Vulnerability management system and vulnerability management program

Abstract

To provide a vulnerability management system and a vulnerability management program capable of implementing efficient vulnerability management.SOLUTION: A vulnerability management apparatus 11 includes a storage unit 46 and a first table update unit 35. The storage unit 46 holds an SN / SID table 52 showing first correspondence relationship between software name SN and software identifier SID. The first table update unit 35 periodically accesses a software management server that manages the software name SN and a security management server that manages the software identifier SID via an external network, to determine the first correspondence relationship, and updates the SN / SID table 52.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a vulnerability management system and a vulnerability management program for managing software vulnerabilities. [Background technology]

[0002] Patent Document 1 discloses a vulnerability management device that manages vulnerabilities in software installed on devices and that can manage vulnerabilities by taking patch application into consideration. The vulnerability management device determines whether or not the software installed on the device has vulnerabilities based on device information collected from the device. If a vulnerability is present, the device determines whether or not a corresponding patch has been applied to the software. If a patch has not been applied, the device creates management information for managing vulnerabilities. In addition, during this process, the vulnerability management device normalizes software names included in the collected device information to CPE (Common Platform Enumeration) names. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-4006 Summary of the Invention [Problem to be solved by the invention]

[0004] Information on software vulnerabilities is published by, for example, international organizations such as the National Institute of Standards and Technology (NIST). NIST assigns vulnerability identifiers such as CVE (Common Vulnerabilities and Exposures)-IDs to individual vulnerabilities and publishes them. Each CVE-ID is accompanied by detailed information, such as the name of the software affected by the vulnerability, in the form of a software identifier such as CPE.

[0005] On the other hand, for example, network administrators who manage corporate networks typically manage software installed on each device within the network using its standard software name. In this case, in order to manage vulnerabilities in each piece of software, network administrators must first find the CPE from the software name, and then find the CVE-ID from the CPE. This increases the workload, making it difficult to perform efficient vulnerability management.

[0006] Therefore, one object of the present invention is to provide a vulnerability management system and a vulnerability management program that can realize efficient vulnerability management.

[0007] The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0008] A brief summary of a representative embodiment of the invention disclosed in this application will be given below.

[0009] A vulnerability management system according to one embodiment includes an asset management device that manages devices installed on an internal network, and a vulnerability management device that is connected to the asset management device via the network and provides information about software vulnerabilities to the asset management device. The vulnerability management device includes a memory unit and a first table update unit. The memory unit holds a first table that represents a first correspondence between software names and software identifiers. The first table update unit determines the first correspondence and updates the first table by periodically accessing a software management server that manages software names and a security management server that manages software identifiers via the network. [Effects of the Invention]

[0010] To briefly explain the effect obtained by a representative embodiment of the invention disclosed in this application, efficient vulnerability management can be achieved. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a schematic diagram illustrating an example of the configuration of a vulnerability management system according to an embodiment. [Figure 2] 2 is a block diagram showing an example of the hardware configuration of a main part of the vulnerability management device shown in FIG. 1. FIG. [Figure 3] 2 is a block diagram showing an example of the functional configuration of a main part of the vulnerability management device shown in FIG. 1. FIG. [Figure 4] 4 is a schematic diagram showing an example of the configuration of SN dictionary data in FIG. 3. FIG. [Figure 5] 4 is a schematic diagram showing an example of the configuration of SID dictionary data in FIG. 3. FIG. [Figure 6] 4 is a schematic diagram showing an example of the configuration of an SN / SID table in FIG. 3. [Figure 7] FIG. 4 is a schematic diagram showing an example of the configuration of vulnerability data in FIG. 3. [Figure 8] 4 is a schematic diagram showing an example of the configuration of an SN / VID table in FIG. 3. FIG. [Figure 9] 4 is a flowchart showing an example of the processing contents of an SN / SID associating unit and a notifying unit in FIG. 3. [Figure 10] 10 is a flowchart showing an example of detailed processing contents of the SID search process (step S103) in FIG. [Figure 11A] FIG. 11 is a diagram showing the contents of a SID search character string used in the flowchart shown in FIG. [Figure 11B] FIG. 11B is a diagram showing a specific example of the SID search character string shown in FIG. 11A. [Figure 12A] 10 is a flowchart showing an example of detailed processing contents of the SN search processing (step S105) in FIG. [Figure 12B] 10 is a flowchart showing an example of detailed processing contents of the SN search processing (step S105) in FIG. [Figure 13] FIG. 9 is a diagram showing an example of the notification content sent in the update notification (step S106) to the security administrator. [Figure 14] 4 is a flowchart showing an example of processing contents of an SN / VID linking unit and a notification unit in FIG. 3. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In all drawings for explaining the embodiments, the same components are generally designated by the same reference numerals, and repeated description thereof will be omitted.

[0013] <Outline of vulnerability management system> Fig. 1 is a schematic diagram showing an example of the configuration of a vulnerability management system according to an embodiment. The vulnerability management system shown in Fig. 1 includes a vulnerability management device 11, a software management server 12, a security management server 13, multiple asset management devices 14[1]-14[n], and an external network 10 connecting these devices. The external network 10 is, for example, the Internet. In this specification, the network is referred to as NW, and software is referred to as SW.

[0014] The multiple asset management devices 14[1]-14[n] are provided in multiple internal networks 15[1]-15[n], respectively. The multiple internal networks 15[1]-15[n] are, for example, networks of different companies. In this specification, the multiple asset management devices 14[1]-14[n] are collectively referred to as asset management devices 14. Furthermore, the multiple internal networks 15[1]-15[n] are collectively referred to as internal networks 15.

[0015] The asset management device 14[1] is used by a network administrator 21[1] to manage various devices (not shown) that are installed in the internal network 15[1]. Similarly, the asset management device 14[n] is used by a network administrator 21[n] to manage various devices (not shown) that are installed in the internal network 15[n]. As one of the devices, the asset management device 14 manages the security status of software installed in devices such as PCs (Personal Computers). In this specification, the multiple network administrators 21[1]-21[n] are collectively referred to as the network administrator 21.

[0016] The vulnerability management device 11 is used by the security administrator 20 and provides information about software vulnerabilities to the asset management device 14 and, ultimately, to the network administrator 21. The vulnerability management device 11 may be configured, for example, as a cloud server. In this case, the asset management device 14 and the network administrator 21 are clients that use the vulnerability management device 11.

[0017] The software management server 12 is, for example, a server managed by the Security Assessment and Accreditation Consortium (SAMAC). The software management server 12 manages a software (SW) dictionary 16, for example, the SAMAC dictionary. The SAMAC dictionary defines vendor names, product names, versions, update information, and the like for various software names.

[0018] The security management server 13 is, for example, a server managed by NIST. The security management server 13 manages a vulnerability database (DB) 17, such as the National Vulnerability Database (NVD). The vulnerability DB 17 has vulnerability data that indicates the relationship between vulnerability identifiers that indicate the types of vulnerabilities in software and software identifiers that distinguish each piece of software. In the NVD, the vulnerability identifiers are CVE-IDs. Furthermore, the software identifiers are CPEs.

[0019] The security management server 13 may be a server managed by, for example, the Japan Computer Emergency Response Team / Coordination Center (JPCERT / CC) and the Information-Technology Promotion Agency (IPA). In this case, the vulnerability DB 17 is Japan Vulnerability Notes (JVN).

[0020] Fig. 2 is a block diagram showing an example of the hardware configuration of the main parts of the vulnerability management device 11 in Fig. 1. The vulnerability management device 11 shown in Fig. 2 is configured by a computer and includes a processor 25, a memory 26, a communication interface (IF) 27, and a bus 28 connecting these. The memory 26 includes a random access memory (RAM) 26a and a nonvolatile storage medium 26b. The nonvolatile storage medium 26b may be configured by, for example, a solid state drive (SSD) or a hard disk drive (HDD).

[0021] The communication interface 27 is connected to, for example, the external network 10. The nonvolatile storage medium 26b holds a vulnerability management program 30. The processor 25 executes the vulnerability management program 30 deployed from the nonvolatile storage medium 26b to the RAM 26a. As a result, the vulnerability management program 30 causes a computer such as that shown in FIG. 2 to function as the vulnerability management device 11.

[0022] <Details of vulnerability management equipment> Fig. 3 is a block diagram showing an example of the functional configuration of the main parts of the vulnerability management device 11 in Fig. 1. The vulnerability management device 11 shown in Fig. 3 includes a first table update unit 35, a second table update unit 40, a notification unit 45, and a storage unit 46. That is, the computer shown in Fig. 2 functions as the first table update unit 35, the second table update unit 40, the notification unit 45, and the storage unit 46 shown in Fig. 3 when the processor 25 executes the vulnerability management program 30. The storage unit 46 is realized by the memory 26 shown in Fig. 2.

[0023] In this specification, a software name is referred to as an SN, a software identifier is referred to as an SID, and a vulnerability identifier is referred to as a VID. The storage unit 46 holds SN dictionary data 50, SID dictionary data 51, an SN / SID table 52, vulnerability data 53, and an SN / VID table 54.

[0024] Fig. 4 is a schematic diagram showing an example of the configuration of SN dictionary data 50 in Fig. 3. Fig. 5 is a schematic diagram showing an example of the configuration of SID dictionary data 51 in Fig. 3. Fig. 6 is a schematic diagram showing an example of the configuration of SN / SID table 52 in Fig. 3. Fig. 7 is a schematic diagram showing an example of the configuration of vulnerability data 53 in Fig. 3. Fig. 8 is a schematic diagram showing an example of the configuration of SN / VID table 54 in Fig. 3.

[0025] The SN dictionary data 50 shown in Fig. 4 holds a list of software names SN, and information on the vendor name, product name, version, and update corresponding to each software name SN. The SID dictionary data 51 shown in Fig. 5 holds a list of CPEs, which are one of the software identifiers SID in this example. The SN / SID table (first table) 52 shown in Fig. 6 holds the correspondence relationship (first correspondence relationship) between the software name SN and the software identifier SID.

[0026] The vulnerability data 53 shown in FIG. 7 is data that represents the relationship between a vulnerability identifier VID and a software identifier SID that is the target of the vulnerability. In this example, the vulnerability identifier VID is a CVE-ID. The software identifier SID is a CPE. The vulnerability data 53 may also include detailed information about the vulnerability represented by each CVE-ID, such as an explanation of the type of vulnerability. The SN / VID table 54 shown in FIG. 8 holds a correspondence relationship (second correspondence relationship) between a software name SN and a vulnerability identifier VID, for example, a CVE-ID.

[0027] <About the underlying issues> First, as a premise, SW dictionary 16 shown in Fig. 1 holds various pieces of information related to software, including the information shown in Fig. 4. Furthermore, vulnerability DB 17 shown in Fig. 1 holds various pieces of information related to vulnerabilities, including the information shown in Fig. 7, and a list of CPEs, such as that shown in Fig. 5. Here, network administrator 21 shown in Fig. 1 generally manages vulnerabilities in software installed in various devices within internal network 15 using ordinary software names SN, such as those shown in Fig. 4.

[0028] To do this, the network administrator 21 must find a CPE, such as that shown in FIG. 5, that corresponds to each software name SN, by, for example, referring to the vulnerability DB 17. Furthermore, the network administrator 21 must use the found CPE to search the vulnerability DB 17 to find the corresponding CVE-ID. As a result, the workload increases, making it difficult to perform efficient vulnerability management. Therefore, it is beneficial to use a vulnerability management device 11, such as that shown in FIG. 3.

[0029] <Details of the first table update section> 3, generally, the first table update unit 35 periodically accesses the software management server 12 that manages the software names SN, i.e., the SW dictionary 16, and the security management server 13 that manages the software identifiers SID, i.e., the vulnerability DB 17, via the external network 10. In this way, the first table update unit 35 determines the correspondence between the software names SN and the software identifiers SID, and updates the SN / SID table (first table) 52 held in the storage unit 46.

[0030] In detail, the first table update unit 35 includes an SN dictionary update unit 36, a SID dictionary update unit 37, and an SN / SID linking unit 38. The SN dictionary update unit 36 ​​updates the SN dictionary data 50 by periodically accessing the SW dictionary 16 in the software management server 12. For example, when new software is added to the SW dictionary 16, the SN dictionary update unit 36 ​​registers information about the software in the SN dictionary data 50. The access frequency may be, for example, every day or every few days.

[0031] When the SN dictionary update unit 36 ​​updates the SN dictionary data 50, it notifies the SN / SID linking unit 38 of the update information. Furthermore, when the SN dictionary update unit 36 ​​accesses the software management server 12, it may specify a period and acquire information about software that was added during that period. Alternatively, the SN dictionary update unit 36 ​​may determine whether the acquired software information matches or does not match the information already registered in the SN dictionary data 50 without specifying a period, and add only the information that does not match to the SN dictionary data 50.

[0032] Similarly, the SID dictionary update unit 37 periodically accesses the vulnerability DB 17 in the security management server 13 to update the SID dictionary data 51. For example, when a new software identifier SID is added to the vulnerability DB 17, the SID dictionary update unit 37 registers the software identifier SID in the SID dictionary data 51. The access frequency may be, for example, every day or every few days.

[0033] When the SID dictionary update unit 37 updates the SID dictionary data 51, it notifies the SN / SID linking unit 38 of the update information. Furthermore, when accessing the security management server 13, the SID dictionary update unit 37 may specify a period and acquire software identifiers SID that were added during that period. Alternatively, the SID dictionary update unit 37 may determine whether a software identifier SID acquired without specifying a period matches or does not match a software identifier SID registered in the SID dictionary data 51, and add only the software identifiers SID that do not match to the SID dictionary data 51.

[0034] Fig. 9 is a flowchart showing an example of the processing details of SN / SID linking unit 38 and notification unit 45 in Fig. 3. In Fig. 9, SN / SID linking unit 38 determines whether SN dictionary data 50 as shown in Fig. 4 or SID dictionary data 51 as shown in Fig. 5 has been updated, based on update information from SN dictionary update unit 36 ​​or SID dictionary update unit 37 (step S101). If neither SN dictionary data 50 nor SID dictionary data 51 has been updated (step S101: No), SN / SID linking unit 38 ends the processing.

[0035] On the other hand, if the SN dictionary data 50 has been updated (step S101: Yes), the SN / SID associating unit 38 executes the processes of steps S102 and S103, and if the SID dictionary data 51 has been updated (step S101: Yes), it executes the processes of steps S104 and S105. In step S102, the SN / SID associating unit 38 extracts the updated software name SN based on the update information from the SN dictionary update unit 36. Then, the SN / SID associating unit 38 searches the SID dictionary data 51 for the software identifier SID for the extracted software name SN, and updates the SN / SID table 52 as shown in FIG. 6 based on the search results (step S103).

[0036] Similarly, in step S104, the SN / SID associating unit 38 extracts the updated software identifier SID based on the update information from the SID dictionary update unit 37. Then, the SN / SID associating unit 38 searches the SN dictionary data 50 for the software name SN for the extracted software identifier SID, and updates the SN / SID table 52 based on the search results (step S105).

[0037] When SN / SID associating unit 38 updates SN / SID table 52, it notifies notification unit 45 of the update information. In response, notification unit 45 notifies security administrator 20 of vulnerability management device 11 that SN / SID table 52 has been updated (step S106). By configuring SN / SID table 52 to be automatically updated in this way, it is possible to reduce the workload required to find a CPE corresponding to a software name SN as described above, and to improve the efficiency of vulnerability management.

[0038] Fig. 10 is a flowchart showing an example of detailed processing contents of the SID search process (step S103) in Fig. 9. Fig. 11A is a diagram showing the contents of a character string for SID search used in the flowchart shown in Fig. 10. Fig. 11B is a diagram showing a specific example of the character string for SID search shown in Fig. 11A.

[0039] 10, the SN / SID associating unit 38 first determines, as a search key, a string P[n] for SID search, which is a string obtained based on the software name SN and has multiple different granularities.The SN / SID associating unit 38 then uses the search key to search for software identifiers SIDs managed by the security management server 13, in order from the highest granularity to the lowest granularity, by using a prefix match.

[0040] 3, SID dictionary data 51 obtained from vulnerability DB 17 is provided. Therefore, the search destination for the software identifier SID may be the SID dictionary data 51. Then, when the search result is found, SN / SID linking unit 38 links the found software identifier SID to the software name SN.

[0041] As the SID search string P[n], four levels of granularity, P[1]-P[4], are used here as the SID search string P[n], as shown in Fig. 11A. The granularity is determined using four items consisting of vendor name, product name, version, and update information, based on the specifications of the SAMAC dictionary described above, i.e., the items stored in the SN dictionary data 50 shown in Fig. 4.

[0042] The most granular SID search string P[1] includes all four of these items. On the other hand, the least granular SID search string P[4] includes only one of these four items, specifically the vendor name. The second most granular SID search string P[2] includes only three of the four items, specifically the vendor name, product name, and version. The third most granular SID search string P[3] includes only two of the four items, specifically the vendor name and product name.

[0043] As a specific example, assume that the software name SN is "Microsoft Access 2000 SP2" (Microsoft and Access are registered trademarks) as shown in FIG. 11B. In this case, the vendor name, product name, version, and update information are "Microsoft," "Access," "2000," and "SP2," respectively. As a result, the highest-granularity SID search string P[1] is determined to be "cpe:2.3:a:microsoft:access:2000:sp2" based on the format of the software identifier SID, in this example, CPE. Furthermore, the lowest-granularity SID search string P[1] is determined to be "cpe:2.3:a:microsoft."

[0044] 10, in detail, the SN / SID associating unit 38 first targets one of the software names SN extracted in step S102 in Fig. 9 (step S201). Next, the SN / SID associating unit 38 sets "n," which indicates the granularity, to "1," which is the highest granularity (step S202). Next, the SN / SID associating unit 38 generates a SID search string P[n], initially P[1], as shown in Figs. 11A and 11B, based on the target software name SN (step S203).

[0045] 5 using the SID search string P[n] (P[1]) as a search key, and determines whether the search result is a hit or a miss (step S205). If the search result is a hit (step S205: Yes), the SN / SID associating unit 38 updates the SN / SID table 52 using the software identifier SID that was found (step S206).

[0046] The SN / SID associating unit 38 then determines whether the search process has been performed on all of the extracted software names SN (step S210). If there are other target software names SN (step S210: No), the SN / SID associating unit 38 returns to step S201 and repeats the same process. On the other hand, if there are no other target software names SN (step S210: Yes), the SN / SID associating unit 38 ends the search process.

[0047] As a specific example of steps S205 and S206, if a search result using the SID search string P[1] shown in FIG. 11B is found, the found software identifier SID will usually be an identifier that includes an additional character string before "...:2000:sp2". Furthermore, the found software identifier SID is not limited to one, but may be multiple. The SN / SID linking unit 38 links the found single or multiple software identifiers SID to the target software name SN, and updates the SN / SID table 52.

[0048] On the other hand, if the search result is a miss in step S205 (step S205: No), the SN / SID associating unit 38 adds "1" to the granularity "n" (step S207). That is, the SN / SID associating unit 38 lowers the granularity of the SID search string P[n] by one level. Then, the SN / SID associating unit 38 determines whether the granularity "n" exceeds the minimum granularity, n=4 in the example of FIG. 11A (step S208).

[0049] If the granularity "n" does not exceed the minimum granularity (step S208: No), the SN / SID associating unit 38 returns to step S203, changes the SID search string P[n], and repeats the same process. On the other hand, if the granularity "n" exceeds the minimum granularity (step S208: Yes), the SN / SID associating unit 38 registers the miss-hit information in the SN / SID table 52 (step S209), and proceeds to the process of step S210 described above.

[0050] As described above, the SN / SID linking unit 38 generates SID search strings P[n] with different granularities based on the software name SN, and searches for matching software identifiers SID while sequentially changing the granularity from the highest granularity to the lowest granularity. This makes it possible to obtain more accurate software identifiers SID corresponding to each software name SN, and also reduces the probability of search results resulting in misses.

[0051] 12A and 12B are flowcharts showing an example of detailed processing contents of the SN search processing (step S105) in Fig. 9. For example, when a new software identifier SID is added to the SID dictionary data 51, the software identifier SID may be associated with any of the software names SN already registered in the SN / SID table 52.

[0052] 10 for all software names SN registered in the SN / SID table 52, while generating SID search character strings P[n]. If the SID search character string P[n] matches the updated software identifier SID, the SN / SID associating unit 38 associates the software identifier SID with the target software name SN and updates the SN / SID table 52.

[0053] 12A, the SN / SID associating unit 38 targets one of the software identifiers SID extracted in step S104 in Fig. 9 (step S302). Next, the SN / SID associating unit 38 targets the first software name SN registered in the SN / SID table 52 (step S302). Then, the SN / SID associating unit 38 executes the process shown in Fig. 12B while sequentially changing the target software name SN (step S304) until it reaches the last software name SN (step S303).

[0054] If the last software name SN has been reached (step S303: Yes), the SN / SID associating unit 38 determines whether or not the processing has been performed on all of the extracted software identifiers SID (step S305). If there are other target software identifiers SID (step S305: No), the SN / SID associating unit 38 returns to step S301 and repeats the same processing. On the other hand, if there are no other target software identifiers SID (step S305: Yes), the SN / SID associating unit 38 ends the processing.

[0055] 12B, the SN / SID associating unit 38 sets "n," which indicates granularity, to "1," which is the highest granularity (step S310). Next, the SN / SID associating unit 38 generates a SID search string P[n] based on the target software name SN (step S311). Next, the SN / SID associating unit 38 compares the SID search string P[n] with the target software identifier SID based on a prefix match condition (step S312).

[0056] If the comparison results in a match (step S313: Yes), the SN / SID associating unit 38 associates the target software identifier SID with the target software name SN and updates the SN / SID table 52 (step S314). As a result, for example, a software identifier SID can be associated with a software name SN that is already registered in the SN / SID table 52 and to which no software identifier SID is associated. Alternatively, a new software identifier SID can be further associated with a software name SN to which one or more software identifiers SIDs are already associated. Thereafter, the SN / SID associating unit 38 proceeds to the processing of step S303 in FIG. 12A.

[0057] On the other hand, if the comparison result in step S313 is a mismatch (step S313: No), the SN / SID associating unit 38 adds "1" to the granularity "n" (step S315). Then, the SN / SID associating unit 38 determines whether the granularity "n" exceeds the minimum granularity (step S316). If the granularity "n" does not exceed the minimum granularity (step S316: No), the SN / SID associating unit 38 returns to step S311, changes the SID search character string P[n], and repeats the same processing. On the other hand, if the granularity "n" exceeds the minimum granularity (step S316: Yes), the SN / SID associating unit 38 proceeds to the processing of step S303 in FIG. 12A.

[0058] By using such processing, for example, a software name SN corresponding to a newly added software identifier SID can be searched for in the SN / SID table 52 and linked to the software name SN. Although not shown, the SN / SID linking unit 38 may retain information indicating that the software identifier SID is a miss-hit if, for example, no software name SN corresponding to the target software identifier SID is found in the SN / SID table 52. This information can be notified to the security administrator 20 in step S106 in FIG. 9.

[0059] <Notification of updates to security administrators> 9, the notification unit 45 notifies the security administrator 20 by email or the like that SN / SID table 52 has been updated (step S106). In response, the security administrator 20 can access the vulnerability management device 11 using, for example, a management terminal, and have the notification unit 45 display a notification screen of the update result on a display via, for example, an API (Application Programming Interface).

[0060] Fig. 13 is a diagram showing an example of the notification content sent in the update notification (step S106) to the security administrator in Fig. 9. Fig. 13 shows an example of a notification screen for the update results when SN / SID table 52 is updated by the SID search process (step S103) as an example. SID association result notification screen 60 shown in Fig. 13 presents information 61 about the updated parts in SN / SID table 52. Furthermore, notification screen 60 presents information 62 about the granularity at the time the search results were hit, and if the search results were a miss, presents information 63 about the miss.

[0061] 10, the lower the granularity of the SID search string P[n], the lower the accuracy of the hit software identifiers SIDs, and more software identifiers SIDs may be hit, i.e., in addition to the correct software identifiers SIDs, inaccurate software identifiers SIDs may also be hit. For this reason, confirmation by the security administrator 20 may be required.

[0062] 13 to the security administrator 20. The security administrator 20 checks the information 61 about the updated parts, including the granularity information 62 and the mishit information 63, and makes any necessary corrections so that the correct software identifier SID is associated with the updated software name SN, and then presses the update confirmation button 64. This confirms the update contents of the SN / SID table 52.

[0063] In this case, the security administrator 20 mainly needs to select from among candidates for the software identifier SID that are provided in advance. This reduces the workload compared to the case where the security administrator 20 has to access the security management server 13 one by one in order to find the software identifier SID from the software name SN. As a result, vulnerability management can be made more efficient.

[0064] Note that, although the example here is a case where the SN / SID table 52 is updated by the SID search process (step S103), the same applies when the SN / SID table 52 is updated by the SN search process (step S105). That is, on the notification screen 60, for example, the updated software identifier SID is presented as information 61 about the updated part, including granularity information 62. Furthermore, in the case of a miss-hit, for example, miss-hit information 63 is presented in the software name SN.

[0065] <Details of the second table update section> 3, generally, the second table update unit 40 periodically accesses the security management server 13, which manages vulnerability data indicating the relationship between vulnerability identifiers VID and software identifiers SID, i.e., the vulnerability DB 17, via the external network 10. Then, based on the vulnerability data acquired by this access and the SN / SID table 52 with the updated contents confirmed, the second table update unit 40 determines the correspondence relationship (second correspondence relationship) between the software name SN and the vulnerability identifier VID, and updates the SN / VID table (second table) 54 as shown in FIG.

[0066] In detail, the second table update unit 40 includes a vulnerability data acquisition unit 41 and an SN / VID linking unit 42. The vulnerability data acquisition unit 41 updates the vulnerability data 53 by periodically accessing the vulnerability DB 17 in the security management server 13. As shown in FIG. 7 , the vulnerability data 53 represents the correspondence between a vulnerability identifier VID, for example, a CVE-ID, and one or more target software identifiers SIDs, for example, CPEs. For example, when a new CVE-ID is added to the vulnerability DB 17, the vulnerability data acquisition unit 41 updates the vulnerability data 53 with information about the CVE-ID. The access frequency may be, for example, every day or every few days.

[0067] When the vulnerability data acquisition unit 41 updates the vulnerability data 53, it notifies the SN / VID linking unit 42 of the update information. Furthermore, when accessing the security management server 13, the vulnerability data acquisition unit 41 may specify a period and acquire information on CVE-IDs added during that period. Alternatively, the vulnerability data acquisition unit 41 may determine whether or not the acquired CVE-ID information matches or does not match the information already registered in the vulnerability data 53 without specifying a period, and add only the information that does not match to the vulnerability data 53 as new information.

[0068] Furthermore, vulnerability data acquisition unit 41 has the same access destination as SID dictionary update unit 37. Therefore, vulnerability data acquisition unit 41 and SID dictionary update unit 37 may be integrated into a single acquisition / update unit. Specifically, for example, the acquisition / update unit periodically accesses vulnerability DB 17 to acquire vulnerability data 53 such as that shown in FIG. 7. Then, the acquisition / update unit may extract only the software identifier SID from the acquired vulnerability data 53, and if the extracted software identifier SID is not registered in SID dictionary data 51, update SID dictionary data 51 using the software identifier SID.

[0069] Fig. 14 is a flowchart showing an example of the processing contents of the SN / VID associating unit 42 and the notifying unit 45 in Fig. 3. In Fig. 14, the SN / VID associating unit 42 first determines whether the vulnerability data 53 has been updated based on the update information from the vulnerability data acquiring unit 41 (step S401). If the vulnerability data 53 has not been updated (step S401: No), the SN / VID associating unit 42 ends the processing. On the other hand, if the vulnerability data 53 has been updated (step S401: Yes), the SN / VID associating unit 42 extracts the software identifier SID included in the updated vulnerability data 53 (step S402).

[0070] Next, SN / VID associating unit 42 selects one of the extracted software identifiers SID as a target (step S403). Next, SN / VID associating unit 42 searches SN / SID table 52 using the target software identifier SID (step S404). The SN / SID table 52 that is the search target at this time is the table after the update contents have been confirmed through the process described in FIG. 13.

[0071] Next, the SN / VID associating unit 42 determines whether the search result in step S404 is a hit or a miss (step S405). If the search result is a hit (step S405: Yes), the SN / VID associating unit 42 converts the target software identifier SID into a corresponding software name SN (step S406). Next, the SN / VID associating unit 42 updates the SN / VID table 54 (second table) as shown in FIG. 8 by associating the vulnerability identifier VID associated with the target software identifier SID in the vulnerability data 53 with the software name SN converted in step S406 (step S407). Then, the SN / VID associating unit 42 proceeds to step S408.

[0072] On the other hand, if the search result in step S405 is a miss (step S405: No), the SN / VID linking unit 42 proceeds directly to step S408. In step S408, the SN / VID linking unit 42 determines whether the search process has been performed on all of the extracted software identifiers SID. If there are other target software identifiers SID (step S408: No), the SN / VID linking unit 42 returns to step S403, changes the target software identifier SID, and repeats the same process. On the other hand, if there are no other target software identifiers SID (step S408: Yes), the SN / VID linking unit 42 proceeds to step S409.

[0073] In step S409, the notification unit 45 notifies the network administrator 21 managing the asset management device 14, by email or the like, that the SN / VID table 54 has been updated. In response, the network administrator 21 can, for example, use the asset management device 14 to access the vulnerability management device 11, thereby referencing the SN / VID table 54 as shown in Fig. 8 via the notification unit 45, for example, an API, and displaying it on a display, for example. At this time, the notification unit 45 may also display information about the updated parts, as in the case of Fig. 13.

[0074] The SN / VID table 54 shown in FIG. 8 shows the correspondence between a software name SN and one or more associated vulnerability identifiers VIDs, such as CVE-IDs. Furthermore, each CVE-ID is provided with a link. When the network administrator 21 selects a specific CVE-ID, for example, detailed information about the vulnerability represented by the CVE-ID is displayed, such as an explanation of the type of vulnerability. These detailed information is acquired in advance by the vulnerability data acquisition unit 41, as shown in FIG. 7.

[0075] In this way, the vulnerability management device 11 can provide the asset management device 14, and ultimately the network administrator 21, with the latest correspondence between software names SN and vulnerability identifiers VID. By referencing this correspondence, the network administrator 21 can obtain information about vulnerabilities in each piece of software that is to be managed, without having to perform the complicated tasks described above. As a result, the workload can be reduced and vulnerability management can be made more efficient.

[0076] <About various modified examples> <<First Modification>> 3 and 9, the vulnerability management device 11 generates the SN dictionary data 50 and the SID dictionary data 51, and updates the SN / SID table 52 when an update occurs to the contents of these dictionary data. However, the SN dictionary data 50 is essentially part of the data held in the SW dictionary 16, and the SID dictionary data 51 is essentially part of the data held in the vulnerability DB 17. For this reason, the vulnerability management device 11 may use a method that does not generate the SN dictionary data 50 and the SID dictionary data 51.

[0077] Specifically, the vulnerability management device 11 periodically accesses the SW dictionary 16 and the vulnerability DB 17, determines whether the software name SN or the software identifier SID has been updated, and if so, updates the SN / SID table 52. However, when updating the SN / SID table 52, multiple search processes may occur, with the SN dictionary data 50 as the search target, as shown in step S204 in FIG. 10 . In this case, accessing the SW dictionary 16 instead of the SN dictionary data 50 each time a search is performed may increase the processing load, including the communication load. From this perspective, it is desirable for the vulnerability management device 11 to generate the SN dictionary data 50 and the SID dictionary data 51.

[0078] <<Second Modification>> 3 and 14, the vulnerability management device 11 generates vulnerability data 53 and updates the SN / VID table 54 when an update occurs to the content of the vulnerability data 53, specifically, the vulnerability identifier VID. However, the vulnerability data 53 is essentially part of the data held in the vulnerability DB 17. For this reason, the vulnerability management device 11 may use a method that does not generate the vulnerability data 53.

[0079] Specifically, the vulnerability management device 11 periodically accesses the vulnerability DB 17, determines whether the vulnerability identifier VID has been updated, and if so, updates the SN / VID table 54. However, when updating the SN / VID table 54, for example, as shown in step S407 in Fig. 14, a process of referencing the vulnerability data 53 may occur multiple times. Furthermore, as described in step S409 in Fig. 14, there may be cases where detailed information about the vulnerability is desired to be presented to the network administrator 21. To perform these operations efficiently, it is desirable for the vulnerability management device 11 to generate the vulnerability data 53.

[0080] <<Third Modification>> 14 has been described as an example in which the vulnerability management device 11 generates the SN / VID table 54 as shown in FIG. 8 and presents it to the network administrator 21. However, the vulnerability management device 11 does not necessarily have to generate the SN / VID table 54. For example, the vulnerability management device 11 may generate the SN / SID table 52 and the vulnerability data 53 in advance, and associate the software name SN with the vulnerability identifier VID in response to a request from the network administrator 21.

[0081] As a specific example, the vulnerability management device 11 receives a request to acquire vulnerability information corresponding to a predetermined software name from the asset management device 14, and ultimately from the network administrator 21. In response, the vulnerability management device 11 acquires a software identifier SID corresponding to the predetermined software name SN using the SN / SID table 52, and acquires a vulnerability identifier VID corresponding to the acquired software identifier SID using the vulnerability data 53. Then, the vulnerability management device 11 notifies the asset management device 14 of the acquired vulnerability identifier VID.

[0082] <<Fourth Modification>> In addition, here, the vulnerability management program 30 causes a computer to function as a first table update unit 35 and a second table update unit 40. However, a vulnerability management program [1] that causes a computer to function as the first table update unit 35 and a vulnerability management program [2] that causes a computer to function as the second table update unit 40 may be provided separately. Also, a vulnerability management device [1] having the first table update unit 35 and a vulnerability management device [2] having the second table update unit 40 may be provided separately and these may work together.

[0083] <Major effects of each embodiment> As described above, a vulnerability management system according to one embodiment is provided with a vulnerability management device that periodically generates / updates correspondence relationships between software names and software identifiers. As a result, efficient vulnerability management can be achieved. Furthermore, the vulnerability management device can also periodically generate / update correspondence relationships between software names and vulnerability identifiers. As a result, more efficient vulnerability management can be achieved.

[0084] The invention made by the inventor has been specifically described above based on the embodiments, but the present invention is not limited to the above embodiments and can be modified in various ways without departing from the spirit of the invention. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0085] For example, the various programs described above may be stored in a non-transitory, tangible, computer-readable recording medium and then supplied to a computer device. Examples of such recording media include magnetic recording media such as hard disk drives, optical recording media such as DVDs (Digital Versatile Discs) and Blu-ray Discs, and semiconductor memories such as flash memories.

[0086] In the above-described embodiment, the vulnerability management device 11 is connected to the asset management device 14 in the internal network 15 via the external network 10. However, the vulnerability management device 11 may be provided in the internal network 15 and connected to the asset management device 14 within the internal network 15. [Explanation of symbols]

[0087] 10...external network, 11...vulnerability management device, 12...software management server, 13...security management server, 14...asset management device, 16...software (SW) dictionary, 17...vulnerability database, 20...security administrator, 21...network administrator, 30...vulnerability management program, 35...first table update unit, 40...second table update unit, 45...notification unit, 46...storage unit, 52...SN / SID table, 53...vulnerability data, 54...SN / VID table, P[n]...SID search string, SID...software identifier, SN...software name, VID...vulnerability identifier

Claims

1. an asset management device that manages devices installed on the internal network; a vulnerability management device connected to the asset management device via a network and providing information about software vulnerabilities to the asset management device; Equipped with the vulnerability management device, a storage unit that stores a first table that represents a first correspondence relationship between software names and software identifiers; a first table update unit that periodically accesses, via the network, a software management server that manages the software names and a security management server that manages the software identifiers, thereby determining the first correspondence relationship and updating the first table; having Vulnerability management system.

2. The vulnerability management system according to claim 1 , the first table update unit searches the software identifiers managed by the security management server for a prefix match in order from highest to lowest granularity using search strings of multiple different granularities, which are character strings obtained based on the software name, as search keys, and when a search result is found, associates the found software identifier with the software name; Vulnerability management system.

3. The vulnerability management system according to claim 2, the first table update unit generates the search character strings of the plurality of granularities based on the software name; Vulnerability management system.

4. The vulnerability management system according to claim 2, The search string of the highest granularity includes a string representing a vendor name, a string representing a product name, a string representing a version, and a string representing update information. Vulnerability management system.

5. The vulnerability management system according to claim 2, a notification unit that, when the first table is updated by the first table update unit, notifies an administrator of the vulnerability management device that the first table has been updated; Vulnerability management system.

6. The vulnerability management system according to claim 5, the notification unit presents information about the updated portion in the first table to an administrator of the vulnerability management device. Vulnerability management system.

7. 7. The vulnerability management system according to claim 6, the notification unit presents, to an administrator of the vulnerability management device, information on the granularity at the time when the search result is a hit, and, if the search result is a miss, presents information on the miss. Vulnerability management system.

8. The vulnerability management system according to claim 1 , the security management server manages vulnerability data that indicates the relationship between vulnerability identifiers that indicate types of vulnerabilities and the software identifiers; the storage unit holds a second table representing a second correspondence relationship between the software name and the vulnerability identifier; the vulnerability management device has a second table update unit that periodically accesses the security management server via the network to acquire the vulnerability data, determines the second correspondence relationship based on the acquired vulnerability data and the first table, and updates the second table; Vulnerability management system.

9. The vulnerability management system according to claim 8, a notification unit that, when the second table is updated by the second table update unit, notifies an administrator of the asset management device that the second table has been updated; Vulnerability management system.

10. The vulnerability management system according to claim 8, the software management server is a server that manages a SAMAC dictionary; The security management server is a server that manages the software identifier CPE (Common Platform Enumeration) and the vulnerability identifier CVE (Common Vulnerabilities and Exposures)-ID. Vulnerability management system.

11. A vulnerability management program that manages information about software vulnerabilities, Computer, a storage unit that stores a first table that represents a first correspondence relationship between software names and software identifiers; a first table update unit that periodically accesses an external software management server that manages the software names and an external security management server that manages the software identifiers to determine the first correspondence relationship and update the first table; A vulnerability management program to function as a

12. The vulnerability management program according to claim 11, the first table update unit searches the software identifiers managed by the security management server for a prefix match in order from highest to lowest granularity using search strings of multiple different granularities, which are character strings obtained based on the software name, as search keys, and when a search result is found, associates the found software identifier with the software name; Vulnerability management program.

13. 13. The vulnerability management program according to claim 12, the first table update unit generates the search character strings of the plurality of granularities based on the software name; Vulnerability management program.

14. The vulnerability management program according to claim 11, the security management server manages vulnerability data that indicates the relationship between vulnerability identifiers that indicate types of vulnerabilities and the software identifiers; The vulnerability management program The computer a storage unit that stores a second table that indicates a second correspondence relationship between the software name and the vulnerability identifier; a second table update unit that periodically accesses the security management server to acquire the vulnerability data, determines the second correspondence relationship based on the acquired vulnerability data and the first table, and updates the second table; A vulnerability management program to function as a

15. 15. The vulnerability management program according to claim 14, the software management server is a server that manages a SAMAC dictionary; The security management server is a server that manages the software identifier CPE (Common Platform Enumeration) and the vulnerability identifier CVE (Common Vulnerabilities and Exposures)-ID. Vulnerability management program.

Images