Security analysis device and method

Abstract

To provide a technology that enables security analysis where impacts on protected assets of a computer system are taken into account.SOLUTION: A security analysis device maintains software impact reference values, which are reference values for each software characteristic regarding a degree of impact caused by threats to software, and acquires software configuration information that associates software used in an analysis target system which is a computer system to be analyzed, with protected assets provided in the analysis target system to which each piece of software contributes. For each threat that may be input to the analysis target system, the security analysis device calculates a system impact evaluation value, which is an evaluation value indicating the degree of impact caused by the threat on the analysis target system, based on the software impact reference value of the software that contributes to the protected assets that are targets of attack by the threat in the software configuration information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a technique for performing security-related analysis of a computer system. [Background technology]

[0002] When a security vulnerability is discovered in software used in a computer system, the information is made public. If information about a new vulnerability is made public during the maintenance period of a computer system, the computer system provider will address the vulnerability as part of their maintenance work. The configuration or specifications of a computer system may be changed in response to measures to address the new vulnerability. When the configuration or specifications are changed, a security analysis must be performed on the changed computer system. Hereinafter, an analysis of the security of a computer system may be referred to as a security analysis.

[0003] Many vulnerabilities are discovered every day, and information about various vulnerabilities is frequently made public. As a result, the cycle of implementing vulnerability countermeasures and conducting security analysis on computer systems is repeated many times during the maintenance period of the computer system. This can put a strain on maintenance work. Therefore, there is a need to reduce the amount of work required for security analysis.

[0004] In this regard, Patent Document 1 discloses a risk analysis device. The risk analysis device in Patent Document 1 acquires configuration information of a system to be analyzed, analyzes attack methods that can be performed on the system based on the configuration information and vulnerability information, identifies an attack route from the start point to the end point of the attack based on the configuration information and the attack method, calculates a risk value for the attack route, and outputs a risk analysis result including the calculated risk value. Then, when security measures for the system are planned, the analysis device re-analyzes the risk of the system if the security measures are introduced, from any of the processes of acquiring configuration information, analyzing threats, generating attack routes, and calculating risk values. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. WO2022 / 264253 Summary of the Invention [Problem to be solved by the invention]

[0006] As described above, the method disclosed in Patent Document 1 takes into account the addition or disappearance of attack routes in security analysis when the system configuration of the analysis target is changed. However, the method in Patent Document 1 does not take into account that the value of protected assets may change when the system configuration is changed. Protected assets here refer to assets that should be protected against threats such as cyber attacks in a computer system. For example, functions provided in a computer system are protected assets. One objective of the present disclosure is to provide a technology that enables security analysis that takes into account the impact on protected assets of a computer system. [Means for solving the problem]

[0007] A security analysis device according to one aspect of the present disclosure includes a software impact standard value information storage unit that stores software impact standard values, which are standard values ​​for each software characteristic regarding the degree of impact of a threat on software; a configuration information acquisition unit that acquires software configuration information that associates software used in an analysis target system, which is a computer system to be analyzed, with the protected assets provided in the analysis target system to which each of the software contributes; and a system impact evaluation value calculation unit that calculates a system impact evaluation value, which is an evaluation value that indicates the degree of impact of each threat that may be input to the analysis target system, on the basis of the software impact standard value of the software that contributes to the protected assets that are the target of attack by the threat in the software configuration information. [Effects of the Invention]

[0008] According to one aspect of the present disclosure, security analysis can be performed taking into account the impact on protected assets. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 2 is a block diagram showing the functional configuration of the security analysis device. [Figure 2] FIG. 2 is a block diagram showing a hardware configuration of a security analysis device. [Figure 3] 10 is a flowchart of a security analysis process. [Figure 4] 10 is a flowchart of a common process. [Figure 5] FIG. 1 is a diagram illustrating an example of an SBOM. [Figure 6] FIG. 10 illustrates an example of a software classification definition table. [Figure 7] FIG. 10 illustrates an example of a software property definition table. [Figure 8] FIG. 10 is a diagram illustrating an example of an SBOM, i.e., software configuration information, to which association information has been added. [Figure 9]FIG. 10 is a diagram illustrating an example of a system configuration input screen. [Figure 10] FIG. 10 is a diagram illustrating an example of a protected asset information input screen. [Figure 11] FIG. 10 is a conceptual diagram for explaining a method for calculating a system CIA impact evaluation value. [Figure 12] FIG. 10 is a diagram illustrating an example of a system characteristic definition table. [Figure 13] 1 is a table showing the evaluation criteria for each parameter. [Figure 14] FIG. 10 is a diagram illustrating an example of an analysis result output screen. [Figure 15] FIG. 10 is a diagram showing an example of a cautionary threat output screen. [Figure 16] 10 is a flowchart of a software reference value determination process. [Figure 17] 10 is a flowchart of a system reference value determination process. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] <Security Analysis Device Overview>

[0012] Fig. 1 is a block diagram showing the functional configuration of a security analysis device according to this embodiment, and Fig. 2 is a block diagram showing the hardware configuration of the security analysis device according to this embodiment.

[0013] The security analysis device 10 is a device that performs security analysis of a computer system. The computer system for which the security analysis device 10 performs security analysis may be applied to any product field or used for any business, and is not particularly limited.

[0014] Referring to Figure 1, the security analysis device 10 has the following functional blocks: a general CIA information management unit 11, an individual system CIA information management unit 12, a security analysis unit 13, a security analysis result database (DB) 14, an SBOM database 15, and a difference determination unit 16.

[0015] On the other hand, referring to FIG. 2, the security analysis device 10 is a computer having, as hardware, a communication unit 31, a storage unit 32, a control unit 33, an input unit 34, and an output unit 35.

[0016] The communication unit 31 is a communication interface that enables the security analysis device 10 to communicate with other devices via communication networks such as the Internet, an intranet, a LAN (Local Area Network), or a WAN (Wide Area Network), or via wired connections such as a USB (Universal Serial Bus).

[0017] The storage unit 32 includes a nonvolatile storage device such as an HDD (Hard Disc Drive) or an SSD (Solid State Drive), and stores various programs such as application programs and programs for implementing functions according to the embodiments of the present invention. The storage unit 32 also at least temporarily stores information acquired by the communication unit 31 and the input unit 34, and various data (including intermediate data) generated by processing by the control unit 33. A database for storing such data may be constructed in the storage unit 32.

[0018] The control unit 33 is a computing device that controls the transmission and reception of data between each element and performs information processing necessary for application execution and authentication processing. For example, the control unit 33 is a CPU (Central Processing Unit) and / or GPU (Graphics Processing Unit), and performs each information processing by executing programs stored in the storage unit 32. The control unit 33 functions as each processing unit of the security analysis device 10 by executing the programs stored in the storage unit 32.

[0019] The input unit 34 is an input interface that accepts inputs for the user to operate the security analysis device 10, and can be composed of, for example, a keyboard, a mouse, a pointing device such as a joystick, a touch panel, an audio microphone, or any combination thereof. The output unit 35 is a display device that provides visual information such as the results of processing by the control unit 33 to the user.

[0020] As described above, the security analysis device 10 itself is, like the analysis target, configured by a computer, for example. To avoid confusion with the analysis computer that configures the security analysis device 10, the computer system that is the analysis target is sometimes referred to as the analysis target system.

[0021] Returning to Figure 1, the general CIA information management unit 11 determines a reference value for the degree of impact on security based on data collected from multiple computer systems as a parameter to be used in processing by the individual system CIA information management unit 12. The reference value is determined in advance of security analysis. The process of determining the reference value will be described later.

[0022] The individual system CIA information management unit 12 calculates an evaluation value indicating the degree of impact of each threat that may be input to the analysis target system on the security of the analysis target system, based on a reference value of the degree of impact on the security of software that contributes to the protected assets that are the target of attacks by the threat. Protected assets are, for example, various element functions for realizing the analysis target system. The analysis target system has a software configuration including multiple software programs and a system configuration in which multiple components are connected to each other so that they can communicate with each other. The software configuration and system configuration are identified based on the SBOM of the analysis target system stored in the SBOM database 15, through analysis of documents and source code and / or user input. The standard value of the degree of impact on security is determined by the general CIA information management unit 11.

[0023] Specifically, the degree of impact on security includes the degree of impact on each of the three elements of security: confidentiality, integrity, and availability.

[0024] Hereinafter, the impact on confidentiality, impact on integrity, and impact on availability may be collectively referred to as CIA impact. Furthermore, the evaluation value indicating the degree of impact of a threat on the security of the system being analyzed may be referred to as the system CIA impact evaluation value. Meanwhile, the standard value of the degree of impact of a threat on the security of software may be referred to as the software CIA impact standard value. Furthermore, the standard value of the degree of impact of a threat on the security of a computer system may be referred to as the system CIA impact standard value.

[0025] Furthermore, the individual system CIA information management unit 12 reflects the system characteristics of the system to be analyzed based on the system CIA impact standard value in the system CIA impact evaluation value calculated based on the software CIA impact standard value.

[0026] The security analysis unit 13 calculates a security risk value for each threat based on the system CIA impact assessment value for the system under analysis. As an example, the security analysis unit 13 calculates the risk value using a method that uses CRSS (CVSS based Risk Scoring System). The security analysis results including the risk values ​​are presented to the user by screen display or the like, and are also stored in the security analysis result database 14.

[0027] Based on the analysis results, the user plans security measures against threats. The individual system CIA information management unit 12 calculates the risk value when the security measures planned by the user are implemented by the same process as the risk value before the security measures are implemented.

[0028] The difference determination unit 16 calculates the difference between the risk values ​​before and after the security countermeasure is implemented, and if the risk value increases as a result of implementing the security countermeasure, the difference determination unit 16 notifies the user of this.

[0029] <Security analysis processing>

[0030] The security analysis process is a process in which the security analysis device 10 analyzes security risks in a system under analysis. The security analysis process is performed in cooperation with the individual system CIA information management unit 12, the security analysis unit 13, and the difference determination unit 16. As shown in FIG. 1, the individual system CIA information management unit 12 has a configuration information acquisition unit 25, a software classification unit 26, and a system CIA impact evaluation value calculation unit 27. FIG. 3 is a flowchart of the security analysis process.

[0031] In step S101, the individual system CIA information management unit 12 executes pre-change security analysis processing. The pre-change security analysis processing is processing for analyzing security risks in the system being analyzed as it is. As an example, it is conceivable that information on a new vulnerability is made public, and the security risks posed by the threat of an attack exploiting that vulnerability are analyzed. Based on the analysis results, the user will formulate security measures to address the threat.

[0032] Once the security measures have been planned, in step S102, the individual system CIA information management unit 12 executes post-change security analysis processing. The post-change security analysis processing is processing for analyzing how the security risks in the system under analysis will change if the planned security measures are implemented.

[0033] The pre-change security analysis process and the post-change security analysis process are basically the same process. Processes common to the pre-change security analysis process and the post-change security analysis process may be referred to as common processes hereinafter.

[0034] FIG. 4 is a flowchart of the common processing.

[0035] In step S201, the configuration information acquisition unit 25 acquires a software bill of materials (SBOM) of the system to be analyzed. Information about the software that configures the system to be analyzed is registered in the SBOM.

[0036] FIG. 5 is a diagram illustrating an example of an SBOM.

[0037] Referring to FIG. 5, the SBOM 101 registers a software ID (Identifier), name, classification ID, characteristic ID, and CIA impact level for each piece of software that constitutes the system to be analyzed. The software ID is identification information that uniquely identifies the software. The name is the name of the software. The category ID is identification information for identifying software attributes and is defined in advance in the software category definition table.

[0038] 6 is a diagram showing an example of a software classification definition table. The software classification definition table 102 defines a classification ID, which is identification information for each software classification that classifies software by use. For example, the classification ID for application software is "cat1," and the classification ID for utility software is "cat2."

[0039] The characteristic ID is identification information of the software characteristic that indicates the functional characteristics of the software. The software for which the characteristic is defined is software that is classified as application software. The characteristic ID is defined in advance in the software characteristic definition table.

[0040] 7 is a diagram showing an example of a software characteristic definition table. In the software characteristic definition table 103, a characteristic ID and a software CIA impact standard value are defined for each software characteristic. Here, the software CIA impact standard value is defined in three levels: "low," "medium," and "high." The values ​​defined for "low," "medium," and "high" are 0.0, 0.275, and 0.660, respectively. The software characteristic definition table 103 is stored in the software CIA impact standard value database 22.

[0041] For example, software whose software characteristic is "display" has a characteristic ID of "app_f01", and in the software CIA impact criteria, the impact criteria value for confidentiality (C) is 0.0, the impact criteria value for integrity (I) is 0.660, and the impact criteria value for availability (A) is 0.275.

[0042] Although the software CIA influence level reference value is defined here as three levels of 0.0, 0.275, and 0.660, this is just an example, and the reference value may be defined in other ways.

[0043] 4, in step S202, the configuration information acquisition unit 25 adds, to the SBOM 101, information (association information) that associates each piece of software with the components related to that software and the element functions to which that software contributes. The element functions here refer to elemental functions provided in a computer system, i.e., protected assets. Hereinafter, the SBOM with the association information added may be referred to as software configuration information.

[0044] FIG. 8 is a diagram illustrating an example of an SBOM (i.e., software configuration information) with associated information. Referring to FIG. 8, for each piece of software, the components associated with that piece of software and the element functions to which that piece of software contributes are set. For example, software with a software ID of "sw01" is associated with a web server and a database (DB) server, and contributes to the element functions "screen share" and "transfer control." Software associated with the web server includes software with a software ID of "sw01" and software with a software ID of "sw02." Furthermore, software with a software ID of "sw01" and software with a software ID of "sw02" contribute to the element function "screen share." Note that by adding information to the SBOM, a table structure is created in which information about components and element functions is added to software, but the format of the table structure is not limited. Furthermore, components associated with software and the element functions to which software contributes may be stored using identification information such as IDs.

[0045] 4, in step S203, the software classification unit 26 extracts software that should be noted from among the software included in the system to be analyzed. Software that should be noted in security analysis and is classified as application software is extracted. In step S204, the configuration information acquisition unit 25 acquires information about the system configuration. The information about the system configuration is acquired through an operation input by the user.

[0046] 9 is a diagram showing an example of a system configuration input screen 105. The configuration information acquisition unit 25 acquires information about the system configuration input by the user through the system configuration input screen 105.

[0047] The configuration information acquisition unit 25 extracts components from the SBOM 104 and places objects corresponding to each component on the system configuration input screen 105. The shapes of the objects vary depending on the type of component. For example, a server object is a rectangle with double lines. An object for a client terminal such as a personal computer (PC) is a rectangle with single lines. Network devices such as load balancers and gateways are super ellipses that are close to rectangles. Each object has triangular thorns around it. By connecting the thorns between objects, communication paths connecting the objects are expressed. The user can input the system configuration by moving objects on the system configuration input screen 105 or connecting objects with lines. Furthermore, the user can input security settings on the components and communication protocols for connections between the components on the GUI.

[0048] A symbol indicating the security settings of the component is displayed on the component object. The name of the communication protocol in the communication path of the connection may be displayed near the line connecting the components. Next, in step S205, the configuration information acquisition unit 25 acquires information on the protected asset. The information on the protected asset is acquired through an operation input by the user.

[0049] 10 is a diagram showing an example of a protected asset information input screen. The configuration information acquisition unit 25 acquires information about the protected asset input by the user from the protected asset information input screen 106.

[0050] The configuration information acquisition unit 25 extracts element functions from the SBOM 104 and displays them so that the user can select them. When one of the element functions is selected, the configuration information acquisition unit 25 displays a protected asset information input screen 106 that allows information about the selected element function to be entered. In the example of Figure 10, an element function called screen share is selected. The configuration information acquisition unit 25 extracts components related to the screen share from the SBOM 104 and displays the corresponding objects. The connections between objects are also extracted and displayed from the system configuration information. The user can check whether the relationships between element functions (i.e., protected assets) and components are displayed correctly on the protected asset information input screen 106, and can make corrections on this screen if necessary.

[0051] 4, in step S206, system CIA impact evaluation value calculation unit 27 calculates a system CIA impact evaluation value for each element function (protected asset). In doing so, system CIA impact evaluation value calculation unit 27 selects one of the element functions from SBOM 104, calculates the average value of the software CIA impact standard values ​​of the software that contributes to that element function, and sets this value as the system CIA impact evaluation value.

[0052] Fig. 11 is a conceptual diagram for explaining a method for calculating a system CIA impact evaluation value, which shows an example of calculating a system CIA impact evaluation value for an element function called screen share.

[0053] When focusing on the element function "screen share" in SBOM104, it can be seen that software with the software ID "sw01" and software with the software ID "sw02" contribute to the element function "screen share."

[0054] The software CIA impact criteria values ​​for software ID "sw01" are as follows: confidentiality (C) impact criteria value is "high" or 0.660, integrity (I) impact criteria value is "medium" or 0.275, and availability (A) impact criteria value is "low" or 0.0.

[0055] The software CIA impact criteria values ​​for software ID "sw02" are as follows: the impact criteria value for confidentiality (C) is "medium" or 0.275, the impact criteria value for integrity (I) is "high" or 0.660, and the impact criteria value for availability (A) is "medium" or 0.275.

[0056] Therefore, the impact evaluation value for confidentiality (C) = (0.660 + 0.275) / 2 = 0.4675. The impact evaluation value for integrity (I) = (0.275 + 0.660) / 2 = 0.4675. The impact evaluation value for availability (A) = (0.0 + 0.275) / 2 = 0.1375.

[0057] 4, in step S207, the system CIA impact assessment value calculation unit 27 reflects the system characteristics of the system under analysis in the system CIA impact assessment value for each element function (protected asset). Specifically, the system CIA impact assessment value calculation unit 27 calculates the average of the system CIA impact assessment value for each element function calculated in step S206 and the system CIA impact standard value of the system under analysis, and sets this as the final system CIA impact assessment value for each element function. The system CIA impact standard value is defined in advance in the system characteristics definition table.

[0058] FIG. 12 is a diagram showing an example of a system characteristic definition table. In the system characteristic definition table 107, a system CIA impact standard value is defined for each system characteristic. The system characteristics indicate differences in characteristics depending on the product field, main business, etc. of the computer system. Here, the system CIA impact standard value is defined in three levels: "low," "medium," and "high," similar to the software CIA impact standard value described above. The values ​​defined for "low," "medium," and "high" are 0.0, 0.275, and 0.660, respectively. The system characteristic definition table 107 is stored in the system CIA impact standard value database 24.

[0059] For example, if the system being analyzed is an "artificial heart-lung machine," the system CIA impact standard values ​​are as follows: the impact standard value for confidentiality (C) in the system CIA impact standard values ​​is 0.660, the impact standard value for integrity (I) is 0.275, and the impact standard value for availability (A) is 0.660.

[0060] In the example of the element function "Screen Share" described above using Figure 11, in step S206, the system CIA impact assessment is calculated as follows: confidentiality (C) impact assessment value = 0.4675, integrity (I) impact assessment value = 0.4675, availability (A) impact assessment value = 0.1375.

[0061] If the system being analyzed is a "heart-lung machine" and its system characteristics are reflected, the system CIA impact assessment value is as follows: confidentiality (C) impact assessment value = (0.4675 + 0.660) / 2 ≒ 0.564; integrity (I) impact assessment value = (0.4675 + 0.275) / 2 ≒ 0.371; availability (A) impact assessment value = (0.1375 + 0.660) / 2 ≒ 0.399.

[0062] Although the system CIA influence standard value is defined here as three levels of 0.0, 0.275, and 0.660, this is just an example, and the standard value may be defined in other ways.

[0063] 4, in step S208, the security analysis unit 13 calculates a risk value for each element function based on the system CIA impact assessment value. There are no particular limitations on the method for calculating the risk value, but here, as an example, the risk value is calculated using CRSS (CVSS-based Risk Scoring System). CRSS is a risk assessment method that applies CVSS (Common Vulnerability Scoring System), and the base value of CVSS is used as the risk. The basic value is calculated using the following formula (1). Base value = ((0.6 × impact) + (0.4 × attack ease) - 1.5) × f (impact) ... (1) Impact = 10.41×(1-(1-C)×(1-I)×(1-A)) Attack Ease = 20 x AV x AC x Au f(impact) = 0 (if impact is 0), 1.176 (if impact is other than 0) Here, C, I, and A are the confidentiality impact assessment value, the integrity impact assessment value, and the availability impact assessment value of the system CIA impact assessment value, respectively.

[0064] Here, AV, AC, and Au are parameters that respectively represent the attack source category, the complexity of the attack conditions, and whether authentication is required before the attack. Figure 13 is a table showing the evaluation criteria for each parameter. The value of each parameter is determined according to the corresponding category.

[0065] The classification of each parameter is determined by the system configuration acquired in step S204, the information on the protected assets acquired in step S205, and the values ​​obtained by analyzing them. The AV classification can be determined from the system configuration. The AC classification can be determined by extracting threats related to element functions, identifying the attack path of the threat, and determining the number of attack steps. The Au classification can be determined by acquiring the security settings on the attack path from the system configuration.

[0066] The risk value (base value) calculated here is classified into three threat levels based on its value. If the risk value is between 7.0 and 10.0, the threat level is level 3 (serious). If the risk value is between 4.0 and 6.9, the threat level is level 2 (warning). If the risk value is between 0.0 and 3.9, the threat level is level 1 (caution).

[0067] Then, the security analysis unit 13 outputs the analysis results including the risk value by displaying them on a screen or the like, and records them in the security analysis result database 14 .

[0068] 3, when the pre-change security analysis process of step S101 and the post-change security analysis process of step S102 are completed, the difference determination unit 16 calculates the difference between the analysis result of the pre-change security analysis process and the analysis result of the post-change security analysis process in step S103. Specifically, the difference determination unit 16 calculates the difference between the risk value obtained by the pre-change security analysis process and the risk value obtained by the post-change security analysis process.

[0069] Furthermore, in step S104, the difference determination unit 16 outputs the analysis results including the risk values ​​calculated by the pre-change security analysis process or the post-change security analysis process by displaying them on a screen, etc. Furthermore, if the risk value calculated by the post-change security analysis process is greater than the risk value calculated by the pre-change security analysis process, the difference determination unit 16 may output a notification to that effect. 14 is a diagram showing an example of an analysis result output screen 108. The analysis result output screen 108 is a screen that displays the analysis results for each threat.

[0070] 14, the analysis result output screen 108 displays the attack path, risk value, and risk value calculation configuration for each threat. The risk value calculation configuration includes impact, attack ease, AV, AC, Au, C, I, and A. These are included in formula (1).

[0071] The analysis result output screen 108 also displays software configuration changes and CIA evaluation values. This screen displays information about software configuration changes resulting from the implementation of security measures. The software to be added and its CIA impact evaluation value are also displayed.

[0072] 15 is a diagram showing an example of a caution-required threat output screen. The caution-required threat output screen 109 is a screen for displaying information about caution-required threats. Threats with a risk value of level 3 or level 2 are considered caution-required threats.

[0073] Referring to FIG. 15, the latest risk values ​​and past risk histories for threats requiring attention are shown. The areas where the risk values ​​are displayed are displayed in a differentiated manner so that the risk value levels can be visually identified. The level 3 area is hatched with diagonal lines sloping downward to the right. The level 2 area is hatched with dots. The level 1 area is hatched with diagonal lines sloping upward to the right. The levels may also be distinguished by color. For example, the level 3 area may be red, the level 2 area may be yellow, and the level 1 area may be blue. The risk value threshold for distinguishing the display may also be other values. For example, a risk value of 8 or more may be distinguished from a risk value of 4 or more but less than 8, and a risk value of less than 4.

[0074] By differentiating the display according to the risk value, the level of risk can be visually ascertained, for example, whether it is a threat that requires countermeasures, a threat that it is desirable to counter, or a threat that can be put on hold.

[0075] <Reference value determination process> The reference value determination process includes a procedure for determining a software CIA influence reference value and a process for determining a system CIA influence reference value.

[0076] FIG. 16 is a flowchart of the software reference value determination process.

[0077] Referring to FIG. 16, in step S301, the software function requirement acquisition unit 17 acquires information on the function requirements of each piece of software from a plurality of computer systems, and stores the information in the software function requirement database 21.

[0078] In step S302, the software CIA impact reference value determination unit 18 extracts software characteristics and software CIA impact reference values ​​from the data stored in the software function requirements database 21, and determines the CIA impact reference value of each software characteristic based on the extracted data. In this case, the software CIA impact reference value determination unit 18 may use a statistical method or a machine learning method. Alternatively, it may use a generative AI model constructed by learning from a huge amount of data including the data stored in the software function requirements database 21.

[0079] Then, in step S303, the software CIA impact standard value determiner 18 updates the data of the software characteristic definition table 103 stored in the software CIA impact standard value database 22 to the data determined in step S302. The software function requirement acquisition unit 17 continuously and repeatedly executes the processes of steps S301 to S303.

[0080] FIG. 17 is a flowchart of the system reference value determination process.

[0081] Referring to FIG. 17, in step S401, the system function requirement acquisition unit 19 acquires information on the function requirements from a plurality of computer systems and stores the information in the system function requirement database 23.

[0082] In step S402, the system CIA impact reference value determiner 20 extracts system characteristics and system CIA impact reference values ​​from the data stored in the system function requirements database 23, and determines the CIA impact reference value of each system characteristic based on the extracted data. In this case, the system CIA impact reference value determiner 20 may use a statistical method or a machine learning method. Alternatively, a generative AI model constructed by learning from a huge amount of data including the data stored in the system function requirements database 23 may be used.

[0083] Then, in step S403, the system CIA influence standard value determination unit 20 updates the data of the system characteristic definition table 107 stored in the system CIA influence standard value database 24 to the data determined in step S402. The system function requirement acquisition unit 19 and the system CIA impact level reference value determination unit 20 continuously and repeatedly execute the processes of steps S401 to S403.

[0084] The above-described embodiment is an example for explaining the present invention, and is not intended to limit the scope of the present invention to only this embodiment. Those skilled in the art can implement the present invention in various other modes without departing from the scope of the present invention.

[0085] The above-described embodiment also includes the following features. However, the features included in the above-described embodiment are not limited to the following features.

[0086] (Item 1) The security analysis device has a software impact standard value information storage unit that holds software impact standard values, which are standard values ​​for each software characteristic regarding the degree of impact of a threat to software; a configuration information acquisition unit that acquires software configuration information that associates software used in an analysis target system, which is a computer system to be analyzed, with the protected assets provided in the analysis target system to which each of the software contributes; and a system impact evaluation value calculation unit that calculates a system impact evaluation value, which is an evaluation value that indicates the degree of impact of each threat that may be input to the analysis target system, on the basis of the software impact standard value of the software that contributes to the protected assets that are the target of attack by the threat in the software configuration information.

[0087] This allows the degree of impact of a threat on the system being analyzed to be calculated based on a standard value determined according to the characteristics of the software that contributes to the protected assets that are the target of attack by the threat in the system being analyzed, making it possible to perform security analysis that takes into account the impact on the protected assets.

[0088] (Item 2) The security analysis device according to item 1 further comprises a security analysis unit that calculates a security risk value for each of the threats based on the system impact assessment value, thereby making it possible to calculate a risk value that takes into account the impact on the protected assets.

[0089] (Item 3) The security analysis device according to claim 2 further includes a difference determination unit, wherein the configuration information acquisition unit acquires first software configuration information indicating a software configuration before a security measure is implemented and second software configuration information indicating a software configuration after the security measure is implemented, the system impact evaluation value calculation unit calculates a system impact evaluation value based on each of the first software configuration information and the second software configuration information, the security analysis unit calculates a risk value based on each of the system impact evaluation value based on the first software configuration information and the system impact evaluation value based on the second software configuration information, and the difference determination unit calculates the difference between the risk value based on the first software configuration information and the risk value based on the second software configuration information. This makes it possible to know the change in risk value before and after the implementation of the security measure.

[0090] (Item 4) In the security analysis device described in item 3, the difference determination unit outputs a notification if the risk value based on the second software configuration information is higher than the risk value based on the first software configuration information. This makes it easy to know that implementing security measures will increase the risk value.

[0091] (Item 5) The security analysis device according to claim 1 further comprises a software function requirement acquisition unit that acquires software function requirement data, which is data that accumulates software function requirements for software that constitutes a computer system, and a software impact reference value determination unit that determines the software impact reference value based on the software function requirement data. This enables highly reliable security analysis using an appropriate software impact reference value that is free from personal variations.

[0092] (Item 6) The security analysis device according to claim 1 further includes a system impact reference value information storage unit that stores a system impact reference value, which is a reference value of the degree of impact of a threat for each system characteristic of a computer system, and the system impact evaluation value calculation unit calculates the system impact evaluation value based on the software impact reference value and the system impact reference value. This enables appropriate security analysis that takes into account that the value of protected assets may differ depending on system characteristics such as the product field and main business of the computer system.

[0093] (Item 7) The security analysis device according to item 6 further includes a system function requirement acquisition unit that acquires system function requirement data, which is data that accumulates system function requirements for a computer system, and a system impact reference value determination unit that determines the system impact reference value based on the system function requirement data. This enables highly reliable security analysis using an appropriate system impact reference value that is free from personal variations.

[0094] (Item 8) In the security analysis device described in item 1, the system impact evaluation value includes evaluation values ​​for the impact on confidentiality, the impact on integrity, and the impact on availability. This enables appropriate security analysis based on the evaluation values ​​of the impact on the three security elements of confidentiality, integrity, and availability.

[0095] (Item 9) In the security analysis device described in item 1, the protected assets are element functions provided in the system to be analyzed. This enables security analysis that takes into account the impact on element functions based on the degree of impact of threats on the element functions of the computer system.

[0096] (Item 10) In the security analysis device described in item 7, the degree of impact of each threat on software characteristics is divided into three levels, with the respective software impact standard values ​​being 0.660, 0.275, and 0.0, and the degree of impact of a threat on a computer system on system characteristics is divided into three levels, with the respective system impact standard values ​​being 0.660, 0.275, and 0.0, and the system impact evaluation value calculation unit calculates the system impact evaluation value for each threat that may be input to the system under analysis as the average value of the software impact standard values ​​of software that contribute to protected assets that are the target of attacks by the threats and the average value of the system impact standard values ​​of the system characteristics of the system under analysis.

[0097] (Item 11) In the security analysis device described in item 1, the configuration information acquisition unit further acquires system configuration information indicating the components included in the system to be analyzed and the connections between the components, and the system impact evaluation value calculation unit identifies threats that may be input to the system to be analyzed based on the system configuration information. [Explanation of symbols]

[0098] 10...security analysis device, 11...general CIA information management unit, 12...individual system CIA information management unit, 13...security analysis unit, 14...security analysis result database, 15...SBOM database, 16...difference judgment unit, 17...software function requirement acquisition unit, 18...software CIA impact standard value determination unit, 19...system function requirement acquisition unit, 20...system CIA impact standard value determination unit, 21...software function requirement database, 22...software CIA impact standard value database, 23...system function requirement database, 24...system CIA impact standard value database, 25...configuration information acquisition unit, 26...software classification unit, 27...system CIA impact evaluation value calculation unit, 31...communication unit, 32...memory unit, 33...control unit, 34...input unit, 35...output unit

Claims

1. a software influence level reference value information storage unit that stores a software influence level reference value, which is a reference value for each software characteristic regarding the degree of influence of a threat on software; a configuration information acquisition unit that acquires software configuration information that associates software used in an analysis target system, which is a computer system to be analyzed, with protected assets provided in the analysis target system to which each of the software contributes; a system impact evaluation value calculation unit that calculates, for each threat that may be input to the analysis target system, a system impact evaluation value that is an evaluation value indicating the degree of impact of the threat on the analysis target system based on a software impact reference value of software that contributes to a protected asset that is a target of attack by the threat in the software configuration information; A security analysis device having:

2. a security analysis unit that calculates a security risk value for each of the threats based on the system impact assessment value; The security analysis device of claim 1 .

3. Further comprising a difference determination unit, the configuration information acquisition unit acquires first software configuration information indicating a software configuration before a security measure is implemented and second software configuration information indicating a software configuration after the security measure is implemented; the system impact evaluation value calculation unit calculates a system impact evaluation value based on each of the first software configuration information and the second software configuration information; the security analysis unit calculates a risk value based on each of a system impact evaluation value based on the first software configuration information and a system impact evaluation value based on the second software configuration information; the difference determination unit calculates a difference between a risk value based on the first software configuration information and a risk value based on the second software configuration information; The security analysis device of claim 2 .

4. the difference determination unit outputs a notification if the risk value based on the second software configuration information is higher than the risk value based on the first software configuration information. The security analysis device of claim 3 .

5. a software function requirement acquisition unit that acquires software function requirement data, which is data that accumulates software function requirements for software that constitutes a computer system; and a software influence level reference value determination unit that determines the software influence level reference value based on the software function requirement data. The security analysis device of claim 1 .

6. The computer system further includes a system impact reference value information storage unit that stores a system impact reference value, which is a reference value of the degree of impact of a threat for each of the system characteristics of the computer system, the system impact evaluation value calculation unit calculates the system impact evaluation value based on the software impact reference value and the system impact reference value; The security analysis device of claim 1 .

7. a system function requirement acquisition unit that acquires system function requirement data, which is data that accumulates system function requirements for a computer system; and a system impact reference value determination unit that determines the system impact reference value based on the system function requirement data. The security analysis device of claim 6 .

8. The system impact assessment value includes assessment values ​​of impact on confidentiality, impact on integrity, and impact on availability. The security analysis device of claim 1 .

9. The protected assets are element functions provided in the analysis target system. The security analysis device of claim 1 .

10. The degree of impact of each threat on software characteristics is divided into three levels, and the respective software impact standard values ​​are set to 0.660, 0.275, and 0.

0. The degree of impact of threats to a computer system due to system characteristics is divided into three levels, and the respective system impact standard values ​​are set to 0.660, 0.275, and 0.

0. the system impact evaluation value calculation unit calculates a system impact evaluation value for each threat that may be input to the analysis target system as an average value of the software impact reference values ​​of software that contribute to the protected assets that are subject to attack by the threat and the system impact reference value of the system characteristics of the analysis target system; The security analysis device of claim 7 .

11. the configuration information acquisition unit further acquires system configuration information indicating components included in the analysis target system and connections between the components; the system impact evaluation value calculation unit identifies threats that may be input to the analysis target system based on the system configuration information; The security analysis device of claim 1 .

12. A software impact standard value is maintained, which is a standard value for each software characteristic regarding the degree of impact of threats on the software. Acquire software configuration information that associates software used in an analysis target system, which is a computer system to be analyzed, with the protected assets provided in the analysis target system to which each of the software contributes; A security analysis method executed by an analysis computer, in which a system impact evaluation value, which is an evaluation value indicating the degree of impact of each threat that may be input to the system under analysis, on the basis of a software impact standard value of software that contributes to protected assets that are subject to attack by the threat in the software configuration information.

Images