Evaluation device, evaluation method, and program

Abstract

To determine which software or the like is to be preferentially repaired.SOLUTION: The evaluation device performs an internal scan and an external scan on the device to be evaluated, and determines to preferentially repair the content of the common software and the resource and the path corresponding to the software by comparing the results of both scans with each other.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an evaluation device, an evaluation method, and a program. [Background technology]

[0002] The vulnerability assessment system described in Patent Document 1 aims to be able to assess the impact of a vulnerability on a system. To achieve this aim, the vulnerability assessment system determines whether software affected by a vulnerability can be directly attacked from an external network (for example, paragraph 0009 and claim 1 of Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-208863 Summary of the Invention [Problem to be solved by the invention]

[0004] However, although the vulnerability assessment system described above determines the possibility of an attack from an external network, as described above, it has the problem of being unable to determine, for example, which software should be repaired first among multiple pieces of software that contain different vulnerabilities.

[0005] An object of the present disclosure is to provide an evaluation device, an evaluation method, and a program that can determine which software among a plurality of pieces of software should be repaired with priority. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems, the evaluation device according to the present disclosure includes: a first acquisition unit that acquires a name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation target device having a plurality of pieces of software, each piece of software having a version number, and a plurality of resources used for the plurality of pieces of software, each resource being identified by a path indicating the location of the resource; a second acquisition unit that acquires a name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation target device; a matching / discrimination unit that compares the name and version of the first piece of software with the name and version of the second piece of software to determine common software names and versions and non-common software names and versions between the name and version of the first piece of software and the name and version of the second piece of software; an evaluation unit that evaluates that the risk of vulnerabilities in the common software names and versions is greater than the risk of vulnerabilities in the non-common software names and versions; and a determination unit that determines to preferentially repair at least one of the content of the common software and the resources and paths corresponding to the common software. [Effects of the Invention]

[0007] According to the evaluation device of the present disclosure, it is possible to determine which of the plurality of pieces of software should be repaired with priority. [Brief explanation of the drawings]

[0008] [Figure 1] 1 shows the configuration of a vulnerability risk assessment system ZRH according to an embodiment. [Figure 2] 1 shows the configuration of an evaluation device HY according to an embodiment. [Figure 3] 1 shows the configuration of an evaluation target device HI according to an embodiment. [Figure 4] 1 shows the functions of the evaluation device HI according to the embodiment. [Figure 5] 1 illustrates the function of a vulnerability database DB(ZE) according to an embodiment. [Figure 6] 1 is a flowchart showing the operation of the vulnerability risk assessment system ZRH according to the embodiment. [Figure 7] 10 shows the results of executing the internal scan NS in step ST11 of the embodiment. [Figure 8] 10 shows the results of executing the external scan GS in step ST12 of the embodiment. [Figure 9] 10 illustrates the acquisition ST of vulnerability ZE in step ST13 of the embodiment. [Figure 10] 10 shows the butting TG in step ST14 of the embodiment. [Figure 11] 10 shows the evaluation HK of step ST15 of the embodiment. [Figure 12] 10 shows the determination KT1 in step ST16 of the embodiment. [Figure 13] 10 shows the determination KT2 in step ST18 of the embodiment. [Figure 14] The concept of internal scan NS and external scan GS (one example) is shown below. [Figure 15] The concepts of internal scan NS and external scan GS (other examples) are shown below. [Figure 16] 1 shows the hardware configuration of an evaluation device HY and an evaluated device HI according to an embodiment. [Figure 17] 1 shows a hardware configuration based on software realization of an evaluation device HY and an evaluated device HI according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of the vulnerability risk assessment system ZRH according to the present disclosure will be described.

[0010] <Embodiment> The vulnerability risk assessment system ZRH according to the embodiment will be described.

[0011] <Configuration of the embodiment> FIG. 1 shows the configuration of a vulnerability risk assessment system ZRH according to an embodiment.

[0012] The vulnerability risk assessment system ZRH of the embodiment includes an assessment device HY, assessed devices HI1 to HIm (m is an integer equal to or greater than 2), and a vulnerability database DB(ZE), as shown in Fig. 1. The assessment device HY, assessed devices HI1 to HIm, and vulnerability database DB(ZE) are connected to each other via a network NW (e.g., the Internet) as shown in Fig. 1.

[0013] The evaluation device HY is used by a user US to evaluate vulnerabilities ZE (for example, as shown in FIG. 9) of evaluation target devices HI1 to HIm, which are, for example, a server and a client. Details of the vulnerabilities ZE will be described later.

[0014] In the following, for ease of explanation and understanding, a plurality of names may be collectively referred to as one name, for example, the evaluated devices HI1, HI2, . . . , HIm may be collectively referred to as the evaluated device HI.

[0015] <Configuration of evaluation device HY> FIG. 2 shows the configuration of an evaluation device HY according to the embodiment.

[0016] As shown in FIG. 2, the evaluation device HY of the first embodiment has an input / output unit NY(HY), a processing unit SY(HY), a storage unit KI(HY), and a communication unit TU(HY).

[0017] The input / output unit NY (HY) is used by the user US to input commands to the device under evaluation HI (shown in FIG. 1) to execute an internal scan NS (e.g., as shown in FIG. 4) and an external scan GS (e.g., as shown in FIG. 4), and to output the results of executing the internal scan NS and the external scan GS. The input / output unit NY (HY) is, for example, a keyboard, a mouse, an LCD monitor, or a printer.

[0018] Here, "internal scan" refers to, for example, scanning each component (e.g., file, data, software) included in the device HI to be evaluated inside the device HI to obtain the attributes (e.g., name, version, etc.) of each component (e.g., the tool "trivy" can be used for this internal scan). Also, "external scan" refers to, for example, scanning each component (same as above) included in the device HI to be evaluated from outside the device HI to obtain the attributes (same as above) of each component (e.g., the tools "nmap" and "nucle" can be used for this external scan).

[0019] The processing unit SY (HY) performs, for example, the above-mentioned internal scan NS and external scan GS.

[0020] The storage unit KI (HY) stores, for example, data necessary for processing by the processing unit SY (HY).

[0021] The communication unit TU(HY) communicates via the network NW. For example, the communication unit TU(HY) transmits commands to the evaluated device HI to perform the internal scan NS and external scan GS, and receives the results of the internal scan NS and external scan GS from the evaluated device HI.

[0022] <Configuration of the evaluated device HI> FIG. 3 shows the configuration of the evaluation target device HI according to the embodiment.

[0023] As shown in FIG. 3, the device to be evaluated HI of the embodiment includes an input / output unit NY(HI), a processing unit SY(HI), a storage unit KI(HI), and a communication unit TU(HI).

[0024] The input / output unit NY(HI) is used by an administrator (not shown) of the evaluated device HI to monitor and control the normal operation of the evaluated device HI. The input / output unit NY(HI) is, for example, a keyboard, a mouse, an LCD monitor, and a printer.

[0025] The processing unit SY(HI) performs, for example, processing related to monitoring and controlling the normal operation of the above-mentioned evaluated device HI, and processing related to the above-mentioned internal scan NS and external scan GS upon request from the above-mentioned evaluation device HY.

[0026] The storage unit KI(HI) stores, for example, data necessary for processing by the processing unit SY(HI).

[0027] The communication unit TU(HI) communicates via the network NW. For example, the communication unit TU(HI) receives commands to perform the internal scan NS and external scan GS from the device under evaluation HI, and also transmits the results of executing the internal scan NS and external scan GS to the device under evaluation HI.

[0028] <Functions of the evaluated device HI> <Software SW, version VE, resource RE, path PA, interface IF> FIG. 4 shows the functions of the evaluation target device HI according to the embodiment.

[0029] As shown in Fig. 4, the device to be evaluated HI has multiple pieces of software SW1, SW2, etc. Each of the multiple pieces of software SW1, SW2, etc. is assigned a version (version number of creation, repair, etc.). As shown in Fig. 4, for example, "software SW1" owned by the device to be evaluated HI is assigned to be "version VE2," and "software SW2" owned by the device to be evaluated HI is assigned to be "version VE3."

[0030] The device to be evaluated HI also has a plurality of resources RE1, RE2, ... used for a plurality of pieces of software SW1, SW2, ... as shown in Fig. 4. More specifically, the plurality of pieces of software SW1, SW2, ... are stored in a plurality of resources RE1, RE2, .... As shown in Fig. 4, for example, "software SW1" is stored in "resource RE1", and "software SW3, SW4" are stored in "resource RE3".

[0031] As shown in Figure 4, multiple resources RE1, RE2, ... are identified by multiple paths PA1, PA2, ... which are routes indicating the locations of the multiple resources RE1, RE2, ... (where the resources RE exist). Here, the "location of resource RE" broadly means the "location of software SW." As shown in Figure 4, for example, the location of "resource RE1," in other words, the location of "software SW1," is identified by "path PA1," and the location of "resource RE2," in other words, the location of "software SW2," is identified by "path PA2."

[0032] The evaluated device HI further has a plurality of interfaces IF1, IF2, etc., which are used for external scanning GS by the evaluation device HY, as shown in FIG.

[0033] <Internal Scan NS, External Scan GS> The device to be evaluated HI has an internal scan unit NS(HI) as shown in Fig. 4. In response to a request from the evaluation device HY, the internal scan unit NS(HI) executes a conventionally known internal scan NS on a plurality of pieces of software SW1, SW2, ..., and returns the results to the evaluation device HY.

[0034] As shown in Fig. 4, the evaluation device HI receives an external scan GS from the evaluation device HY via multiple interfaces IF1, IF2, etc. The evaluation device HY executes an external scan GS unspecified on multiple software programs SW1, SW2, etc. from the interface IF1, for example, and acquires results of the execution, such as "software SW1" and "version VE2" (shown in Fig. 8). The evaluation device HY also executes an external scan GS unspecified on multiple software programs SW1, SW2, etc. from the interface IF5, for example, and acquires results of the execution, such as "software SW3" and "version VE1" (shown in Fig. 8).

[0035] The reason for the "indefinite" is that the evaluating device HY cannot know in advance what kind of software SW the evaluated device HI has.

[0036] <Vulnerability Database DB(ZE)> FIG. 5 shows the function of the vulnerability database DB(ZE) according to the embodiment.

[0037] 5, the vulnerability database DB(ZE) indicates the correspondence between multiple software SW, versions VE, and vulnerabilities ZE, regardless of whether the software SW is included in the device under evaluation HI. For example, the vulnerability database DB(ZE) indicates that when "software SW1" is version "version VE2," it has vulnerability ZE "ZE1b," and when "software SW2" is version VE3, it has vulnerability ZE "ZE3c."

[0038] Correspondence The processing units SY(HY) and SY(HI) correspond to the "first acquisition unit," "second acquisition unit," "matching and discrimination unit," "evaluation unit," and "decision unit," and the internal scanning unit NS(HI) corresponds to the "first acquisition unit." The vulnerability database DB(ZE) indicates the "correspondence relationship."

[0039] <Operation of the embodiment> The operation of the vulnerability risk assessment system ZRH according to the embodiment will be described.

[0040] FIG. 6 is a flowchart showing the operation of the vulnerability risk assessment system ZRH according to the embodiment.

[0041] The operation of the vulnerability risk assessment system ZRH according to the embodiment will be described with reference to the flowchart of FIG.

[0042] In the following, for ease of explanation and understanding, it is assumed that the vulnerability ZE of the device to be evaluated HI1 among a plurality of devices to be evaluated HI1, HI2, . . . HIm is to be evaluated.

[0043] Step ST11: A user US (e.g., as shown in FIG. 1) inputs a command to an evaluation device HY (e.g., as shown in FIG. 1) to execute an internal scan NS (e.g., as shown in FIG. 4) to an evaluation target device HI1 (e.g., as shown in FIG. 1). As a result, the evaluation device HY notifies the evaluation target device HI1 that it will execute an internal scan NS. Upon receiving the notification, the evaluation target device HI1's internal scanning unit NS (HI) (e.g., as shown in FIG. 4) executes the internal scan NS.

[0044] FIG. 7 shows the result of executing the internal scan NS in step ST11 of the embodiment.

[0045] As a result of the internal scanning unit NS(HI) of the evaluated device HI1 performing an internal scan NS on the evaluated device HI1, the evaluation device HY acquires from the internal scanning unit NS(HI) information about the software SW possessed by the evaluated device HI1, as shown in Figure 7, such as that "software SW1" is "version VE2," "resource RE1" is used, and is identified by "path PA1," and that "software SW2" is "version VE3," "resource RE2" is used, and is identified by "path PA2."

[0046] Returning to FIG. 6, the explanation will continue.

[0047] Step ST12: The user US executes an external scan GS from the evaluation device HY to the evaluated device HI1 via the multiple interfaces IF1, IF2, . . . of the evaluated device HI1.

[0048] More specifically, first, the evaluation device HY inputs signals (solid arrows, dotted arrows) for performing an external scan GS to the evaluated device HI1 via the interface IF1 of the evaluated device HI1, and as a result, receives an output of a signal (not shown) for estimating what software SW the evaluated device HI1 has and what version VE of that software SW is.

[0049] Next, the evaluation device HY inputs signals (solid arrows, dotted arrows) for performing an external scan GS to the evaluated device HI1 via the interface IF2 of the evaluated device HI1, and as a result receives an output of a signal (not shown) for estimating what software SW the evaluated device HI1 has and what version VE of that software SW is.

[0050] Thereafter, the evaluation device HY performs an external scan GS on the interfaces IF3, IF4, . . . of the evaluated device HI1 in that order.

[0051] FIG. 8 shows the result of executing the external scan GS in step ST12 of the embodiment.

[0052] As a result of the evaluation device HY performing an external scan GS on the evaluated device HI1, the evaluation device HY estimates and acquires, for example, that "software SW1" is "version VE2" through the external scan GS from "interface IF1", and estimates and acquires that "software SW3" is "version VE1" through the external scan GS from "interface IF5", as shown in Figure 8.

[0053] Returning to FIG. 6, the explanation will continue.

[0054] Step ST13: The evaluation device HY acquires vulnerabilities ZE for the results of the internal scan NS and the results of the external scan GS by referring to the vulnerability database DB(ZE) (shown in Figures 1 and 5) (acquisition ST).

[0055] FIG. 9 shows the acquisition ST of vulnerability ZE in step ST13 of the embodiment.

[0056] As shown in FIG. 9, the evaluation device HY acquires the following vulnerabilities ZE by referring to the vulnerability database DB(ZE).

[0057] (1) Results of internal scan NS "Software SW1", "Version VE2", "Resource RE1", and "Path PA1" have vulnerability ZE "ZE1b". "Software SW2", "Version VE3", "Resource RE2", and "Path PA2" have vulnerability ZE "ZE2c" (2) Results of external scan GS "Software SW1", "Version VE2" has vulnerability ZE "ZE1b" "Software SW3", "Version VE1" has vulnerability ZE "ZE3a"

[0058] Returning to FIG. 6, the explanation will continue.

[0059] Step ST14: The evaluation device HY compares the results of the internal scan NS (shown in FIGS. 7 and 9) with the results of the external scan GS (shown in FIGS. 8 and 9) (matching TG).

[0060] FIG. 10 shows the butting TG in step ST14 of the embodiment.

[0061] The evaluation device HY compares the results of the internal scan NS with the results of the external scan GS as shown in Fig. 10. The evaluation device HY determines the following through this comparison.

[0062] (1) "Software SW1" and "Version VE2" are common to the results of the internal scan NS and the external scan GS (shown by the solid line). (2) "Software SW2" and "Version VE3" are not common to the results of the internal scan NS and the external scan GS (in other words, "Software SW2" and "Version VE3" exist only in the results of the internal scan NS) (shown by the dotted line). (3) "Software SW3" and "Version VE1" are not common to the results of the internal scan NS and the external scan GS (in other words, "Software SW3" and "Version VE1" exist only in the results of the external scan GS) (shown by the dotted line).

[0063] Returning to FIG. 6, the explanation will continue.

[0064] Step ST15: The evaluation device HY evaluates the magnitude of the risk of the vulnerability ZE based on the result of cross-checking the result of the internal scan NS and the result of the external scan GS (evaluation HK).

[0065] FIG. 11 shows the evaluation HK in step ST15 of the embodiment.

[0066] As shown in Figures 10 and 11, the evaluation device HY evaluates that the risk of vulnerability ZE "ZE1b" in "software SW1", version VE2, which is common between the results of the internal scan NS and the results of the external scan GS, is greater than the risk of vulnerability ZE "ZE2c" in "software SW2", version VE3, and vulnerability ZE "ZE3a" in "software SW3", version VE1, which are not common between the results of the internal scan NS and the results of the external scan GS.

[0067] Returning to FIG. 6, the explanation will continue.

[0068] Step ST16: The evaluation device HY determines the "software SW" to be repaired (decision KT1).

[0069] FIG. 12 shows the determination KT1 in step ST16 of the embodiment.

[0070] As shown in FIG. 12, the evaluation device HY determines to repair "software SW1" and "version VE2" with priority, which corresponds to vulnerability ZE "ZE1b" (shown in FIG. 11) that poses the greatest risk.

[0071] Returning to FIG. 6, the explanation will continue.

[0072] Step ST17: The evaluation device HY determines the "resource RE," "path PA," and "interface IF" to be repaired (decision KT2).

[0073] FIG. 13 shows the decision KT2 in step ST18 of the embodiment.

[0074] 10 and 13, the evaluation device HY determines that at least one of the "resource RE1" and the "path PA1" corresponding to the "software SW1" to be repaired with priority should be repaired with priority over other resources RE2, RE3, ... and other paths PA2, PA3, .... The evaluation device HY also determines that the "interface IF1" corresponding to the "software SW1" to be repaired with priority over other interfaces IF2, IF3, ....

[0075] Effects of the embodiment As described above, in the vulnerability risk assessment system ZRH of the embodiment, the assessment device HY can determine that, among the multiple "software SW1, SW2, ..." possessed by the assessed device HI, "software SW1" which has the greatest risk of vulnerability ZE should be repaired as a priority (decision KT1).

[0076] In the vulnerability risk assessment system ZRH of the embodiment, in addition to the above effect (decision KT1), it can be determined that, among the "plural resources RE1, RE2, ...," "plural paths PA1, PA2, ...," and "plural interfaces IF1, IF2, ...," the "resource RE1," "path PA1," and "interface IF1" corresponding to the "software SW1" that should be repaired with priority should be repaired with priority (decision KT2).

[0077] <Concepts of internal scan NS and external scan GS> FIG. 14 shows the concept (one example) of the internal scan NS and the external scan GS.

[0078] FIG. 14 conceptually shows the operations of the internal scan NS and external scan GS in FIG.

[0079] As shown in Figure 14, the internal scan NS is realized by the internal scanning unit NS(HI) included in the evaluated device HI transmitting the results of the internal scan NS of the evaluated device HI to the evaluation device HY via the network NW.

[0080] On the other hand, as shown in Figure 14, the external scan GS is realized when the external scan unit GS (HY) present inside the evaluation device HY receives the results of the external scan GS of the evaluation target device HI via the network NW.

[0081] FIG. 15 shows the concept (another example) of the internal scan NS and the external scan GS.

[0082] FIG. 15 is a variation of the inner scan NS and outer scan GS shown in FIG.

[0083] As shown in Figure 15, the internal scan NS is realized by the internal scanning unit NS(HI) included in the evaluated device HI transmitting the results of the internal scan NS of the evaluated device HI to the evaluation device HY via the network NW, as shown in Figure 14.

[0084] On the other hand, as shown in Figure 15, the external scan GS differs from that shown in Figure 14 in that an external scan unit GS (HY) located outside the evaluation device HY receives the results of the external scan GS of the evaluation device HY via the network NW and transmits the received results to the evaluation device HY.

[0085] <Hardware configuration of the embodiment> FIG. 16 shows the hardware configuration of the evaluation device HY and the evaluated device HI according to the embodiment.

[0086] In order to perform the above-described functions, the evaluation device HY and the evaluated device HI of the embodiment include a processing circuit SYO, as shown in FIG. 16, and may further include an input circuit NYU and an output circuit SYU as necessary.

[0087] The processing circuit SYO is dedicated hardware that mainly realizes the functions of the processing unit SY(HY) of the evaluation device HY (shown in FIG. 2) and the processing unit SY(HI) of the evaluated device HI (shown in FIG. 3).

[0088] The processing circuit SYO is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0089] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processing circuit SYO with, for example, the outside of the evaluation device HY and the evaluated device HI.

[0090] <Hardware configuration based on software implementation of the embodiment> FIG. 17 shows a hardware configuration based on software implementation of the evaluation device HY and the evaluated device HI according to the embodiment.

[0091] As shown in FIG. 17, the evaluation device HY and the evaluated device HI of the embodiment include a processor PRO and a memory circuit KIO, and may further include an input circuit NYU and an output circuit SYU as necessary.

[0092] The processor PRO is a CPU (also called a Central Processing Unit, central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, or DSP (Digital Signal Processing)) that executes programs. The processor PRO mainly realizes the functions of the processing unit SY(HY) of the evaluation device HY (shown in Figure 2) and the processing unit SY(HI) of the evaluated device HI (shown in Figure 3).

[0093] The processor PRO realizes the above-mentioned functions by software, firmware, or a combination of software and firmware. The software and firmware are written as programs and stored in the memory circuit KIO.

[0094] The processor PRO realizes the above-mentioned functions by reading and executing the above-mentioned programs from the memory circuit KIO. The above-mentioned programs can be said to mainly cause a computer to execute the procedures and methods of the processing unit SY(HY) of the evaluation device HY and the processing unit SY(HI) of the evaluated device HI.

[0095] Here, the memory circuit KIO is, for example, a non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), as well as a magnetic disk, flexible disk, optical disk, compact disk, mini disk, DVD (Digital Versatile Disc), etc.

[0096] Of the functions of the processing unit SY(HY) of the evaluation device HY and the processing unit SY(HI) of the evaluated device HI, some of the functions may be realized by a processing circuit SYO (shown in Figure 16), while other functions may be realized by a processor PRO (shown in Figure 17).

[0097] As described above, the functions of the processing unit SY(HY) of the evaluation device HY and the processing unit SY(HI) of the evaluated device HI can be realized by hardware, software, firmware, or a combination of these.

[0098] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processor PRO with, for example, the outside of the evaluating device HY and the evaluated device HI.

[0099] <Example of composition> The evaluation device, evaluation method, and program according to the present disclosure have, for example, the following configuration.

[0100] [Item 1] a first acquisition unit that acquires a name and a version of at least one first software among the plurality of software by internally scanning an evaluation target device that has a plurality of software programs, each of which has a version number assigned thereto, and a plurality of resources used for the plurality of software programs, each of which is specified by a path indicating the location of the resource; a second acquisition unit that acquires a name and a version of at least one second software item among the plurality of software items by externally scanning the device under evaluation; a matching / discrimination unit that matches the name and version of the first software with the name and version of the second software to determine which software names and versions are common between the name and version of the first software and the name and version of the second software and which software names and versions are not common; an evaluation unit that evaluates that the risk of vulnerability in the common software name and version is greater than the risk of vulnerability in the non-common software name and version; a determination unit that determines to prioritize repair of at least one of the contents of the common software and the resources and paths corresponding to the software; An evaluation device comprising:

[0101] [Item 2] the evaluation unit performs the evaluation by referring to a correspondence between names and versions of the plurality of software programs and a plurality of vulnerabilities. Item 1. The evaluation device according to item 1.

[0102] [Item 3] the device under evaluation has a plurality of interfaces used for the external scanning, the determining unit determines to preferentially repair, among the plurality of interfaces, an interface used by the second obtaining unit when obtaining the name and version of the common software among the names and versions of the second software. Item 1. The evaluation device according to item 1.

[0103] [Item 4] a first acquisition step of acquiring a name and version of at least one first software among the plurality of software by internally scanning an evaluation target device having a plurality of software programs, each of which has a version number assigned thereto, and a plurality of resources used for the plurality of software programs, each of which is specified by a path indicating the location of the resource; a second acquisition step of acquiring a name and a version of at least one second software item among the plurality of software items by externally scanning the device under evaluation; a matching and determining step of comparing the name and version of the first software with the name and version of the second software to determine which software names and versions are common between the name and version of the first software and the name and version of the second software and which software names and versions are not common; an evaluation step of evaluating that the risk of vulnerability in the common software name and version is greater than the risk of vulnerability in the non-common software name and version; a determining step of determining that at least one of the contents of the common software and the resources and paths corresponding to the software be repaired with priority; Evaluation methods including.

[0104] [Item 5] On the computer, a first acquisition step of acquiring a name and version of at least one first software among the plurality of software by internally scanning an evaluation target device having a plurality of software programs, each of which has a version number assigned thereto, and a plurality of resources used for the plurality of software programs, each of which is specified by a path indicating the location of the resource; a second acquisition step of acquiring a name and a version of at least one second software item among the plurality of software items by externally scanning the device under evaluation; a matching and determining step of comparing the name and version of the first software with the name and version of the second software to determine which software names and versions are common between the name and version of the first software and the name and version of the second software and which software names and versions are not common; an evaluation step of evaluating that the risk of vulnerability in the common software name and version is greater than the risk of vulnerability in the non-common software name and version; a determining step of determining that at least one of the contents of the common software and the resources and paths corresponding to the software be repaired with priority; A program to execute. [Explanation of symbols]

[0105] ZRH vulnerability risk assessment system, HY assessment device, HI1~HIm assessed device, DB(ZE) vulnerability database, NW network, US user.

Claims

1. a first acquisition unit that acquires a name and a version of at least one first software among the plurality of software by internally scanning an evaluation target device that has a plurality of software programs, each of which has a version number assigned thereto, and a plurality of resources used for the plurality of software programs, each of which is specified by a path indicating the location of the resource; a second acquisition unit that acquires a name and a version of at least one second software item among the plurality of software items by externally scanning the evaluation target device; a matching and discriminating unit that compares the name and version of the first software with the name and version of the second software to determine which software names and versions are common between the name and version of the first software and the name and version of the second software and which software names and versions are not common; an evaluation unit that evaluates that the risk of vulnerability in the common software name and version is greater than the risk of vulnerability in the non-common software name and version; a determination unit that determines to prioritize repair of at least one of the contents of the common software and the resources and paths corresponding to the software; An evaluation device comprising:

2. the evaluation unit performs the evaluation by referring to a correspondence between names and versions of the plurality of software programs and a plurality of vulnerabilities. The evaluation device according to claim 1 .

3. the device under evaluation has a plurality of interfaces used for the external scanning, the determining unit determines to preferentially repair the interface used by the second obtaining unit when obtaining the name and version of the common software among the names and versions of the second software, among the plurality of interfaces; The evaluation device according to claim 1 .

4. a first acquisition step of acquiring a name and version of at least one first software among the plurality of software by internally scanning an evaluation target device having a plurality of software programs, each of which has a version number assigned thereto, and a plurality of resources used for the plurality of software programs, each resource being specified by a path indicating the location of the resource; a second acquisition step of acquiring a name and a version of at least one second software item among the plurality of software items by externally scanning the device to be evaluated; a matching / discrimination process for comparing the name and version of the first software with the name and version of the second software to determine which software names and versions are common between the name and version of the first software and the name and version of the second software and which software names and versions are not common; an evaluation step of evaluating that the risk of vulnerability in the common software name and version is greater than the risk of vulnerability in the non-common software name and version; a determining step of determining that at least one of the contents of the common software and the resources and paths corresponding to the software be repaired with priority; Evaluation methods including.

5. On the computer, a first acquisition step of acquiring a name and version of at least one first software among the plurality of software by internally scanning an evaluation target device having a plurality of software programs, each of which has a version number assigned thereto, and a plurality of resources used for the plurality of software programs, each resource being specified by a path indicating the location of the resource; a second acquisition step of acquiring a name and a version of at least one second software item among the plurality of software items by externally scanning the device to be evaluated; a matching / discrimination process for comparing the name and version of the first software with the name and version of the second software to determine which software names and versions are common between the name and version of the first software and the name and version of the second software and which software names and versions are not common; an evaluation step of evaluating that the risk of vulnerability in the common software name and version is greater than the risk of vulnerability in the non-common software name and version; a determining step of determining that at least one of the contents of the common software and the resources and paths corresponding to the software be repaired with priority; A program to execute.

Images