patterned attacker's behavior (kill chain) and a system configuration. However, since there is no causal relationship between attack phases, there is a risk that an unrealistic scenario will be generated in which a desired attack (parameter tampering, etc.) can be executed against a PLC (Programmable Logic Controller) or the like, even if there is no appropriate confidentiality violation and collection phase in advance. In reality, cyber attacks on the devices that make up a system can be launched by collecting information in a chain reaction, even without collecting appropriate information in advance. In the past, such attack patterns were not anticipated, leading to the creation of a large number of unrealistic attack scenarios. This makes it difficult to accurately assess the damage caused by an attack that violates confidentiality, and makes it difficult to prioritize attack scenarios.

[0007] Therefore, an object of the present invention is to accurately evaluate the impact on business operations, including damage to a system, when an attack scenario occurs. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the cybersecurity evaluation device of the present invention is characterized in that it comprises a generation unit that generates an attack scenario including cyberattack patterns that can be carried out against virtual multiple devices simulating the multiple devices constituting the system, attacker confidential information that is assumed to be possessed by a virtual attack device that carries out the cyberattack, and the system confidential information that can be obtained by a cyberattack, based on system configuration information and system confidential information held by the multiple devices constituting the system; an update unit that updates the system confidential information obtained from any of the virtual multiple devices by the cyberattack of the attack scenario by adding it to the attacker confidential information; an evaluation unit that evaluates the impact on business when a cyberattack of the attack scenario occurs, based on a system model that reproduces the state of the virtual multiple devices when the attack scenario is implemented and the operation status of business in a virtual system composed of the virtual multiple devices; and an output unit that displays the impact on the business evaluated by the evaluation unit.

[0009] The cybersecurity evaluation method of the present invention is characterized in that it includes a step in which a generation unit generates an attack scenario based on system configuration information and system confidential information held by a plurality of devices constituting the system, the attack scenario including cyberattack patterns that can be carried out against a virtual plurality of devices simulating the plurality of devices, attacker confidential information that is assumed to be held by a virtual attack device that carries out the cyberattack, and the system confidential information that can be obtained by a cyberattack; a step in which an update unit updates the system confidential information virtually obtained from any of the virtual plurality of devices by the cyberattack of the attack scenario by adding it to the attacker confidential information; a step in which an evaluation unit evaluates the impact on business when a cyberattack of the attack scenario occurs based on a system model that reproduces the state of the virtual plurality of devices when the attack scenario is implemented and the operation status of business in a virtual system composed of the virtual plurality of devices; and a step in which an output unit displays the impact on the business evaluated by the evaluation unit.

[0010] The cybersecurity evaluation program of the present invention causes a computer to execute the following steps: generating an attack scenario including cyberattack patterns that an attacker can launch against multiple devices, attacker confidential information held by an attacking device that carries out a cyberattack, and the system confidential information that can be obtained through a cyberattack, based on system configuration information and system confidential information that is necessary for a cyberattack and is held by multiple devices that constitute the system; updating the attacker confidential information by adding the system confidential information obtained from any of the multiple devices through the cyberattack of the attack scenario to the attacker confidential information held by the attacker; evaluating the impact on business when a cyberattack of the attack scenario occurs, based on a system model that reproduces the state of the devices that constitute the system and the operation status of business in the system when the attack scenario is implemented; and displaying the impact on business. Other means will be described in the description of the embodiment of the invention. Effect of the Invention

[0011] According to the present invention, when an attack scenario occurs, it becomes possible to accurately evaluate the impact on business operations, including damage to a system. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a hardware configuration diagram of a cybersecurity evaluation device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a conceptual diagram illustrating the operation of the cybersecurity evaluation device. [Diagram 3] FIG. 2 is a logical configuration diagram of the cybersecurity evaluation device. [Figure 4] FIG. 1 is a diagram illustrating the configuration of a system to be evaluated. [Diagram 5] 13 is a flowchart of an attack scenario evaluation process. [Figure 6] FIG. 2 is a diagram showing system configuration data to be evaluated. [Figure 7]FIG. 11 is a diagram showing a device type ID. [Figure 8] FIG. 1 is a mode transition diagram of an attack scenario. [Figure 9] FIG. 13 is a diagram showing attack patterns. [Figure 10] FIG. 1 illustrates confidential information stored in the system. [Figure 11] FIG. 11 is a diagram showing a status code. [Figure 12] FIG. 13 is a diagram showing an analysis condition setting screen. [Figure 13] FIG. 2 illustrates the operation of a system model operator. [Figure 14] 1 is a time series graph of system performance indicators. [Figure 15] FIG. 1 illustrates an example of an attack scenario. [Figure 16] FIG. 13 is a diagram illustrating an example of an evaluation result of an attack scenario. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a hardware configuration diagram of a cybersecurity evaluation device 1 according to this embodiment. The cybersecurity evaluation device 1 includes a CPU (Central Processing Unit) 31, a memory 32, an input / output interface 33, and a storage device 2. The cybersecurity evaluation device 1 can accurately evaluate the damage impact on a system when an attack scenario occurs. In particular, in a control system, the cybersecurity evaluation device 1 can accurately evaluate the damage impact on business continuity. Note that the present invention may be realized not only as a single cybersecurity evaluation device 1, but also as a cybersecurity evaluation system that combines multiple devices equipped with each functional unit. The cybersecurity evaluation program may be stored in a storage medium and provided so as to be installable on a computer.

[0014] The CPU (Central Processing Unit) 31 is a central processing unit that executes the attack scenario evaluation program 21 to realize each of the functional units described below. The memory 32 stores information, and is, for example, a random access memory (RAM) or a read only memory (ROM).

[0015] The input / output interface 33 is, for example, a graphic card, a USB (Universal Serial Bus) host controller, a network interface card, etc. The input / output interface 33 allows the CPU to receive information input from an input device 35 and to display the information on a display device 36.

[0016] The storage device 2 stores information, and is, for example, a solid state drive (SSD) or a hard disk. The storage device 2 stores an attack scenario evaluation program 21, system configuration information 22, system confidential information 23, attacker confidential information 24, attack scenarios 25, attack patterns 26, evaluation results 27, and a system model 28. The attack scenario evaluation program 21 is a software program executed by the CPU 31 .

[0017] The system configuration information 22 is configuration information of the system to be evaluated by the cybersecurity evaluation device 1. The system confidential information 23 is confidential information stored in each device constituting the evaluation target system. The attacker confidential information 24 is confidential information assumed to be possessed by a hypothetical attacker or attack device evaluated by the cybersecurity evaluation device 1. The attack scenario 25 includes a series of cyber attacks evaluated by the cybersecurity evaluation device 1 and the system confidential information 23 acquired by the cyber attacks. A cyber attack refers to an attack on an information terminal such as a server, a personal computer, or a smartphone via a network such as the Internet, with the aim of stealing money or personal information or stopping the function of the system. The evaluation target system is, for example, a business system managed by a customer or a system that provides a service to a user via the Internet. The cybersecurity evaluation device 1 of this embodiment performs a simulation of a cyber attack based on confidential information stored in each device constituting the evaluation target system, and therefore evaluates the attack scenario without accessing the actual evaluation target system.

[0018] Attack pattern 26 is a series of cyber attacks evaluated by this cybersecurity evaluation device 1, and constitutes a part of attack scenario 25. Evaluation result 27 is the result of the attack evaluated by this cybersecurity evaluation device 1. System model 28 indicates the state and operation state of the system, and can reproduce the operation status of business in the system based on the time-series data of the equipment state and the recovery time of the equipment stored in the system configuration.

[0019] FIG. 2 is a conceptual diagram of the operation of the cybersecurity evaluation device 1. The generating unit 41, the updating unit 44, and the evaluating unit 43 are realized by the CPU 31 in FIG.

[0020] The generation unit 41 generates an attack scenario 25 including an attack pattern 26 of a cyber attack that a virtual attacker or attack device can perform against a plurality of devices, attacker confidential information 24 that is assumed to be possessed by a virtual attack device that performs a cyber attack, and system confidential information 23 that can be acquired by a cyber attack, based on configuration information of the system and system confidential information 23 that is necessary for a cyber attack and is held by a plurality of devices that constitute the system. The generation unit 41 accesses the attack pattern 26, the attacker confidential information 24, and the system confidential information 23. The generation unit 41 transmits the attack scenario 25 that it has generated to the update unit 44. The plurality of devices handled by the generation unit 41 are, for example, virtual devices that simulate devices that constitute the system, or actual devices that constitute the system. The attack devices handled by the generation unit 41 are virtual devices that simulate devices that perform a cyber attack, or actual devices that perform a cyber attack.

[0021] The generation unit 41 generates an attack scenario 25 based on a state in which a virtual attacker or attacking device already possesses the attacker confidential information 24. The generation unit 41 repeatedly generates the attack scenario 25 so as to attack a virtual device that has become newly attackable due to the attacker confidential information 24 updated by the update unit 44 described below. The generation unit 41 stops generating the attack scenario when there is no virtual device that has become newly attackable due to the attacker confidential information 24 updated by the update unit 44. This allows the generation unit 41 to easily determine the conditions for stopping the generation of the attack scenario 25 and finish the simulation in a short time.

[0022] The generation unit 41 generates an attack scenario 25 so that a cyber-attack is made on one of the virtual devices constituting the system, the system confidential information 23 is obtained from the virtual device, and another virtual device that can be newly attacked is attacked using the system confidential information 23. This makes it possible to evaluate a situation in which an attacker or an attacking device launches a cyber-attack on each device in a succession manner.

[0023] The generation unit 41 generates the attack scenario 25 within a predetermined number of hops. Here, the number of hops refers to the number of devices that will be attacked before invading the final target device. By generating the attack scenario 25 within a predetermined number of hops, the attack scenario 25 is within a range that can actually occur, and the simulation of the attack scenario 25 can be completed in a short time.

[0024] The update unit 44 updates the system confidential information 23 acquired from any one of the virtual multiple devices through a cyber attack based on the attack scenario 25 by adding it to the attacker confidential information 24 held by the attacker or the attacking device. The attacker confidential information 24 includes the operating status of the system.

[0025] The evaluation unit 43 evaluates the impact on the business in the actual system based on the system model 28 that reproduces the state of the virtual multiple devices when the attack scenario 25 is executed and the operating status of the business in the virtual system composed of the virtual multiple devices. The evaluation unit 43 evaluates the sum of the value of the system confidential information 23 acquired by the virtual attacker or attack device. The evaluation unit 43 may evaluate the production volume of the business in the system in absolute value or in relative value. This allows the system administrator to take measures against information that is highly valuable against attacks. The virtual multiple devices are devices that are configured virtually from each of the devices that configure the system. A method of simulating the virtual multiple devices will be described in detail with reference to FIG. 6. The confidential information may also include a numerical value expressing an information value. In this case, the evaluation unit 43 evaluates the impact of the attack scenario 25 on confidentiality by the information value of the confidential information that the virtual attacker or attack device can obtain, or by multiplying the information value by the time that the virtual attacker or attack device stayed in the virtual device. By expressing the impact in chronological order, the damage caused by the attack scenario 25 can be appropriately evaluated. The evaluation unit 43 may evaluate at least one of the cost and time required to restore the virtual device as the impact on business.

[0026] The evaluation unit 43 may evaluate the lost profits of the virtual system affected by the cyber-attack of the virtual attacker or attacking device in an absolute value or in a relative value. The evaluation unit 43 may evaluate the personnel costs, equipment costs, and time involved in the recovery of the virtual equipment stopped by the cyber-attack of the virtual attacker or attacking device in an absolute value or in a relative value. The evaluation unit 43 may evaluate the value of the confidential information stolen by the cyber-attack of the virtual attacker or attacking device in an absolute value or in a relative value.

[0027] Table 29 shows the status of an attack. The first row of table 29 stores information on the first step of the attack. Some of the devices targeted by the attack are PCs (Personal Computers), and the attack is an initial intrusion. At this time, the system is in a normal operating state, and the operating state is 100%.

[0028] The second row of Table 29 stores information about the second step of the attack. The target device is an EWS (Engineering WorkStation), the attack is to gather information, and confidential information in the control logic is attacked. At this time, the system is in a normal operating state, and the operating status is 100%.

[0029] The third row of Table 29 stores information about the third step of the attack. The target device is a PLC (Programmable Logic Controller), and the attack is the attack itself. At this time, the system is in a state where values ​​have been tampered with, and the operation status is 50%.

[0030] FIG. 3 is a logical configuration diagram of the cybersecurity evaluation device 1. The cybersecurity evaluation device 1 is configured to include a setting unit 42 and an output unit 45 in addition to the generating unit 41, the updating unit 44, and the evaluating unit 43 described in FIG.

[0031] The setting unit 42 displays an analysis condition setting screen 60 shown in Fig. 12 on the monitor, accepts input of analysis conditions, and sets the analysis conditions. The setting unit 42 sets the analysis conditions by displaying a setting screen for setting attacker confidential information 24 possessed in advance by a hypothetical attacker or attack device. A text box for setting the number of hops is displayed on the setting screen.

[0032] The output unit 45 graphs the system performance shown in Fig. 14 and displays it on the display device 36. The output unit 45 outputs the production volume of the work in the system evaluated by the evaluation unit 43 as a performance index to the display device 36 or the like for display.

[0033] In addition, without being limited to this, the output unit 45 may also display on the display device 36 the value of information stolen through a cyber-attack, profits lost due to the system being stopped due to a cyber-attack, and the labor hours or labor costs required to recover equipment from a cyber-attack.

[0034] FIG. 4 is a diagram showing the configuration of a system 50 to be evaluated. The system 50 is configured by connecting a data historian 55, PLCs 51 to 53, and an EWS 54 to a network. The cybersecurity evaluation device 1 stores information about the system 50 and evaluates the impact of the attack scenario and the result of the attack on the system 50 by simulating an attack on the system 50 using a software program without accessing an actual device.

[0035] 5 is a flowchart of the attack scenario evaluation process. Hereinafter, the cybersecurity evaluation device 1 only internally simulates cyberattacks and does not carry out actual cyberattacks. First, the setting unit 42 initializes the analysis conditions (step S10). Specifically, the setting unit 42 accepts the analysis conditions, such as the target device of the initial intrusion, the final target device, and confidential information owned by the virtual attacker or attack device, via the analysis condition setting screen 60 shown in FIG.

[0036] Next, the generation unit 41 reads information about the target device of the initial intrusion (step S11), and selects an attack pattern 26 to be executed by the virtual attacker or attack device against the virtual target device based on the attacker confidential information 24 possessed by the virtual attacker or attack device (step S12).

[0037] The update unit 44 updates confidential information owned by the hypothetical attacker or attack device based on the system confidential information 23 that can be acquired by executing the selected attack pattern 26 (step S13). The generation unit 41 determines whether the attack on the final virtual device is complete (step S14). If the attack on the final virtual device is complete (Yes), the process proceeds to step S16. If the attack on the final virtual device is not complete (No), the process proceeds to step S15, where the generation unit 41 selects the next target virtual device based on the system configuration and confidential information, reads the information, and then returns to step S12.

[0038] In step S16, the generation unit 41 determines whether attack scenarios 25 for all routes have been generated. If attack scenarios for all routes have been generated (Yes), the process proceeds to step S18. If attack scenarios 25 for any routes have not been generated (No), the process proceeds to step S17, where the generation unit 41 changes the attack scenario ID and starts generating attack scenarios 25 for different routes. Then, the process returns to step S11.

[0039] In step S18, the evaluation unit 43 inputs the state of the virtual device at the time of occurrence of the attack scenario 25 into the system model 28 to obtain the operation state of the virtual system. Then, the output unit 45 calculates the indexes required for impact evaluation from the operation state of the virtual system 50 and presents them to the user (step S19), and ends the processing in Fig. 5. An example of the information presented to the user here is shown in Fig. 14, which will be described later.

[0040] FIG. 6 is a diagram of the system configuration information 22 to be evaluated. The system configuration information 22 includes a device ID column, a name column, a confidential information ID column, a user operation column, a physical access column, an Internet access column, a security countermeasure level column, and a basic recovery time column. Each row of the system configuration information 22 stores information on each device that constitutes the system 50. In this way, multiple virtual devices are represented by a database. Other methods include Jason and network configuration.

[0041] The device ID field stores the identifier of this device. The name field stores the name of this device. The confidential information ID field stores the identifier of confidential information stored in this device. The user operation field stores whether or not the user operates this device.

[0042] The physical access field stores whether or not this device can be physically accessed. The Internet access field stores whether or not this device can access the Internet. The security countermeasure level field stores the level of security countermeasures taken for this device. The basic recovery time field stores the time required to recover this device.

[0043] FIG. 7 is a diagram showing device type IDs. The device type ID field stores an identifier indicating the device type, and the name field stores a name according to the device type.

[0044] The name of device type ID=1 is PLC. The name of device type ID=2 is Human Machine Interface. The name of device type ID=3 is Engineering Workstation. The name of device type ID=4 is Data Historian.

[0045] FIG. 8 is a mode transition diagram of the attack scenario 25. First, the cybersecurity evaluation device 1 evaluates an initial intrusion by an attacker or an attack device (mode M10). Next, the cybersecurity evaluation device 1 evaluates information gathering by the attacker or the attack device (mode M11). Then, if an attack on the final target device is impossible, the cybersecurity evaluation device 1 evaluates moving to another device (mode M12) and returns to mode M11 again.

[0046] If an attack on the final target device is possible, the cybersecurity evaluation device 1 evaluates the impact on the device (mode M13) and ends the mode transition in Fig. 8. In this way, the cybersecurity evaluation device 1 searches for new devices that may be potentially invaded by adding the system confidential information 23 that can be obtained through an initial intrusion by an attacker or an attacking device to the attacker confidential information 24 possessed by the attacker or the attacking device. Through such an evaluation, the cybersecurity evaluation device 1 can accurately evaluate the possibility of an attack on the final target device.

[0047] FIG. 9 is a diagram showing attack pattern 26. The attack pattern 26 stores an attack tactic ID column, an attack tactic name column, an attack technique ID column, an attack technique name column, and a target device type ID column. The offensive tactics ID field stores an identifier of the offensive tactics, and the offensive tactics name field stores the name of the offensive tactics.

[0048] The attack technique ID field stores an identifier of the attack technique. The attack technique name field stores a name of the attack technique. The target device type ID field stores an identifier of the type of the target device.

[0049] Specifically, initial intrusion attack techniques include phishing emails and removable media connections, but other possible techniques include port scanning and password list attacks. In addition, attack techniques for gathering information include network eavesdropping and downloading control programs, but the installation of backdoors is also possible.

[0050] Attack techniques used to move to another device include exploiting remote services and exploiting weak / leaked passwords. Attack techniques that can affect devices include service halt through DoS (Denial of Service) attacks and parameter tampering, but also include session hijacking, buffer overflow attacks, and database tampering through SQL (Structured Query Language) injection.

[0051] As explained in FIG. 8 and FIG. 9, by creating a database, it is possible to generate a virtual attacker or a virtual attack device.

[0052] FIG. 10 is a diagram showing the system confidential information 23 stored in the system. The system confidential information 23 stores a confidential information ID field, a name field, an information value field, an attack target device ID field, a related tactic / technology ID field, and a status code field. The system confidential information 23 is stored in a distributed manner in each device that constitutes the system.

[0053] The confidential information ID field stores an identifier of the confidential information. The name field stores the name of the confidential information. The information value field stores information regarding the value of the confidential information. The target device ID field stores an identifier of the device that is the target of the attack. The related tactics / techniques ID field stores an identifier of the related tactics or techniques. The status code field stores a status code of the confidential information.

[0054] FIG. 11 is a diagram showing status codes. The status code column stores the status code of the confidential information. The content column stores the content corresponding to the status code of the confidential information.

[0055] FIG. 12 is a diagram showing the analysis condition setting screen 60. As shown in FIG. The analysis condition setting screen 60 displays an initial intrusion combo box 601, a final target combo box 602, an attack time required text box 603, a number of hops text box 604, and an attacker confidential information check box 605.

[0056] The initial intrusion combo box 601 is for selecting a device to be initially intruded. The final target combo box 602 is for selecting a device to be the final target. The attack time required text box 603 is for inputting the time required for a cyber attack.

[0057] The hop count text box 604 is for inputting the number of hops of a cyber attack. Since the user can specify the number of hops of a cyber attack when simulating, it becomes possible to evaluate a realistic attack scenario with a short simulation.

[0058] The attacker confidential information checkbox 605 is for setting confidential information that the virtual attacker or attack device possesses from the beginning. The user can arbitrarily set and evaluate the attacker confidential information 24 that the virtual attacker or attack device possesses in advance, and can appropriately evaluate the attack scenario 25 by the internal attacker.

[0059] FIG. 13 is a diagram illustrating the operation of the system model operator 431. The evaluation unit 43 includes a system model operator 431. The system model operator 431 receives the system configuration information 22, a device ID, and a status code as input, and outputs the evaluation result 27, that is, system performance information.

[0060] Figure 14 is a time series graph of system performance indicators. The horizontal axis of the graph represents time. The vertical axis of the graph represents the system performance index. The solid line represents the degradation of the system performance when under attack. Here, the cumulative system performance is the result of the attack. The output unit 45 in FIG. 3 displays a graph of this system performance index on a display device, thereby indicating the impact of the attack to the user.

[0061] FIG. 15 is a diagram showing an example of an attack scenario 25. The attack scenario 25 includes an attack scenario ID column, an occurrence order column, a time column, a device ID column, a tactic / technique ID column, a confidential information ID column, and a status code column.

[0062] The Attack Scenario ID column stores an identifier of an attack scenario. The Occurrence Order column stores the occurrence time of the attack scenario. The Time column stores the time required for the attack scenario. The Device ID column stores an identifier of the device to be attacked. The Tactic / Technique ID column stores an identifier of the attack tactics or techniques. The Confidential Information ID column stores an identifier of confidential information that an attacker or attack device can obtain through an attack, and the Status Code column stores a status code of the confidential information.

[0063] FIG. 16 is a diagram showing an example of the evaluation result 27 of the attack scenario 25. The evaluation result 27 includes an attack scenario ID column, an occurrence probability column, an accumulated loss information value column, and an impact column. The impact column includes a normal production volume column, an abnormal production volume column, a remote monitoring column, and a safety risk aversion rate column.

[0064] The attack scenario ID field stores an identifier of an attack scenario. The occurrence probability field stores the occurrence probability of an attack scenario. The cumulative loss information value field stores information value regarding cumulative loss.

[0065] The impact column stores the impact of an attack. The normal production volume column stores the production volume under normal conditions. The abnormal production volume column stores the production volume under abnormal conditions. The remote monitoring column stores the downtime of remote monitoring. The safety risk avoidance rate column stores the rate at which safety risks can be avoided.

[0066] Possible impacts of an attack may include service outages due to a DoS attack, disposal of products that have become abnormal due to parameter tampering, damage to unauthorized services due to session hijacking, the labor required to initialize and reinstall a system that has been penetrated by a buffer overflow attack, and the need to recover a database that has been tampered with due to SQL injection.

[0067] In this embodiment, confidential information necessary for executing a cyber attack stored in the system 50 and confidential information held by an attacker or an attacking device are defined separately. First, the generation unit 41 generates an attack scenario 25 including an attack pattern executable on the system 50 and confidential information that can be obtained from the system 50 in an attack, based on the confidential information held by the attacker or the attacking device.

[0068] Then, the update unit 44 updates the confidential information held by the attacker or the attack device based on the attack scenario 25, and the generation unit 41 repeats the process of generating a new attack scenario 25. Then, the evaluation unit 43 inputs the generated attack scenario 25 into a system model 28 that can reproduce the operating status of the system 50, and evaluates the impact on business operations when an attack occurs.

[0069] According to this, the generated attack scenarios 25 are limited to those that take into consideration the violation of confidentiality, so that the number of attack scenarios 25 to be considered in the risk assessment can be narrowed down in advance.

[0070] The configuration and effects of the present invention will be described below.

[0071] [1] A generation unit (41) that generates an attack scenario (25) based on configuration information of a system (50) and system confidential information (23) held by a plurality of devices (51, 52, 53, 54, 55) constituting the system (50), the attack scenario including a cyber-attack pattern that can be carried out against the plurality of devices, attacker confidential information assumed to be held by a hypothetical attack device that carries out the cyber-attack, and the system confidential information (23) that can be obtained by a cyber-attack; an update unit (44) that adds the system confidential information (23) acquired from any one of the plurality of devices through a cyber attack of the attack scenario (25) to the attacker confidential information (24) to update the system confidential information; an evaluation unit (43) that evaluates an impact on business operations when a cyber-attack of the attack scenario occurs, based on a system model (28) that reproduces the state of the plurality of devices when the attack scenario (25) is executed and the operating status of business operations in a virtual system configured by the plurality of devices; an output unit (45) that displays the impact on the business evaluated by the evaluation unit (43); A cybersecurity evaluation device (1).

[0072] This makes it possible to accurately evaluate the impact on business operations, including damage to the system, when an attack scenario occurs.

[0073] [2] The plurality of devices are virtual devices simulating devices constituting the system (50), The attack device is a virtual device that simulates a device that carries out a cyber attack. A cybersecurity evaluation device (1) as claimed in claim 1.

[0074] This makes it possible to accurately evaluate the impact of damage to the system without using actual equipment.

[0075] [3] The generation unit (41) generates the attack scenario (25) based on a state in which the attack device has the attacker confidential information (24) in advance. A cybersecurity evaluation device (1) as claimed in claim 1.

[0076] This makes it possible to accurately evaluate attack scenarios in which the attacker already has possession of confidential information, such as an internal attack, and thus makes it easier to find the attacker.

[0077] [4] The generation unit (41) repeatedly generates the attack scenario (25) so as to newly attack a device that has become attackable by the attacker confidential information (24) updated by the update unit (44). A cybersecurity evaluation device (1) as claimed in claim 1.

[0078] This allows the generation unit (41) to evaluate which device the attacker is able to attack first, using the attacker's confidential information that the attacker possesses in advance.

[0079] [5] a setting unit that displays a setting screen for setting the attacker confidential information (24) that the attacker device possesses in advance; The cybersecurity evaluation device (1) according to claim 4, further comprising:

[0080] This allows the user to arbitrarily set and evaluate the attacker's confidential information (24) that the attacker possesses in advance, and allows the user to appropriately evaluate the attack scenario (25) by an internal attacker.

[0081] [6] The generation unit (41) stops generating the attack scenario (25) when there is no device that has become attackable due to the attacker confidential information (24) updated by the update unit (44). A cybersecurity evaluation device (1) as claimed in claim 1.

[0082] This enables the generation unit (41) to easily determine the conditions for stopping the generation of the attack scenario (25) and to end the simulation in a short time.

[0083] [7] The generation unit (41) generates an attack scenario (25) within a predetermined number of hops. A cybersecurity evaluation device (1) as claimed in claim 1.

[0084] This makes it possible to perform a simulation within a realistic range of hop numbers, making it possible to set the attack scenario 25 within a range that could actually occur, and to complete the simulation of the attack scenario 25 in a short period of time.

[0085] [8] A setting unit (42) that displays a setting screen for setting the number of hops; The cybersecurity evaluation device (1) according to claim 7, further comprising:

[0086] This allows users to specify the number of hops for a cyber attack when simulating, making it possible to evaluate realistic attack scenarios with a short simulation time.

[0087] [9] The evaluation unit (43) evaluates a sum of values ​​of the system confidential information (23) acquired by the attack device. The cybersecurity evaluation device (1) according to claim 1, further comprising:

[0088] This allows the evaluation unit (43) to evaluate value information acquired by an attacking device through an attack, and to take measures against information that is highly valuable against an attack.

[0089]

[10] The evaluation unit (43) evaluates the impact of the operation on the production volume in the system (50) in absolute value. The cybersecurity evaluation device (1) according to claim 1, further comprising:

[0090] This allows the evaluation unit (43) to evaluate value information acquired by an attacking device through an attack, and to take measures against the information that is most valuable against an attack.

[0091]

[11] The evaluation unit (43) evaluates the impact of the operation on the production volume in the system (50) relative to a target value. The cybersecurity evaluation device (1) according to claim 1, further comprising:

[0092] This allows the evaluation unit (43) to evaluate value information acquired by an attacking device through an attack, and to take measures against the information that is most valuable against an attack.

[0093]

[12] The evaluation unit (43) evaluates at least one of the cost and time required to restore the equipment as an impact on the business. A cybersecurity evaluation device (1) according to claim 11.

[0094] This enables the evaluation unit (43) to present to the user at least one of the cost and time required to restore a device that has been infected with, for example, malware or a virus due to a cyber attack.

[0095]

[13] The output unit (45) outputs the impact on the business in the system (50) evaluated by the evaluation unit (43) as a performance index. The cybersecurity evaluation device (1) according to claim 1, further comprising:

[0096] This allows users to accurately understand the impact of an attack on their business operations.

[0097]

[14] A cyberattack pattern that an attacker can carry out is access to a set of devices that can perform a given attack technique. A cybersecurity evaluation device (1) as claimed in claim 1.

[0098] This enables the cybersecurity evaluation device (1) to select which attack technique to use as a cyberattack pattern.

[0099]

[15] A step in which a generation unit (41) generates an attack scenario (25) based on configuration information of a system (50) and system confidential information (23) held by a plurality of devices (51, 52, 53, 54, 55) constituting the system (50), the attack scenario including cyber-attack patterns that can be carried out against a plurality of virtual devices simulating the plurality of devices, attacker confidential information assumed to be held by a virtual attack device that carries out a cyber-attack, and the system confidential information (23) that can be obtained by a cyber-attack; an update unit (44) updating the system confidential information (23) virtually acquired from any one of the virtual devices by the cyber attack of the attack scenario (25) by adding it to the attacker confidential information (24); an evaluation unit (43) evaluating an impact on business operations when a cyber-attack of the attack scenario occurs based on a system model (28) that reproduces the state of the virtual multiple devices when the attack scenario (25) is executed and the operational status of business operations in a virtual system (50) configured by the virtual multiple devices; An output unit (45) displays the impact on the business evaluated by the evaluation unit (43); An attack scenario evaluation method comprising:

[0100] This makes it possible to accurately evaluate the impact on business operations, including damage to the system, when an attack scenario occurs.

[0101]

[16] To the computer: a step of generating an attack scenario (25) based on configuration information of a system (50) and system confidential information (23) necessary for a cyber attack and held by a plurality of devices constituting the system (50), the attack scenario including a cyber attack pattern that an attacker can launch against the plurality of devices, attacker confidential information held by an attacking device that performs a cyber attack, and the system confidential information that can be obtained by a cyber attack; a step of adding the system confidential information (23) acquired from any one of the plurality of devices by the cyber-attack of the attack scenario (25) to attacker confidential information (24) held by the attacker, thereby updating the attacker confidential information (24); A procedure for evaluating the impact on business operations when a cyber-attack of the attack scenario occurs, based on a system model (28) that reproduces the state of devices constituting the system (50) and the operational status of business operations in the system (50) when the attack scenario is implemented; a step of displaying the impact on said business; Cybersecurity assessment program to implement.

[0102] This makes it possible to accurately evaluate the impact on business operations, including damage to the system, when an attack scenario occurs.

[0103] (Modification) The present invention is not limited to the above-described embodiment, and includes various modified examples. For example, the above-described embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all of the configurations described. It is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0104] The above configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware such as an integrated circuit. The above configurations, functions, etc. may be realized by software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a recording device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as a flash memory card or a DVD (Digital Versatile Disk).

[0105] In each embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it may be considered that almost all components are connected to each other.

[0106] In each embodiment, the impact of the business is evaluated using multiple virtual devices or a virtual attack device. However, the present invention is not limited to this. For example, it is also possible to access multiple actual devices, obtain information that is lacking in the model of multiple virtual devices, and evaluate the business by adding the obtained information. The same applies to a virtual attacking device or a virtual attacker. [Explanation of symbols]

[0107] 1. Cybersecurity evaluation equipment 32 Memory 33 Input / Output Interface 2 Storage device 21 Attack Scenario Evaluation Program 35 Input Devices 36 Display device 22 System configuration information 23 System Confidentiality 24 Attacker's Confidential Information 25 Attack Scenarios 26 Attack Patterns 28 System Model 41 Generation part 43 Evaluation Department 44 Update section 29 Table 42 Setting section 45 Output section 60 Analysis condition setting screen 50 Systems 55 Data Historian 51~53 PLC 54 EWS 601 Initial Invasion Combo Box 602 Final Target Combo Box 603 Attack Time Text Box 604 Hop count text box 605 Attacker Sensitive Information Checkbox 431 System Model Operators

Claims

1. a generation unit that generates an attack scenario including a cyber-attack pattern that can be performed on the plurality of devices, attacker confidential information held by an attacking device that performs a cyber-attack, and the system confidential information that can be obtained by a cyber-attack, based on configuration information of the system and system confidential information held by the plurality of devices that configure the system; an update unit that updates the system confidential information acquired from any one of the plurality of devices by the cyber-attack of the attack scenario by adding the system confidential information to the attacker confidential information; an evaluation unit that evaluates an impact on business operations when a cyber-attack of the attack scenario occurs, based on a system model that reproduces the states of the multiple devices when the attack scenario is executed and the operating status of business operations in a virtual system configured by the multiple devices; and an output unit that displays the impact on the business evaluated by the evaluation unit; A cybersecurity evaluation device comprising:

2. the plurality of devices are virtual devices simulating devices constituting the system, The attack device is a virtual device that simulates a device that carries out a cyber attack. The cybersecurity evaluation device according to claim 1 .

3. the generation unit generates the attack scenario based on a state in which the attacker device has the attacker confidential information in advance. The cybersecurity evaluation device according to claim 1 .

4. the generation unit repeatedly generates the attack scenario so as to newly attack a virtual device that has become attackable by the attacker confidential information updated by the update unit. The cybersecurity evaluation device according to claim 1 .

5. a setting unit that displays a setting screen for setting the attacker confidential information previously possessed by the attacking device; The cybersecurity evaluation device according to claim 4, further comprising:

6. the generation unit stops generating the attack scenario when there is no device that has become attackable by the attacker confidential information updated by the update unit. The cybersecurity evaluation device according to claim 1 .

7. the generation unit generates an attack scenario within a predetermined number of hops. The cybersecurity evaluation device according to claim 1 .

8. a setting unit that displays a setting screen for setting the number of hops; The cybersecurity evaluation device according to claim 7, further comprising:

9. The evaluation unit evaluates a sum of values ​​of the system confidential information acquired by the attack device. The cybersecurity evaluation device according to claim 1, further comprising:

10. The evaluation unit evaluates the impact of the work in the system on production volume in an absolute value. The cybersecurity evaluation device according to claim 1, further comprising:

11. The evaluation unit evaluates an impact on a production volume of the work in the system as a relative value to a target value. The cybersecurity evaluation device according to claim 1 .

12. The evaluation unit evaluates at least one of the cost and time required for restoring the equipment as an impact on the business. The cybersecurity evaluation device according to claim 11 .

13. The output unit outputs the impact on the business in the system evaluated by the evaluation unit as a performance index. The cybersecurity evaluation device according to claim 1, further comprising:

14. A cyber attack pattern that an attack device can carry out is access to a series of devices to realize a specific attack technique. The cybersecurity evaluation device according to claim 1 .

15. A generation unit generates an attack scenario based on system configuration information and system confidential information held by a plurality of devices constituting the system, the attack scenario including cyber-attack patterns that can be performed on a plurality of virtual devices simulating the plurality of devices, attacker confidential information assumed to be held by a virtual attacking device that performs a cyber-attack, and the system confidential information that can be obtained by a cyber-attack; an update unit updating the system confidential information virtually acquired from any one of the virtual devices by the cyber attack of the attack scenario by adding the system confidential information to the attacker confidential information; an evaluation unit evaluating an impact on business operations when a cyber-attack of the attack scenario occurs based on a system model that reproduces the state of the virtual multiple devices when the attack scenario is executed and the operation status of business operations in a virtual system configured by the virtual multiple devices; An output unit displays the impact on the business evaluated by the evaluation unit; An attack scenario evaluation method comprising:

16. On the computer, A step of generating an attack scenario based on configuration information of a system and system confidential information necessary for a cyber attack and held by a plurality of devices constituting the system, the attack scenario including a pattern of a cyber attack that an attacker can perform against the plurality of devices, attacker confidential information held by an attacking device that performs a cyber attack, and the system confidential information that can be obtained by a cyber attack; a step of adding the system confidential information acquired from any one of the plurality of devices by the cyber-attack of the attack scenario to attacker confidential information held by the attacker, thereby updating the attacker confidential information; A step of evaluating the impact on business operations when a cyber-attack of the attack scenario occurs, based on a system model that reproduces the state of devices constituting the system and the operational status of the business operations in the system when the attack scenario is implemented; a step of displaying the impact on said business; A cybersecurity assessment program to implement.

Images