Security management system and security management method

Abstract

To enable efficient execution of planning of a measure effective and suitable for a threat.SOLUTION: A security management system stores attack event information including information on attack against each of resources constituting an information processing system, measure list information including information on a measure against the attack, and an evaluation object model including information which specifies a configuration of the information processing system as an evaluation object of a security measure, extracts attacks assumed for resources of the evaluation object model from the attack event information, extracts a measure against each of the extracted attacks from the measure list information, and produces a screen having information described thereon showing the extracted attacks and the extracted measure associated with each other. The security management system also describes, on the screen, the information showing the extracted attacks and the extracted measure associated with each other in such a way as to arrange the information in descending order of a risk value obtained by evaluation for each of the extracted attacks.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a security management system and a security management method. [Background technology]

[0002] In recent years, the methods of cyber attacks have become more diverse, and the importance of measures against threats that target vulnerabilities in complex information processing systems is increasing. In order to take appropriate measures quickly against various threats, it is essential to efficiently plan effective measures against threats.

[0003] As a mechanism for supporting the formulation of security measures, for example, Patent Document 1 describes a security measures selection support system configured for the purpose of verifying the cost-effectiveness of a combination of security measures. For any combination of security measures stored in a database, the security measures selection support system calculates and outputs the total cost of the security measures for the combination and the expected amount of damage for a predetermined period when the security measures for the combination are implemented, based on the information stored in the database.

[0004] Also, for example, Patent Document 2 describes a security operations management system that is configured for the purpose of reducing the burden on an administrator who constructs knowledge in security operations management using knowledge such as threat countermeasure knowledge by using knowledge that is commonly applicable to multiple information systems, even if the information systems have different system configurations. The security operations management system derives a calculation formula for calculating a risk value that reflects system configuration information by applying system configuration information to common threat countermeasure knowledge that is not dependent on the system configuration information, and analyzes the risk of the information system using the calculation formula and the system configuration information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-200991 A [Patent Document 2] JP 2009-140041 A Summary of the Invention [Problem to be solved by the invention]

[0006] Incidentally, in security consulting work, for example, which supports clients in identifying potential threats to their information processing systems and developing countermeasures against those threats, it is necessary to clearly explain to the client that appropriate countermeasures have been implemented to defend against threatening attacks.

[0007] However, in complex information processing systems, there are many combinations of threats and countermeasures, and it takes a lot of time and effort to organize the threats and countermeasures, select countermeasures against the threats, and check that all the countermeasures against the threats are complete. In addition, when providing consulting services, it is necessary to respond in detail to various customer requests, such as the effectiveness of the proposed countermeasures against threats and the priority order of the countermeasures to be taken.

[0008] In the technology described in Patent Document 1, the correspondence between specific threats and countermeasures is not organized. Therefore, it is not possible to grasp which threats the countermeasures are effective against. In addition, in the technology described in Patent Document 2, the correspondence (traceability) between threats and countermeasures is lost, making it impossible to specifically show customers which threats the countermeasures are being taken against. can't be done.

[0009] The present invention has been made in view of the above background, and has an object to provide a security management system and a security management method for supporting the creation of effective and appropriate measures against threats. [Means for solving the problem]

[0010] One of the present inventions for achieving the above object is a security management system configured using an information processing device having a processor and a memory, the security management system configured using the information processing device having a processor and a memory stores attack event information including information on attacks against each of the assets constituting the information processing system, countermeasure list information including information on countermeasures against the attacks, and an evaluation target model including information specifying the configuration of the information processing system that is the target of an evaluation of security countermeasures, extracts attacks anticipated against the assets of the evaluation target model from the attack event information, extracts countermeasures against each of the extracted attacks from the countermeasure list information, and outputs a screen showing information showing the extracted attacks in correspondence with the extracted countermeasures. a function for allowing a user to select one or more of the extracted countermeasures on the screen; determining an index showing an attack extension effect obtained by each of the countermeasures selected by the user; and writing information based on the determined index on the screen. .

[0011] Other problems and solutions disclosed in the present application will be made clear in the detailed description and drawings. Effect of the Invention

[0012] According to the present invention, it is possible to assist in planning effective and appropriate measures against threats. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 illustrates an example of a security management system. [Diagram 2] FIG. 2 is a diagram illustrating an example of functions of a center server. [Diagram 3] FIG. 2 is a diagram illustrating an example of functions provided in a user terminal. [Figure 4] FIG. 1 illustrates an example of an information processing device used in a configuration of a security management system. [Diagram 5] FIG. 11 is a sequence diagram illustrating an example of a countermeasure planning process. [Figure 6] This is an example of a module / asset list. [Figure 7] 11 is a schematic diagram showing an example of evaluation target information and an attack module ID. [Figure 8] 1 is an example of a link list. [Figure 9] This is an example of a lifecycle / participant definition. [Figure 10A] This is an example of a What template. [Figure 10B] This is an example of a What template. [Figure 11] 1 is an example of attack event information (attack event table). [Figure 12A] 13 is an example of an impact level classification table. [Figure 12B] 13 is an example of an attack ease classification table. [Figure 13] 1 is an example of threat list information. [Figure 14A] This is an example of an attack path model. [Figure 14B] 1 is an example of an attack event map. [Figure 15] 13 is an example of countermeasure list information. [Figure 16] 13 is an example of a countermeasure selection condition table. [Figure 17] 13 is an example of a countermeasures table. [Figure 18A] 13 is an example of a presentation screen. [Figure 18B] 13 is an example of a presentation screen. [Figure 18C] 13 is an example of a presentation screen. [Figure 19] 13 is an example of standard compliance measure information. [Figure 20] 13 is an example of past analysis result information. [Figure 21] FIG. 13 is a sequence diagram showing an example of a consultant-customer sequence. [Figure 22] 13 is a flowchart illustrating an example of an attack event information update process. [Diagram 23] 13 is a flowchart showing an example of a countermeasure selection condition table update process. [Figure 24] 13 is a flowchart showing an example of a standard compliance countermeasure information update process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The following description and drawings are examples for explaining the present invention, and are omitted or simplified as appropriate for clarity of explanation. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

[0015] In the following description, when explaining identification information, expressions such as "identifier," "name," "ID," and "number" are used, but these can be interchanged with each other.

[0016] In the following description, various information may be described using expressions such as "table" and "information", but the various information may be expressed in a data structure other than these. In addition, an "XX table" or the like may be referred to as "XX information" to indicate that it is not dependent on the data structure.

[0017] In the following description, a "communication network" may be referred to as a "communication NW." In the following description, a "communication interface" may be referred to as a "communication IF."

[0018] In the following description, duplicated descriptions of identical or similar configurations may be omitted. In the following description, the letter "S" added before a reference symbol indicates a processing step.

[0019] FIG. 1 shows a schematic configuration of an information processing system (hereinafter, referred to as a "security management system 1") that will be described as an embodiment.

[0020] As shown in the figure, the security management system 1 includes a center server 100 and one or more user terminals 200. The center server 100 and the user terminals 200 are communicatively connected via a first communication NW 51. The center server 100 is also communicatively connected via a second communication NW 52 to an external server 300 that provides information related to security (hereinafter referred to as "security-related information"). The first communication NW 51 and the second communication NW 52 are wired or wireless communication networks, such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, or various public wireless communications. The first communication NW 51 and the second communication NW 52 may be a common communication network or may be connected to each other.

[0021] The center server 100 is, for example, an information processing device managed by a business providing SOC services (SOC: Security Operation Center), and uses security-related information to generate information on threats and countermeasures against threats (hereinafter referred to as "threat / countermeasure information") and provides the generated threat / countermeasure information to a user via the user terminal 200.

[0022] The user terminal 200 is an information processing device used by a user who uses the threat / countermeasure information provided by the center server 100. The user is, for example, a security advisor who provides consulting services on explaining anticipated threats to a client's information processing system and countermeasures against the threats.

[0023] The external server 300 provides security-related information. In this embodiment, the external server 300 organizes, in a matrix, tactics (TPPs), techniques, and procedures that an attacker uses to achieve a target objective in an information processing system. The external server 300 provides information on threats, including information on threat mitigation measures and detection methods linked to specific methods that attackers may use. Examples of such systems include "ATT&CK for Enterprise" (registered trademark) provided by Lockheed Martin (registered trademark) and "Cyber ​​Kill Chain" (registered trademark) developed by Lockheed Martin (registered trademark).

[0024] 2 shows the main functions of the center server 100. As shown in the figure, the center server 100 has the following functions: a storage unit 110, an information acquisition management unit 130, an information update management unit 132, an evaluation target model generation unit 134, a threat list generation unit 140, a risk assessment unit 142, an attack path model generation unit 145, a countermeasure generation unit 150, an information presentation unit 160, and a countermeasure reception unit 165.

[0025] Of the above functions, the storage unit 110 stores various input information 111, an evaluation target model 112, threat list information 113, an attack path model 114, an attack event map 115, countermeasure list information 116, a countermeasure selection condition table 117, a countermeasure proposal table 118, user-provided information 119, various reference information 120, standard-compliant countermeasure information 122, an attack event information DB 123, and past analysis result information 124. Of these, the various input information 111 includes a module / asset list 1101, evaluation target information 1102, a link list 1103, a life cycle / participant definition 1104, an AWhat template 1105, and an attack module ID 1106. In addition, the various reference information 120 includes an impact level classification table 1211 and an attack ease classification table 1212.

[0026] The information acquisition management unit 130 acquires information from the external server 300 and the user terminal 200 , and manages the acquired information as various input information 111 and various reference information 120 .

[0027] The information update management unit 132 acquires information from the external server 300, and reflects the acquired information in the standard compliance countermeasure information 122 and the attack event information 123. The information update management unit 132 also updates the past analysis result information .

[0028] The evaluation object model generation unit 134 generates an evaluation object model 112 based on various input information 111 .

[0029] The threat list generating unit 140 extracts threats assumed for the evaluation target model 112 from the attack event information 123 and manages the extracted threats in the threat list information 113 .

[0030] The risk assessment unit 142 calculates a risk value for each of the extracted threats, and reflects the calculated value in the threat list information 113. The risk value is, for example, a risk score based on the Common Vulnerability Scoring System (CVSS). The calculation is based on the Vulnerability Scoring System.

[0031] The attack path model generation unit 144 generates an attack path model 114, which is a model that reflects information indicating the attack path of each threat in the threat list information 113 in the evaluation target model 112. In addition, the attack path model generation unit 144 generates an attack event map 115, which is information that visually shows the attack path model 114. Note that the attack path model 114 and the attack event map 115 are described in accordance with specifications for describing cyber attack activities, such as STIX (Structured Threat Information eXpression).

[0032] The countermeasure generation unit 150 extracts countermeasures for each threat in the threat list information 113 based on the countermeasure list information 116 and the countermeasure selection condition table 117, and stores the extracted countermeasures in the countermeasure proposal table 118. Manage to.

[0033] The information presenter 160 generates information (screen information, audio information, etc.) to be presented to the user, and transmits the generated information to the user terminal 200.

[0034] The countermeasure receiving unit 165 receives the result of the selection of countermeasures by the user from the user terminal 200. The received selection result is reflected in the past analysis result information 124 by the information update management unit 132.

[0035] 3 is a block diagram illustrating main functions of the user terminal 200. As shown in the figure, the user terminal 200 has the functions of a storage unit 210, a dialogue processing unit 220, a variety of input information receiving unit 230, a variety of input information transmitting unit 235, a user-provided information receiving unit 240, and a user-provided information output unit 245.

[0036] Of the above functions, the storage unit 210 stores various input information 111 and user-provided information 119 .

[0037] The dialogue processor 220 provides a function for accepting information input from a user and a function for presenting information to the user.

[0038] The various input information receiving unit 230 receives the various input information 111 via the dialogue processing unit 220. The various input information transmitting unit 235 transmits the various input information 111 received by the various input information receiving unit 230 to the center server 100 via the first communication NW 51.

[0039] The user-provided information receiving unit 240 receives the user-provided information 119 from the center server 100 via the first communication NW 51. The user-provided information output unit 245 presents the user-provided information 119 to the user via the dialogue processing unit 220.

[0040] FIG. 4 shows an example of a hardware configuration of an information processing device (computer) used to realize the center server 100 and the user terminal 200. As shown in FIG.

[0041] The illustrated information processing device 10 includes a processor 11, a main storage device 12 (memory), an auxiliary storage device 13 (external storage device), an input device 14, an output device 15, and a communication device 16. These are communicatively connected via a bus, a communication cable, etc. Examples of the information processing device 10 include a personal computer, a server device, a smartphone, a tablet, an office computer, a general-purpose machine (mainframe), etc.

[0042] The information processing device 10 may be realized, in whole or in part, by using virtual information processing resources provided by using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. Also, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by the cloud system via an API (Application Programming Interface) or the like. All or part of the functions provided by the information processing device 10 may be provided as, for example, Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), etc. It may be realized by using the Service as a Service, etc.

[0043] The processor 11 may be, for example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), or the like. It is composed of chips such as ASIC (Application Specific Integrated Circuit), AI (Artificial Intelligence), etc.

[0044] The main memory device 12 is a device used when the processor 11 executes a program, and is, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a non-volatile memory (NVRAM (Non Volatile RAM)), etc. Various functions realized in the center server 100 and the user terminal 200 are realized by each processor 11 reading out programs and data stored (memorized) in the auxiliary memory device 13 into the main memory device 12 and executing them.

[0045] The auxiliary storage device 13 is a device for storing programs and data, and may be, for example, a solid state drive (SSD), a hard disk drive, or an optical storage device (CD (Compact Disc) The auxiliary storage device 13 can be configured with a non-transient storage medium such as a digital video card (Digital Versatile Disc, DVD, etc.), a storage system, a reader / writer for non-transient storage media such as an IC card, an SD card, or an optical storage medium, a non-transient storage area of ​​a cloud server, etc. Programs and data can be read into the auxiliary storage device 13 from other information processing devices equipped with non-transient storage media or non-transient storage devices via a recording medium reader or a communication device 16. The programs and data stored (memorized) in the auxiliary storage device 13 are read into the main storage device 12 as needed.

[0046] The input device 14 is an interface that accepts input of information from the outside, and is, for example, a keyboard, a mouse, a touch panel, a card reader, a pen-input tablet, a voice input device, or the like.

[0047] The output device 15 is an interface that outputs various information such as the process progress and the process result to the outside. The output device 15 is, for example, a display device (liquid crystal monitor, LCD (Liquid Crystal Display), graphic card, etc.) that visualizes the above-mentioned various information, a device that converts the above-mentioned various information into voice (voice output device (speaker, etc.)), and a device that converts the above-mentioned various information into text (printer, etc.). For example, the information processing device 10 may be configured to input and output information to and from other devices via the communication device 16.

[0048] The input device 14 and the output device 15 constitute a user interface that realizes interactive processing with the user (receiving information, providing information, etc.).

[0049] The communication device 16 is a device that realizes communication with other devices. The communication device 16 is a wired or wireless communication interface that realizes communication with other devices via the communication medium 5, and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, or the like.

[0050] In addition, the information processing device 10 may be implemented with, for example, an operating system, a file system, a DBMS (DataBase Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), etc.

[0051] 5 is a sequence diagram for explaining the process (hereinafter referred to as "countermeasure planning process S500") performed in the security management system 1. The countermeasure planning process S500 will be explained below with reference to FIG. 5. Note that the user in the following explanation is assumed to be, as an example, a security advisor who provides consulting services regarding security management for a client's information processing system (hereinafter referred to as "evaluation target system").

[0052] As shown in the figure, the information update management unit 132 of the center server 100 acquires the latest information from the external server 300 via the second communication NW 52 at any time, and updates the contents of the standard compliance countermeasure information 122 and the attack event information 123 at any time based on the acquired information (S511). Details of the standard compliance countermeasure information 122 and the attack event information 123 will be described later.

[0053] The user terminal 200 accepts various input information 111 (module / asset list 1101, evaluation target information 1102, link list 1103, life cycle / participant definition 1104, What template 1105, and attack module ID 1106) from the user and transmits the accepted information to the center server 100 (S512).

[0054] 6 shows an example of a module / asset list 1101. Information about modules and assets that constitute the system to be evaluated is managed in the module / asset list 1101. As shown in the figure, the module / asset list 1101 is made up of a plurality of records, each of which includes the following items: module ID 611 (denoted as "#" in the figure; the same applies to other figures), module name, asset 613, asset ID 614, asset type 615, and impact level 616.

[0055] Of the above items, module ID 611 stores a module ID that is an identifier of the module. Module name 612 stores the name of the module. Asset 613 stores the name of the asset that is the target of protection from attacks among the assets that constitute the module. Asset type 615 stores information indicating the type of asset (such as "function", "information (communication data)"). CIA impact 616 stores information indicating the impact of each CIA (C: confidentiality, I: integrity, A: availability) when each asset is attacked. In this example, it is assumed that one of the ranks "none", "minor", or "severe" is selected for each CAI. The numerical value entered in this item is used, for example, to calculate a risk value.

[0056] 7 is a diagram showing a schematic diagram of evaluation target information 1102 and attack module ID 113. The diagram shows an example in which the evaluation target is an "IoT control device." The entities of the evaluation target information 1102 and attack module ID 113 are managed, for example, as a table or data in a predetermined format.

[0057] As shown in the figure, the evaluation target information 1102 includes information indicating modules (mobile communication function, IoT function, control information communication function, external center, control network, etc.), assets of each module (mobile communication function, external information, IoT function, control information, sensor information, control instructions, etc.), and communications performed between modules (authenticated path, unauthenticated path, etc.).

[0058] Attack module ID 113 includes information (hereinafter referred to as "attack module ID") indicating the module (hereinafter referred to as "attack module") that is the target of an external attack. In the example shown in the figure, the attack modules are the "external center" and the "control network", and "4" and "5" are stored in attack module ID 113.

[0059] 8 shows an example of the link list 1103. The link list 1103 includes information on communication paths in the system to be evaluated and the number of authentication processes performed on each path (hereinafter, referred to as the "number of authentications").

[0060] As shown in the figure, the link list 1103 is made up of a plurality of records each consisting of the following items: module ID (source) 811 , module ID (destination) 812 , link name 813 , number of shortest paths 814 , shortest paths 815 , and number of authentications 816 .

[0061] Of the above items, module ID (source) 811 stores the module ID of the source module, and module ID (destination) 812 stores the module ID of the destination module.

[0062] The link name 813 stores an identifier (hereinafter referred to as a "link name") that is assigned to each connection (link) between the system to be evaluated and the outside.

[0063] The number of shortest routes connecting a source module and a destination module is stored in the number of shortest routes 814. The shortest routes 815 stores information indicating the above-mentioned shortest routes.

[0064] The number of times authentication processing is performed on the shortest route is stored in the authentication count 816 .

[0065] FIG. 9 shows an example of the life cycle / participant definition 1104. Definition 1104 is information equivalent to "Who" in the 5W analysis (hereinafter, "Life Cycle As shown in the figure, the life cycle / participant definition 1104 includes a definition ID 911, a phase 912, a sub-phase 913, an overview 914, and a participant definition 915. It is composed of multiple records, each of which consists of the items of the donor 916.

[0066] Of the above items, definition ID 911 stores a definition ID that is an identifier for each life cycle / participant definition.

[0067] The phase 912 stores information indicating a phase in the life cycle of a business carried out using the system to be evaluated (such as "planning", "product development", "development and manufacturing"), and the sub-phase 913 stores information indicating a sub-phase in the life cycle (such as "planning", "product design", "manufacturing").

[0068] Information indicating an overview of the sub-phase is stored in the summary 914. Information indicating the participants (users, third parties, etc.) of the sub-phase is stored in the participants 916.

[0069] 10A and 10B show examples of the What template 1105. The What template 1105 includes information corresponding to "What" in the 5W analysis. The What template 1105 stores What information for each asset type 615 in the module / asset list 1101. FIG. 10A is an example of the What template 1105 focusing on information assets (stored data, communication data). FIG. 10B is an example of the What template 1105 focusing on functional assets (the functions themselves, firmware that realizes the functions).

[0070] The What template 1105 illustrated in FIG. 10A and FIG. 10B includes information describing attack methods (reference numbers 1012, 1013, 1021, 1022) for each of C (confidentiality), I (integrity), and A (availability) (reference numbers 1011, 1021).

[0071] Returning to FIG. 5, next, when the information acquisition management unit 130 of the center server 100 receives the various input information 111 from the user terminal 200, it manages the contents of the received various input information 111 as information defining the evaluation target model 112 (S513).

[0072] Next, the threat list generation unit 140 of the center server 100 extracts threats assumed for the evaluation target model 112 from the attack event information 123 (S514). In addition, the threat list generation unit 140 calculates a risk value of each extracted threat using the impact level classification table 1211 and the attack ease classification table 1212, and reflects the calculated values ​​in the threat list information 113 (S515).

[0073] 11 shows an example of a table (hereinafter referred to as an "attack event table") constituting the attack event information 123. The attack event table includes information organizing the tactics, techniques, and procedures used by attackers to achieve their targeted objectives, and information on threat countermeasures (mitigation measures, detection methods) linked to specific methods that attackers may employ.

[0074] As shown in the figure, the example attack event table has a major category ID of 1111, a major category The attack information 1112 is made up of a plurality of records including an attack ID 1113 , an attack item 1114 , a communication interface type 1115 , a time required for the attack 1116 , an attack prevention countermeasure policy 1117 , and an effect of the countermeasure 1118 .

[0075] Among the above items, a major category ID that is an identifier for each major category is stored in the major category ID 1111. The major category 1112 stores the name of the major category.

[0076] The attack ID 1113 stores an attack ID that is an identifier of an attack in each category. The attack IDs are assigned in ascending order according to the order of attacks within a large category. The attack item 1114 stores information indicating the content of the attack.

[0077] The communication IF type 1115 stores information indicating the target of the attack (mobile communication, control network, etc.), whether or not an attack is selected depending on the target, and links in the attack order. The time required for the attack 1116 stores an estimated time required for the attack.

[0078] Information specifying the countermeasure policy for the attack (in this example, the identifier of the countermeasure policy) is stored in the attack prevention countermeasure policy 1117. Information indicating the effect of the countermeasure when the countermeasure is taken is stored in the countermeasure effect 1118. In this example, the above effect is expressed as large, medium, or small, and large is evaluated as a 10 times effect, medium is evaluated as a 5 times effect, and small is evaluated as a 3 times effect.

[0079] Fig. 12A shows an example of the impact level classification table 1211, and Fig. 12B shows an example of the attack susceptibility classification table 1212. The impact level classification table 1211 and the attack susceptibility classification table 1212 manage information on parameters used when calculating a risk assessment value by CVSS.

[0080] As shown in Fig. 12A, the impact level category table 1211 manages information indicating a category 1202 and a definition 1203 for each parameter (AV, AC, Au, C, I, A) 1201. In FIG. 12B, the numerical values ​​used to calculate the risk value for each parameter (AV, AC, Au) are managed.

[0081] The threat list generation unit 140 calculates a risk value for each extracted threat using the impact degree classification table 1211 and the attack ease classification table 1212. The threat list generation unit 140 calculates the risk value, for example, from each of the following formulas.

[0082] [Number 1] Impact =10.41×(1-(1-C)×(1-I)×(1-A)) [Number 2] Attack Ease = 20 x AV x AC x Au [Number 3] f(impact) = 0 (if the impact is 0), 1.176 (if the impact is non-zero) [Number 4] Risk value = ((0.6 x impact) + (0.4 x ease of attack) - 1.5) x f (impact)

[0083] When calculating the risk value using the above formula, for example, the threat list generating unit 140 may automatically select the parameters (AV, AC, Au).

[0084] 13 shows an example of the threat list information 113. In the threat list information 113, threats extracted from the attack event information 123 for the evaluation target model 112 and the risk value of each threat are managed. As shown in the figure, the illustrated threat list information 113 includes an asset 1311, a From 1312, 2, Who 1313, When 1314, Why 1315, What 1316, and risk value 1317.

[0085] Of the above items, asset 1311 stores information indicating an asset. From 1312 stores information indicating an attack path. Who 1313, When 1314, Why 1315, and What 1316 store information used in 5W analysis. Risk value 1317 stores a risk value calculated by threat list generation unit 140 for each threat.

[0086] 5, next, the attack path model generation unit 144 of the center server 100 generates information indicating the attack paths of each threat in the threat list information 113 in the evaluation target model 112 based on the threat list information 113 as the attack path model 114 (S516). In addition, the attack path model generation unit 144 generates an attack event map 115, which is information visually indicating the attack path model 114 (S517).

[0087] FIG. 14A shows an example of the attack path model 114, and FIG. 14B shows an example of the attack event map 115.

[0088] Returning to FIG. 5, next, the countermeasure generation unit 150 of the center server 100 extracts countermeasures for each threat in the threat list information 113 based on the countermeasure list information 116 and the countermeasure selection condition table 117, and generates a countermeasure proposal table 118 that lists the extracted countermeasures (S518).

[0089] 15 shows an example of the countermeasure list information 116. The countermeasure list information 116 manages countermeasure policy proposals for threats to various assets, acquired from the external server 300 or user input, etc. The countermeasures in the countermeasure list information 116 may include countermeasures that are effective against multiple attacks.

[0090] As shown in the figure, the countermeasure information list 116 is made up of a plurality of records having the following items: asset 1511 , From 1512 , Who 1513 , When 1514 , Why 1515 , What 1516 , risk value 1517 , countermeasure type 1518 , and countermeasure 1519 .

[0091] Of the above items, asset 1511 stores information indicating an asset. From 1512 stores information indicating an attack path. Who 1513, When 1514, Why 1515, and What 1516 store information used in 5W analysis. Risk value 1517 stores a risk value calculated for the attack. Countermeasure type 1518 stores information indicating the type of target to which countermeasure 1519 is applied (hereinafter referred to as "countermeasure type"). Countermeasure 1519 stores information indicating the specific content of the countermeasure.

[0092] 16 shows an example of the countermeasure selection condition table 117. The countermeasure selection condition table 117 is a table used when the countermeasure generation unit 150 extracts countermeasures corresponding to threats extracted for the evaluation target model 112 from the countermeasure list information 116. As shown in the figure, the countermeasure selection condition table 117 is made up of a plurality of records having the items of condition ID 1611, condition 1612, countermeasure type 1613, and countermeasure 1614.

[0093] Of the above items, the condition ID 1611 stores a condition ID that is an identifier of a condition used to select a countermeasure. The condition 1612 stores the contents of the above condition (Not, And, Or). ​​The countermeasure type 1613 stores the countermeasure type corresponding to the condition. The countermeasure 1614 stores information indicating the contents of the countermeasure corresponding to the condition.

[0094] 17 shows an example of the countermeasure proposal table 118. In the countermeasure proposal table 118, countermeasures selected from the countermeasure list information 116 by the countermeasure selection condition table 117 are managed.

[0095] As shown in the figure, the countermeasure proposal table 118 is made up of a plurality of records each having the items of a countermeasure ID 1711, a countermeasure type 1712, and a countermeasure 1713.

[0096] Of the above items, the countermeasure ID 1711 stores an identifier of each countermeasure (hereinafter referred to as a "countermeasure ID") selected from the countermeasure list information 116. The countermeasure type 1712 stores information indicating the countermeasure type of the countermeasure. The countermeasure 1713 stores information indicating the content of the countermeasure.

[0097] Returning to Figure 5, the information presentation unit 160 of the center server 100 generates user-provided information 119 based on information such as the attack event map 115 and countermeasure proposal table 118 in response to a request from the user terminal 200, and transmits the generated user-provided information 119 (screen information, audio information, etc.) to the user terminal 200 (S519).

[0098] 18A to 18C show examples of screens displayed by user terminal 200 based on user-provided information 119 provided by information presenter 160. FIG.

[0099] The screen shown in FIG. 18A (hereinafter referred to as "presentation screen 1810") is configured to allow a user or customer to select countermeasures for each threat while checking the change in security level when each countermeasure is selected (the change in security level when evaluated according to the standard).

[0100] As shown in the figure, presentation screen 1810 has columns for displaying conditions for countermeasures 1811, displaying conditions for countermeasures 1812, displaying conditions 1813 for indicating whether each countermeasure in countermeasure proposal table 118 has an impact on the security level, a selection column 1814 for countermeasures, and a graph 1815 showing a change in the security level when the selected countermeasure is adopted. Note that information is displayed in descending order of the risk value of threats (descending order of risk value) in display column 1811 for countermeasure selection conditions, display column 1812 for the contents of countermeasure proposal table 118, and display column 1813 for indicating whether each countermeasure in countermeasure proposal table 118 has an impact on the security level.

[0101] Among the above columns, a countermeasure selection condition display column 1811 displays information indicating conditions when countermeasures in the countermeasure proposal table 118 are selected from the countermeasure list information 116. A countermeasure display column 1812 displays information indicating the contents of the countermeasures in the countermeasure proposal table 118. A security level influence display column 1813 displays information indicating the influence of the security level in the standard specification acquired by the information presenting unit 160 from the standard plan corresponding countermeasure DB 122 ("○" if there is an influence, and "×" if there is no influence). A countermeasure selection column 1814 displays check boxes for receiving from the user whether or not to select each countermeasure. A graph 1815 showing the change in security level displays the total value of the security level when the countermeasure selected in the countermeasure selection column 1814 is applied in a bar graph.

[0102] 19 shows an example of the standard-compliant countermeasure information 122. The standard-compliant countermeasure information 122 includes, for each countermeasure, information on the impact (whether or not the impact) of the countermeasure on the security level in the standard (for example, the security level (SL) defined in the international industrial security standard IEC 62443). Information indicating the number of times the item is used (no matter whether it is a commodity or not) is managed.

[0103] As shown in the figure, the table of standard-compliant countermeasure information 122 (hereinafter referred to as the "standard-compliant countermeasure table") has the following items: countermeasure ID 1911, countermeasure type 1912, countermeasure 1913, and security level 1914. The standard-compliant countermeasure table is provided for each type of standard.

[0104] Of the above items, a countermeasure ID is stored in countermeasure ID 1911. A countermeasure type is stored in countermeasure type 1912. Information indicating the content of the countermeasure is stored in countermeasure 1913. Information indicating whether or not the security level SL1 to SL4 is applicable is stored in security level 1914 ("○" if applicable, "×" if not applicable).

[0105] 18A, the user can easily check what countermeasures are available against high-risk threats that should be dealt with as a priority. In addition, the user can visually (intuitively) grasp the change in the effectiveness of countermeasures for each pattern by selecting countermeasures in various patterns from the countermeasure selection field 1814.

[0106] The screen shown in FIG. 18B (hereinafter referred to as "presentation screen 1820") is configured so that a user or customer can select a countermeasure against a threat while checking the effect of each countermeasure (attack extension effect).

[0107] As shown in the figure, a presentation screen 1820 includes a display field 1821 for displaying the extension effect by attack path and a display field 1822 for displaying a list of countermeasures.

[0108] The display column 1821 of the extension effect by attack path includes multiple rows having the following items: path selection column 18211, attack path name 18212, communication interface 18213, attack order 18214, total attack time before countermeasures 18215, extension effect after countermeasures are implemented 18216, target threat 18217, and risk value 18218.

[0109] Among the above items, the path selection column 18211 displays a check box for the user to select an attack path. The attack path name 18212 displays the name of the attack path. The communication IF 18213 displays the type and name of the communication interface of the attack path. The attack order 18214 displays information indicating the attack order of the assets by the attack path. The total attack time before countermeasures 18215 displays the total attack time required before countermeasures are taken. The extension effect after countermeasures are taken 18216 displays the total attack time after countermeasures are taken. The value of the extension effect after countermeasures are taken 18216 illustrated in the figure is calculated based on, for example, the effect of countermeasures 1118 of the attack event table. The target threat 18217 displays information indicating the content of the threat in the attack path. The risk value 18218 displays the risk value calculated for each threat. It should be noted that the attack paths displayed in the display field 1821 for the extension effect by attack path are displayed, for example, in descending order of the risk value 18218.

[0110] As shown in the figure, the countermeasure list display column 1822 includes multiple rows each having the following items: countermeasure ID 18221, countermeasure type 18222, countermeasure 18223, target category 18224, priority 18225, attack extension effect 18226, and implementation / non-implementation selection column 18227.

[0111] Of the above items, countermeasure ID 18221 displays a countermeasure ID. Countermeasure type 18222 displays a countermeasure type. Countermeasure 18223 displays information indicating the contents of the countermeasure. Target category 18224 displays a major category of the countermeasure. Priority 18225 displays the priority of each countermeasure within the major category. Attack extension effect 18226 displays the attack extension effect of the countermeasure. The above priority is determined in descending order of attack extension effect. Implementation presence / absence selection field 18227 displays check boxes that allow the user to select a countermeasure.

[0112] By using presentation screen 1810 shown in FIG. 18B, the user can select a measure while checking the effect of each measure when taken.

[0113] The screen shown in FIG. 18C (hereinafter referred to as "presentation screen 1830") is configured to allow a user or customer to select measures while checking the effects (hereinafter referred to as "protection-in-depth effect") of measures taken for each stage of attack (hereinafter referred to as "defense-in-depth").

[0114] As shown in the figure, a presentation screen 1830 includes a display field 1831 for the extension effect by attack path, a display field 1832 for a list of measures (by layer), and a display field 1833 for the defense-in-depth effect.

[0115] The display column 1831 of the extension effect by attack path includes multiple rows having the following items: path selection column 18311, attack path name 18312, communication interface 18313, attack order 18314, total attack time before countermeasures 18315, extension effect after countermeasures are implemented 18316, target threat 18317, and risk value 18318.

[0116] Among the above items, the path selection column 18311 displays a check box for the user to select an attack path. The attack path name 18312 displays the name of the attack path. The communication IF 18313 displays the type and name of the communication interface of the attack path. The attack order 18314 displays information indicating the attack order of the assets by the attack path. The total attack time before countermeasures 18315 displays the total attack time required before countermeasures are taken. The extension effect after countermeasures are taken 18316 displays the total attack time after countermeasures are taken. The value of the extension effect after countermeasures are taken 18316 illustrated in the figure is calculated based on the effect of countermeasures 1118 of the attack event table. The target threat 18317 displays information indicating the content of the threat in the attack path. The risk value 18318 displays the risk value calculated for each threat. The attack paths displayed in the display column 1831 of the extension effect by attack path are displayed, for example, in order of the highest value of the risk value 18318 (descending order of risk value).

[0117] The countermeasures list (by hierarchy) display field 1832 includes multiple rows each having an item such as a major category ID 18321, a major category 18322, an attack ID 18323, an attack item 18324, a communication IF type 18325, time required for an attack 18326, an attack prevention countermeasure policy 18327, an effect of the countermeasure 18328, and an implementation / non-implementation selection field 18329.

[0118] Among the above items, the major category ID 18321 stores a major category ID that is an identifier for each major category. The major category 18322 stores the name of the major category. The attack ID 18323 stores an attack ID that is an identifier for an attack in each category. The attack IDs are assigned in ascending order according to the principle of the order of attacks in the major category. The attack item 18324 stores information indicating the content of the attack. The communication IF type 18325 stores information indicating the target of the attack (mobile communication, control network, etc.), whether an attack is selected according to the target, and a link destination in the attack order. The time required for the attack 18326 stores an estimated time required for the attack. The attack prevention countermeasure policy 18327 stores information identifying the countermeasure policy for the attack (in this example, the identifier of the countermeasure policy). The effect of the countermeasure 18328 stores information indicating the effect when the countermeasure is taken. The value of the countermeasure effect 18328 illustrated in the figure is calculated based on the countermeasure effect 1118 in the attack event table. Check boxes are displayed in the implementation / non-implementation selection column 18329 to allow the user to select a countermeasure.

[0119] A display column 1833 of defense-in-depth effect displays the total effect (total time) of the measures selected by the user in the implementation / non-implementation selection column 18329 for each major category.

[0120] By using presentation screen 1810 shown in FIG. 18C, the user can select a measure while checking the effect of each major category when the measure is taken.

[0121] In the above-mentioned example presentation screens 1810 to 1830, for example, Alternatively, information on countermeasures, etc. may be displayed. For example, countermeasures may be displayed in order of lowest cost of execution. Information on attacks on modules or functions located near the entrance of external attacks may be preferentially displayed.

[0122] Returning to FIG. 5, the countermeasure receiving unit 165 of the center server 100 then receives the result of the user's selection of the countermeasure from the user terminal 200, and reflects the received content in the past analysis result information 124 (S521, S522).

[0123] 20 is an example of the past analysis result information 124. As shown in the figure, the illustrated past analysis result information 124 is made up of a plurality of records each consisting of the items of a countermeasure ID 2011, a countermeasure type 2012, a countermeasure 2013, and an implementation 2014.

[0124] Of the above items, the countermeasure ID 2011 stores a countermeasure ID. The countermeasure type 2012 stores a countermeasure type. The countermeasure 2013 stores a countermeasure. The implementation 2014 stores information indicating whether or not the user selected the countermeasure ("○" if selected, and "×" if not selected).

[0125] The contents of the past analysis result information 124 are used as reference information for checking the current status of countermeasures and for taking new countermeasures.

[0126] FIG. 21 illustrates a flow of a security consulting service between a user and a customer when selecting a countermeasure (hereinafter, referred to as a "consultant-customer sequence S2000"). This is a sequence diagram for explaining the sequence S2000 between the consultant and the customer. We will explain about this.

[0127] First, a user (consultant) requests a client to create input information (S2111), and the client returns the input information to the user (S2112).

[0128] The user inputs the input information received from the customer to the security management system 1 via the user terminal 200 (S2113), and causes the security management system 1 to generate countermeasures (S2114).

[0129] The user checks the countermeasures generated by the security management system 1 (for example, the contents of the countermeasure proposal table 118 shown in FIG. 17) via the user terminal 200 (S2115), and selects countermeasures while interacting with the customer using the screen showing the contents of the countermeasure proposal table 118 and presentation screens 1810-1830, which are provided by the security management system 1 and displayed on the user terminal 200 (S2116, S2117).

[0130] In this way, the user can efficiently formulate measures against threats anticipated in the customer's evaluation target system by using the measures and presentation screens 1810 to 1830 provided by the security management system 1. In addition, by using these screens, the user can appropriately formulate measures while responding to customer requests in a detailed manner.

[0131] <Various update processes> Next, the process of updating various pieces of information performed by the center server 100 will be described.

[0132] FIG. 22 is a flowchart illustrating an example of a process (hereinafter, referred to as "attack event information update process S2200") that the information update management unit 132 performs when updating the attack event information 123. The attack event information update process S2200 will be described below with reference to the same drawing.

[0133] When the information update management unit 132 acquires update information (difference information) of the attack event information 123 from the external server 300, the user terminal 200, etc. (S2211), it accepts input from the user of the type of communication interface that is affected by the attack in the update information (S2212).

[0134] Next, the information update management unit 132 identifies attack items for executing the purpose of the attack on the update information based on the evaluation target model 112 (S2213).

[0135] Next, the information update management unit 132 identifies paths between the attack items and generates attack order links (S2214).

[0136] Next, the information update management unit 132 generates the time required for the attack, a countermeasure policy for preventing the attack, and the countermeasure effect (S2215).

[0137] Next, the information update management unit 132 reflects the content generated by the above processing in the attack event information 123 as a new attack event.

[0138] 23 is a flowchart explaining an example of a process (hereinafter referred to as "countermeasure selection condition table update process S2300") performed by the information update management unit 132 when updating the countermeasure selection condition table 117. The countermeasure selection condition table update process S2300 is executed when a new attack event is added to the attack event information 123 by the attack event information update process S2200. The attack event information update process S2200 will be explained below with reference to the same figure.

[0139] The information update management unit 132 acquires measures for the new attack event from the countermeasures list information 116 (S2311).

[0140] Next, the information update management unit 132 generates a condition (Not, And, OR) and a countermeasure type in the countermeasure selection condition table 117 based on the new attack event and the acquired countermeasure (S2312).

[0141] Next, the information update management unit 132 judges whether or not the combination of the generated condition (Not, And, OR) and the countermeasure type already exists in the countermeasure selection condition table 117 (S2314). If it does not exist (S2313: NO), the combination of the generated condition (Not, And, OR) and the countermeasure type is added to the countermeasure selection condition table 117. If it exists (S2313: YES), the countermeasure selection condition table update process S2300 ends.

[0142] 24 is a flowchart explaining an example of a process (hereinafter referred to as "standards compliance countermeasure information update process S2400") performed by the information update management unit 132 when updating the standard compliance countermeasure information 122. As shown in the figure, when the information update management unit 132 acquires a new standard compliance countermeasure (S2411), it reflects the acquired standard compliance countermeasure in the information update management unit 132 (S2412).

[0143] As described above in detail, the security management system 1 of this embodiment extracts anticipated attacks against the assets of the evaluation target model 112 from the attack event information 123, extracts countermeasures for each of the extracted attacks from the countermeasure list information 116, and generates a screen showing information that corresponds the extracted attacks with the extracted countermeasures and presents it to the user. Therefore, the user can obtain information about anticipated threats and countermeasures for the evaluation target model 112 by inputting information about the evaluation target model 112.

[0144] The user may also display the above information in order of risk value (e.g., descending order of risk value). Therefore, the priority of countermeasures can be appropriately determined taking into consideration the necessity of the countermeasures. Furthermore, since threats and countermeasures are displayed on the screen in association with each other, the user can plan all countermeasures without missing anything.

[0145] In addition, since the user can easily grasp effective countermeasures against multiple threats, the user can plan countermeasures efficiently and at a reduced cost. In addition, the user can perform consulting work while explaining the relationship between threats and countermeasures to the customer.

[0146] Furthermore, since users can simulate the effects of measures simply by selecting whether or not to implement them, it is possible to show customers a wide variety of measures, enabling efficient planning of security measures that will satisfy customers.

[0147] Although the embodiments have been described above, the present invention is not limited to the above-described embodiments, and includes various modified examples, and is not necessarily limited to those having all of the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration. [Explanation of symbols]

[0148] 1 security management system, 51 first communication network, 52 second communication network, 100 center server, 200 user terminal, 300 external server, 110 memory unit, 111 various input information, 1101 module / asset list, 1102 evaluation target information, 1103 link list, 1104 life cycle / participant definition, 1105 What template, 1106 attack module number, 112 evaluation target model, 113 threat list information, 114 attack path model, 115 attack event map, 116 countermeasure list information, 117 countermeasure selection condition table, 118 countermeasure proposal table, 119 user-provided information, 120 various reference information, 1211 impact classification table, 1212 attack ease classification table, 122 standard compliance countermeasure information, 123 attack event information, 124 past analysis result information, 130 information acquisition management unit, 132 Information update management unit, 134 evaluation target model generation unit, 140 threat list generation unit, 142 risk assessment unit, 145 attack path model generation unit, 150 countermeasure generation unit, 160 information presentation unit, 165 countermeasure reception unit, S1500 countermeasure planning process, 1810 to 1830 presentation screen

Claims

1. A security management system configured using an information processing device having a processor and a memory, Attack event information including information regarding attacks on each of the assets constituting the information processing system; A countermeasure list including information regarding countermeasures against the attack; an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures; Remember, extracting from the attack event information an attack anticipated against the asset of the evaluation target model; Extracting countermeasures against each of the extracted attacks from the countermeasure list information; outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other; providing a function on the screen for allowing a user to select one or more of the extracted measures; calculating an index showing an attack extension effect obtained by each of the countermeasures selected by the user; information based on the obtained index is displayed on the screen; Security management systems.

2. A security management system configured using an information processing device having a processor and a memory, Attack event information including information regarding attacks on each of the assets constituting the information processing system; A countermeasure list including information regarding countermeasures against the attack; an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures; Remember, extracting from the attack event information an attack anticipated against the asset of the evaluation target model; Extracting countermeasures against each of the extracted attacks from the countermeasure list information; outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other; providing a function on the screen that allows a user to select one or more of the extracted measures; calculating an index showing the effectiveness of security measures obtained by each of the measures selected by the user; Entering information based on the obtained index on the screen; displaying on said screen information showing the effect of security measures obtained by each of said measures selected by the user for each stage of attack; Security management systems.

3. 3. The security management system according to claim 1, the information showing the extracted attacks and the extracted countermeasures in association with each other is displayed on the screen in descending order of the risk value evaluated for each of the extracted attacks; Security management systems.

4. 4. The security management system according to claim 3, storing information on vulnerability of the evaluation target model based on evaluation criteria in the Common Vulnerability Scoring System (CVSS); determining the risk value based on the information; Security management systems.

5. 5. The security management system according to claim 4, The evaluation criteria are at least one of the following: attack vector (AV), attack condition complexity (AC), authentication requirement before the attack (AU), confidentiality impact (C), integrity impact (I), and availability impact (AI); Security management systems.

6. 3. The security management system according to claim 1, The indicator is a security level based on a standard in an industrial control system. Security management systems.

7. 7. The security management system according to claim 6, displaying on the screen a graph showing an integrated value of the security levels for each of the measures selected by the user; Security management systems.

8. 7. The security management system according to claim 6, A communication connection is established with another information processing device that provides a security level based on the standard, obtaining latest information on the security level based on the standard from the other information processing device as needed and using the information in calculating the index; Security management systems.

9. 3. The security management system according to claim 1, At least one of the countermeasures is effective against a plurality of the attacks. Security management systems.

10. 3. The security management system according to claim 1, A communication connection is established with another information processing device that provides the attack event information, acquiring latest information of the attack event information from the other information processing device as needed and updating the stored attack event information; Security management systems.

11. 3. The security management system according to claim 1, a communication connection with another information processing device that provides conditions for extracting countermeasures against each of the extracted attacks from the countermeasure list information; obtaining the latest information on the conditions from the other information processing devices as needed and using the information to extract the countermeasures; Security management systems.

12. An information processing device having a processor and a memory, Attack event information including information regarding attacks on each of the assets constituting the information processing system; A countermeasure list including information regarding countermeasures against the attack; an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures; storing the Extracting, from the attack event information, attacks assumed against the assets of the evaluation target model; extracting countermeasures against each of the extracted attacks from the countermeasure list information; outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other; providing a function on the screen that allows a user to select one or more of the extracted measures; determining an index indicating an attack extension effect obtained by each of the countermeasures selected by a user; And, a step of displaying information based on the obtained index on the screen; A security management methodology.

13. An information processing device having a processor and a memory, Attack event information including information regarding attacks on each of the assets constituting the information processing system; A countermeasure list including information regarding countermeasures against the attack; an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures; storing the Extracting, from the attack event information, attacks assumed against the assets of the evaluation target model; extracting countermeasures against each of the extracted attacks from the countermeasure list information; outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other; providing a function on the screen that allows a user to select one or more of the extracted measures; determining an index showing the effectiveness of security measures obtained by each of the measures selected by the user; a step of displaying information based on the obtained index on the screen; And, a step of displaying on said screen information showing the effect of security measures obtained by each of said measures selected by a user for each stage of an attack; A security management methodology.

14. 14. A security management method according to claim 12 or 13, comprising: a step of displaying, on the screen, the information indicating the extracted attacks and the extracted countermeasures in association with each other, in descending order of risk values ​​evaluated for each of the extracted attacks, by the information processing device; The security management method further comprises:

Images