Computer system and planning support method for dealing with vulnerability

Abstract

Since resources in system development are limited, in a case where the number of vulnerabilities that require immediate handling is large, there is a possibility that the vulnerabilities cannot be handled.SOLUTION: A computer system holds vulnerability information for managing vulnerability of elements usable for configuring an IT system. The computer system identifies a vulnerability present in the target IT system using the configuration information and the vulnerability information, executes vulnerability evaluation processing of evaluating a risk of the identified vulnerability itself, stores a result of the processing as a first result, acquires a result of threat analysis processing of the target IT system, evaluates a risk of the target IT system caused by the identified vulnerability based on the result of the threat analysis processing, stores a result of the evaluation as a second result, and determines a priority of a response to the vulnerability based on the first result and the second result of the identified vulnerability.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a system and method for planning a response to vulnerabilities present in an IT system. [Background technology]

[0002] In recent years, system development using cloud computing and open source software (OSS) has become widespread. This has led to the need for rapid response to vulnerabilities and regular version updates in system operation and management.

[0003] Known vulnerability assessment methods for determining the priority of responses to vulnerabilities include Stakeholder-Specific Vulnerability Categorization (SSVC), and the technology described in Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-553100 A Summary of the Invention [Problem to be solved by the invention]

[0005] Since system development resources are limited, if there are a large number of vulnerabilities that require immediate response, it may not be possible to address them. Therefore, it is necessary to determine response priorities by considering in more detail the impact of vulnerabilities on the system.

[0006] The present invention provides a system and method for determining the priority of vulnerability responses by taking into consideration the impact of the vulnerability on the system in more detail. [Means for solving the problem]

[0007] A representative example of the invention disclosed in the present application is as follows: That is, a computer system includes a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor, and stores vulnerability information for managing vulnerabilities of elements that can be used to configure an IT system, wherein the processor acquires configuration information for managing the elements that configure the IT system from a target IT system, identifies vulnerabilities present in the target IT system using the configuration information and the vulnerability information, executes a vulnerability assessment process that evaluates the risk of the identified vulnerabilities themselves, saves a result of the vulnerability assessment process as a first result, acquires a result of a threat analysis process for the target IT system, evaluates the risk of the identified vulnerabilities to the target IT system based on the result of the threat analysis process, saves the result of the assessment as a second result, and determines a priority of responses to the vulnerabilities based on the first and second results of the identified vulnerabilities. [Effects of the Invention]

[0008] According to the present invention, by taking into consideration the degree of threat to the system posed by the vulnerability, it is possible to more accurately determine the priority of vulnerability responses. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiment. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example of the configuration of a system according to a first embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer that configures the planning system of the first embodiment. [Figure 3] 10 is a flowchart illustrating an example of a planning support process executed by the planning system of the first embodiment. [Figure 4] 10 is a flowchart illustrating an example of plan generation executed by the planning system of the first embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of a data structure of evaluation information according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a data structure of plan information according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the spirit or intent of the present invention.

[0011] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0012] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order.

[0013] To facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings, etc. may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings, etc. [Example]

[0014] FIG. 1 is a diagram illustrating an example of the configuration of a system according to a first embodiment.

[0015] The system is composed of a planning system 100, an IT system 101, a vulnerability information management system 102, a threat knowledge information management system 103, and a terminal 104. Each system is connected via a network such as a LAN (Local Area Network), and the planning system 100 and the terminal 104 are also connected via the network.

[0016] The IT system 101 is a system that provides services and is composed of elements such as physical devices, an OS, middleware, and application software. Information on the elements of the IT system 101 is managed as configuration information. The IT system 101 transmits the configuration information to the planning system 100. The configuration information is, for example, a Software Bill of Materials (SBOM). The SBOM stores data including the software identification name, version, and vendor.

[0017] The vulnerability information management system 102 manages information related to vulnerabilities (vulnerability information). The vulnerability information stores data including, for example, CVE (Common Vulnerabilities and Exposures) identification numbers, elements having vulnerabilities, and details of the vulnerabilities.

[0018] The threat knowledge information management system 103 manages information (threat knowledge information) used for threat analysis of the IT system 101. The threat knowledge information is, for example, MITRE ATT&CK.

[0019] The planning system 100 plans response policies / measures for vulnerabilities. The planning system 100 includes a vulnerability assessment unit 110, a threat analysis unit 111, a planning unit 112, and a storage unit 113.

[0020] The storage unit 113 manages information acquired from each system, specifically, configuration information, vulnerability information, and threat knowledge information.

[0021] The vulnerability assessment unit 110 detects vulnerabilities present in the IT system 101 using configuration information and vulnerability information, and outputs the results as vulnerability detection results. The vulnerability detection results are, for example, a list of vulnerabilities present in the IT system 101. The vulnerability assessment unit 110 also executes vulnerability assessment processing to assess the risk of the vulnerabilities themselves. In the vulnerability assessment processing, vulnerabilities are assessed using, for example, the SVCC method.

[0022] The threat analysis unit 111 uses configuration information and threat knowledge information to perform threat analysis of the IT system 101. Vulnerability information may also be used in the threat analysis. In the threat analysis of the IT system 101, analysis is performed on assets to be protected, threats to the assets, risks caused by the threats, etc.

[0023] The terminal 104 is a terminal used by a user who uses the planning system 100 .

[0024] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer that constitutes the planning system 100 according to the first embodiment.

[0025] The planning system 100 is configured from one or more computers 200. The computer 200 has a processor 201, a main memory device 202, a secondary memory device 203, and a network interface 204. Each hardware element is connected via a bus 205.

[0026] The processor 201 executes a program stored in the main memory device 202. The processor 201 executes processing in accordance with the program, thereby operating as a functional unit (module) that realizes a specific function. In the following description, when a processing is described using a functional unit as the subject, it indicates that the processor 201 is executing a program that realizes the functional unit.

[0027] The main storage device 202 is a memory or the like, and stores programs executed by the processor 201 and information used by the programs. The main storage device 202 is also used as a work area. The secondary storage device 203 is a large-capacity storage device such as an HDD (Hard Disk Drive) or SSD (Solid State Drive). The programs and information stored in the main storage device 202 may be stored in the secondary storage device 203. In this case, the processor 201 reads the programs and information from the secondary storage device 203 and loads them into the main storage device 202. The network interface 204 is an interface for connecting to a network.

[0028] Similarly, the vulnerability information management system 102 and the threat knowledge information management system 103 are each configured with one or more computers 200. The hardware configuration of the terminal 104 is the same as that of the computer 200.

[0029] FIG. 3 is a flowchart illustrating an example of a planning support process executed by the planning system 100 according to the first embodiment.

[0030] The planning system 100 executes a vulnerability detection process based on the configuration information and vulnerability information, and starts a planning support process described below when it is determined that a vulnerability exists in the IT system 101. The vulnerability detection process may be executed periodically, or may be executed when at least one of the configuration information and the vulnerability information is updated.

[0031] The vulnerability assessment unit 110 executes a vulnerability assessment process (step S101). In the case of a vulnerability assessment process using the SVCC method, a decision tree is used to assess whether there has been a history of attacks, whether access via a network is possible, the usefulness of attacks, and the like.

[0032] In this embodiment, the vulnerability assessment unit 110 sets information regarding whether access via a network is possible in the field "Network Classification," and sets information regarding the usefulness of boundary defense in the field "Border Defense." Note that the above-mentioned fields are merely examples and are not limiting. Fields can be set appropriately depending on the vulnerability assessment method and the items to be assessed.

[0033] Next, the threat analysis unit 111 executes a threat analysis process (step S102). For example, the analysis is performed in the following procedure.

[0034] (Step 1) The threat analysis unit 111 generates a DFD (Data Flow Diagram) of the IT system 101.

[0035] (Step 2) The threat analysis unit 111 extracts the assets of the IT system 101 .

[0036] (Step 3) The threat analysis unit 111 extracts threats using a method such as STRIDE.

[0037] (Step 4) The threat analysis unit 111 identifies the attack method that causes the threat. For example, a method using MITRE ATT&CK can be considered. In this case, the threat analysis unit 111 identifies the attack method that utilizes a vulnerable element. The threat analysis unit 111 also acquires information on countermeasures for attacks against vulnerable elements from MITRE ATT&CK.

[0038] (Step 5) The threat analysis unit 111 calculates an evaluation value that indicates the severity of the threat. For example, a calculation method using techniques such as CVSS (Common Vulnerability Scoring System) and DREAD can be used.

[0039] The threat analysis process may be performed in advance. In this case, the process of step S103 is changed to a process of acquiring the results of the threat analysis process. The threat analysis process may also be performed manually by the user without using a tool.

[0040] Next, the planner 112 executes a plan generation process using the results of the vulnerability assessment process and the threat analysis process (step S103). The plan generation process will be described in detail later.

[0041] Fig. 4 is a flowchart illustrating an example of a plan generation process executed by the planning system 100 according to the first embodiment. Fig. 5 is a diagram illustrating an example of a data structure of evaluation information according to the first embodiment. Fig. 6 is a diagram illustrating an example of a data structure of plan information according to the first embodiment.

[0042] The planning unit 112 acquires the results of the vulnerability assessment process and the threat analysis process (step S201).

[0043] Next, the planning unit 112 initializes the evaluation information 500 and the plan information 600 (step S202). Here, the data structures of the evaluation information 500 and the plan information 600 will be described.

[0044] The assessment information 500 stores entries each including a vulnerability ID 501, a vulnerability assessment 502, a threat analysis 503, and an assessment value 504. One entry corresponds to one element having a vulnerability.

[0045] Vulnerability ID 501 is a field that stores identification information of a vulnerability. For example, a CVE identification number is stored in vulnerability ID 501. Vulnerability assessment 502 is a group of fields that store the results of vulnerability assessment processing. Threat analysis 503 is a group of fields that store the results of threat analysis processing. Evaluation value 504 is a field that stores an evaluation value that indicates the magnitude of the risk of a vulnerability.

[0046] The plan information 600 stores entries each including a vulnerability ID 601, a response policy 602, and a countermeasure 603. One entry corresponds to one element having a vulnerability.

[0047] The vulnerability ID 601 is the same field as the vulnerability ID 501. The response policy 602 is a field that stores the response priority for the vulnerability corresponding to the entry. One of Immediate, Out-of-Cycle, Scheduled, and Defer is stored in this field. The countermeasure 603 is a field that stores the countermeasure for the vulnerability.

[0048] The planning unit 112 starts loop processing of vulnerabilities (step S203). The planning unit 112 selects one vulnerability from those present in the IT system 101, and adds an entry to the assessment information 500 and the plan information 600. Identification information of the selected vulnerability is set in the vulnerability ID 501 and the vulnerability ID 601. In the following explanation, the selected element will be referred to as the target vulnerability.

[0049] The planning unit 112 determines whether or not there is an attack via the network based on the result of the vulnerability assessment process, and sets the determination result in the field "NW classification" of the entry of the assessment information 500 (step S204).

[0050] The planning unit 112 determines whether or not boundary defense is effective for the target vulnerability based on the result of the vulnerability assessment process, and sets the determination result in the field "boundary defense" of the entry of the assessment information 500 (step S205).

[0051] The planning unit 112 identifies an attack method that exploits the target vulnerability based on the result of the threat analysis process (step S206).

[0052] The planning unit 112 identifies assets that will be affected by the attack method identified based on the results of the threat analysis processing, and sets information about the identified assets in the "Asset" field of the entry of the evaluation information 500 (step S207). In this embodiment, if the asset is information and function, "primary asset" is set in the "Asset" field, and if the asset is a countermeasure asset, "secondary asset" is set in the "Asset" field.

[0053] The planning unit 112 determines the magnitude of the impact of the attack method identified based on the result of the threat analysis process, and sets the determination result in the field "magnitude of impact" of the entry of the evaluation information 500 (step S208).

[0054] The planning unit 112 determines whether or not there is a countermeasure applicable to the target vulnerability based on the result of the threat analysis process, and sets the determination result in the "additional countermeasure" field of the entry of the evaluation information 500 (step S209).

[0055] The planning unit 112 may execute only one of the processes from step S207 to step S209.

[0056] The planning unit 112 calculates an evaluation value representing the risk of the target vulnerability based on the information set in the entry of the evaluation information 500, and sets the evaluation value in the evaluation value 504 of the entry (step S210). For example, the planning unit 112 calculates the evaluation value using conversion information that associates the value of each field with a numerical value. In this embodiment, the evaluation value of a vulnerability with a high risk is a large value.

[0057] The planning unit 112 determines countermeasures based on the results of the threat analysis processing, and sets the determined countermeasures in the countermeasures 603 of the entry of the plan information 600 (step S211). Here, the countermeasures identified in step S209 are set.

[0058] The planning unit 112 determines the priority (response policy) of the response to the target vulnerability based on the evaluation value of the target vulnerability, and sets the determined response policy as the response policy 602 of the entry in the planning information 600 (step S212). For example, conversion information that associates the response policy with the range of the evaluation value is set in advance, and the planning unit 112 determines the response policy by referring to the conversion table.

[0059] The planning unit 112 determines whether or not processing has been completed for all vulnerabilities present in the IT system 101 (step S213).

[0060] If processing has not been completed for all vulnerabilities present in the IT system 101, the planning unit 112 returns to step S203 and selects a new target element. If processing has been completed for all vulnerabilities present in the IT system 101, the planning unit 112 ends the plan generation process.

[0061] Note that the vulnerability assessment based on the threat analysis process shown in steps S206 to S209 is an example and is not intended to be limiting. For example, assessment based on the location of the vulnerability in the attack path of the attack method may be considered.

[0062] As described above, according to the present invention, the priority of responses to vulnerabilities can be determined based on the results of an assessment of the risk of the vulnerability itself and the results of an assessment of the risk of the vulnerability based on a threat analysis of the IT system 101.

[0063] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments are provided to explain the present invention in detail, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some of the configurations of each embodiment can be added to, deleted from, or replaced with other configurations.

[0064] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0065] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0066] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0067] In the above-described embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected. [Explanation of symbols]

[0068] 100 Planning System 101 IT Systems 102 Vulnerability Information Management System 103 Threat Knowledge Information Management System 104 terminals 110 Vulnerability Assessment Department 111 Threat Analysis Department 112 Planning Department 113 Storage section 200 calculator 201 processor 202 Main storage 203 Secondary storage device 204 Network Interface 205 Bus 500 Rating Information 600 Planning Information

Claims

1. 1. A computer system comprising: a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor; maintaining vulnerability information for managing vulnerabilities of elements that can be used to configure an IT system; The processor: acquiring, from the target IT system, configuration information for managing elements constituting the IT system; Using the configuration information and the vulnerability information, identify vulnerabilities present in the target IT system; executing a vulnerability assessment process for assessing the risk of the identified vulnerability itself, and storing the execution result of the vulnerability assessment process as a first result; obtaining a result of a threat analysis process for the target IT system; assessing a risk to the target IT system due to the identified vulnerability based on a result of the threat analysis process, and storing the result of the assessment as a second result; A computer system characterized in that a priority of responses to the identified vulnerabilities is determined based on the first result and the second result of the identified vulnerabilities.

2. 2. The computer system of claim 1, The processor evaluates the risk to the target IT system posed by the identified vulnerability by determining, based on the results of the threat analysis process, at least one of the assets affected by the threat posed by the identified vulnerability, the magnitude of the impact of the threat utilizing the identified vulnerability, and whether or not countermeasures have been taken against the identified vulnerability.

3. 3. The computer system according to claim 2, The processor: calculating an evaluation value representing a risk of the identified vulnerability based on the first result and the second result; A computer system characterized in that a priority order of responses to the identified vulnerabilities is determined based on the evaluation value.

4. 4. The computer system according to claim 3, The computer system is characterized in that the vulnerability assessment process is a process using a Stakeholder-Specific Vulnerability Categorization method.

5. A method for supporting planning of a response to vulnerability executed by a computer system, comprising: The computer system a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor; maintaining vulnerability information for managing vulnerabilities of elements that can be used to configure an IT system; The method for supporting planning of responses to vulnerabilities comprises: a first step in which the processor acquires, from a target IT system, configuration information for managing elements that configure the IT system; a second step in which the processor identifies vulnerabilities present in the target IT system using the configuration information and the vulnerability information; a third step in which the processor executes a vulnerability assessment process to assess the risk of the identified vulnerability itself and stores a result of the execution of the vulnerability assessment process as a first result; a fourth step in which the processor obtains a result of a threat analysis process for the target IT system; a fifth step in which the processor evaluates a risk to the target IT system due to the identified vulnerability based on a result of the threat analysis process, and stores the result of the evaluation as a second result; a sixth step in which the processor determines a priority of a response to the identified vulnerability based on the first result and the second result of the identified vulnerability; A method for supporting vulnerability response planning, comprising:

6. 6. The vulnerability response planning support method according to claim 5, The fifth step is a method for supporting planning responses to vulnerabilities, characterized in that it includes a step in which the processor evaluates the risk to the target IT system posed by the identified vulnerability by determining, based on the results of the threat analysis processing, at least one of: the assets affected by the threat posed by the identified vulnerability; the magnitude of the impact of the threat utilizing the identified vulnerability; and whether or not countermeasures have been taken against the identified vulnerability.

7. 7. The vulnerability response planning support method according to claim 6, The sixth step includes: a step of the processor calculating an evaluation value representing a risk of the identified vulnerability based on the first result and the second result of the identified vulnerability; and a step in which the processor determines a priority of responses to the identified vulnerabilities based on the evaluation value.

8. 8. The vulnerability response planning support method according to claim 7, The vulnerability assessment process is a process using a Stakeholder-Specific Vulnerability Categorization method.

Images