Security measures planning system, security measures planning method, and program

Abstract

Provided is a security countermeasure planning system which contributes to selection of a countermeasure on the basis of a change in time of a security risk inherent in a system. The security countermeasure planning system comprises: a functioning unit which calculates risk values of one or more assets included in a system to be diagnosed; a risk change estimation unit which estimates future risk estimation values of the risk values of the assets calculated by the functioning unit; and a countermeasure determination unit which selects the countermeasure on the basis of the future risk estimation values estimated by the risk change estimation unit.

Description

[Technical field]

[0001] The present invention relates to a security countermeasure planning system, a security countermeasure planning method, and a program. [Background technology]

[0002] In risk analysis of the system to be diagnosed, an attack graph is extracted based on various configuration information at the time of analysis, including information on the attack methods and conditions from the entry point to the target of attack, and the hosts via which the attack is made. In planning countermeasures against attacks, risk is reduced by introducing countermeasures that prevent the attack methods and conditions included in the attack route from being established.

[0003] Patent Document 1 relates to a method for planning and designing a security system for creating a PP (Protection Profile) / ST (Security Target) as stipulated in the international standard (Common Criteria).

[0004] Patent Document 2 relates to an information security management support system that supports effective information security management.

[0005] Patent Document 3 relates to a security monitoring device that enables recognition of security and risk conditions and the taking of measures.

[0006] Patent Document 4 relates to a risk management device that supports the planning and implementation of risk countermeasures that are consistent across the entire business process.

[0007] Patent Document 5 relates to a security risk analysis support device capable of presenting an objective index to a user in risk evaluation. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] JP 2000-132767 A [Patent Document 2] JP 2005-293267 A [Patent Document 3] JP 2007-316821 A [Patent Document 4] JP 2010-176274 A [Patent Document 5] International Publication No. 2021 / 059471 Summary of the Invention [Problem to be solved by the invention]

[0009] The following analysis is provided by the present invention.

[0010] However, the effectiveness of measures and the risk of threats inherent in the system change over time due to changes in the effectiveness of measures, such as whether the measures can be implemented immediately or take time to be implemented, whether the measures are permanent or temporary, and changes in threats over time, such as the emergence of attack code and changes in the configuration of the system to be diagnosed. Therefore, if a countermeasure proposal is formulated by considering only the risks at the time of risk analysis of the system to be diagnosed, the countermeasure will often not be effective.

[0011] An object of the present invention is to provide a security countermeasure planning system, a security countermeasure planning method, and a program that contribute to selecting countermeasures based on changes over time in security risks inherent in a system. [Means for solving the problem]

[0012] According to a first aspect of the present invention, there is provided a diagnostic system comprising: a functional unit for calculating a risk value of one or more assets included in a system to be diagnosed; a risk change estimation unit that estimates a future risk estimate value of the risk value of the asset calculated by the functional unit; It is possible to provide a security countermeasure planning system including a countermeasure decision unit that selects a countermeasure plan based on the future risk estimated value estimated by the risk change estimation unit.

[0013] According to a second aspect of the present invention, there is provided a method for evaluating a system to be diagnosed, comprising the steps of: calculating a risk value of one or more assets included in a system to be diagnosed; a risk change estimation step of estimating a future risk estimate of the calculated risk value of the asset; A security countermeasure planning method can be provided, which includes a countermeasure decision step of selecting a countermeasure based on the estimated future risk value.

[0014] According to a third aspect of the present invention, a computer is provided with: A process of calculating a risk value of one or more assets included in the system to be diagnosed; a risk change estimation process for estimating future risk estimates of the calculated asset risk values; It is possible to provide a program for executing a countermeasure decision process for selecting a countermeasure plan based on the estimated future risk value. The program can be recorded in a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. Effect of the Invention

[0015] According to the present invention, it is possible to provide a security countermeasure planning system, a security countermeasure planning method, and a program that contribute to selecting countermeasures based on the time-dependent change in security risks inherent in a system. [Brief description of the drawings]

[0016] [Figure 1] 1 is a diagram illustrating an example of a configuration of a security countermeasure planning system according to an embodiment of the present invention. [Diagram 2]FIG. 2 is a diagram illustrating an example of a concept of the operation of the security countermeasure planning system according to one embodiment of the present invention. [Diagram 3] 1 is a diagram showing an outline of an example of the operation of a security countermeasure planning system according to an embodiment of the present invention; [Figure 4] 1 is a diagram showing an outline of an example of the operation of a security countermeasure planning system according to an embodiment of the present invention; [Diagram 5] FIG. 1 illustrates an example of a configuration of a security countermeasure planning system according to a first exemplary embodiment of the present invention. [Figure 6] 2 is a diagram illustrating an example of a configuration of a risk analysis unit of the security countermeasure planning system according to the first exemplary embodiment of the present invention. FIG. [Figure 7] 2 is a diagram showing an example of information stored in a future risk estimation information unit of the security countermeasure planning system according to the first embodiment of the present invention. FIG. [Figure 8] 2 is a diagram showing an example of information stored in a future risk estimation information unit of the security countermeasure planning system according to the first embodiment of the present invention. FIG. [Figure 9] 3 is a diagram illustrating an example of stored information in a countermeasure candidate information unit of the security countermeasure planning system according to the first embodiment of the present invention. FIG. [Figure 10] FIG. 2 is a diagram illustrating an example of a schematic configuration of a risk change estimation unit of the security countermeasure planning system according to the first exemplary embodiment of the present invention. [Figure 11] FIG. 2 is a diagram illustrating an example of a schematic configuration of a countermeasure decision unit of the security countermeasure planning system according to the first exemplary embodiment of the present invention. [Figure 12] FIG. 2 is a diagram illustrating an overview of an example of the operation of a countermeasure decision unit of the security countermeasure planning system according to the first exemplary embodiment of the present invention. [Figure 13] FIG. 4 is a diagram illustrating an example of an output from a countermeasure decision unit of the security countermeasure planning system according to the first exemplary embodiment of the present invention. [Figure 14] FIG. 11 is a diagram illustrating an example of a configuration of a security countermeasure planning system according to a second exemplary embodiment of the present invention. [Figure 15] FIG. 13 is a diagram illustrating an example of a configuration of a security countermeasure planning system according to a third exemplary embodiment of the present invention. [Figure 16] FIG. 13 is a diagram illustrating an example of a configuration of a diagnosis timing determining unit of a security countermeasure planning system according to a third exemplary embodiment of the present invention. [Figure 17] FIG. 11 is a diagram illustrating an example of an operation of the security countermeasure planning system according to the third exemplary embodiment of the present invention. [Figure 18] FIG. 13 is a diagram illustrating an example of a configuration of a security countermeasure planning system according to a fourth exemplary embodiment of the present invention. [Figure 19] FIG. 13 is a diagram illustrating an example of a configuration of an alert information generating unit of a security countermeasure planning system according to a fourth exemplary embodiment of the present invention. [Figure 20] FIG. 13 is a diagram illustrating an example of the operation of the security countermeasure planning system according to the fourth exemplary embodiment of the present invention. [Figure 21] FIG. 1 is a diagram showing a configuration of a computer that constitutes a security countermeasure planning system according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] First, an overview of one embodiment of the present invention will be described with reference to the drawings. Note that the reference numerals in the drawings attached to this overview are attached to each element for convenience as an example to aid in understanding, and are not intended to limit the present invention to the illustrated form. Furthermore, the connection lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional lines. The unidirectional arrows are intended to diagrammatically indicate the flow of the main signal (data), and do not exclude bidirectionality.

[0018] FIG. 1 is a diagram showing an example of the configuration of a security countermeasure planning system according to one embodiment of the present invention. Security risk can be calculated from three elements: business damage level, threat level, and vulnerability level. For example, these three elements can be quantified and a security risk value can be determined based on the product of the quantified values. The business damage level refers to the degree of damage that will occur when a threat occurs, the threat level refers to the possibility that a threat will occur, and the vulnerability level refers to the possibility that a threat will be accepted. The security countermeasure planning system according to one embodiment of the present invention shown below can estimate changes in the business damage level, threat level, and vulnerability level, and contribute to selecting appropriate countermeasures.

[0019] Referring to FIG. 1, a security countermeasure planning system 100 according to one embodiment of the present invention includes a risk analysis unit 110, a risk change estimation unit 120, and a countermeasure decision unit 130, and receives configuration information 101 of a system to be diagnosed, selects and outputs a security countermeasure plan 102.

[0020] 2 is a diagram showing an example of the concept of the operation of the security countermeasure planning system 100 according to one embodiment of the present invention. Information collection 220 is performed from a system 210 to be diagnosed for security countermeasure planning, configuration information 101 of the system to be diagnosed is acquired, and risk analysis 240 is performed on the acquired configuration information 101 by an inference engine 230 to extract an attack route and a risk value 250. Risk change estimation and countermeasure decision are performed for the attack route and risk value 250, and countermeasure proposal 102 is selected and output.

[0021] Figures 3 and 4 are diagrams showing an outline of an example of the operation of the security countermeasure planning system 100 according to one embodiment of the present invention. The operation of the security countermeasure planning system 100 according to one embodiment of the present invention shown in Figure 1 will be described with reference to Figures 3 and 4. The attacker's attack route and the risk value 250 of the attack route in Figure 3 are assumed to continue to the implementable countermeasure 320 in Figure 4. In Figures 3 and 4, the same reference symbols as those used in Figure 2 indicate the same components.

[0022] 3 is a diagram showing an example of the configuration of the diagnosis target system 210, an example of an image of the corresponding attack graph 310, and an extracted attack route and risk value. In the diagnosis target system 210 of the example in FIG. 3, personal computers PC1, PC2, and PC3 are connected via a network 303, and personal computer PC4, server 1, and server 2 are connected via a network 308, and the network 303 and the network 308 are connected via a firewall FW. In FIG. 3, the configuration allows access from PC1, PC2, and PC3 to server 1, PC4, and server 2.

[0023] The configuration information 101 extracted from the diagnosis target system 210 in Fig. 3 is input to the risk analysis unit 110 in Fig. 1. The risk analysis unit 110 performs a risk analysis to extract an attack route of an attacker and a risk value 250 of the attack route from the configuration information 101 of the diagnosis target system 210. In the risk analysis, the risk analysis unit 110 uses the configuration information 101 of the target system to extract an attack graph 310, and extracts an attack route of an attacker and a risk value 250 of the attack route based on the attack graph 310. The extracted attack route and risk value 250 may include multiple attack routes (attack routes 1, 2, 3, etc.) and risk values ​​corresponding to each attack route (risk values ​​B, B, A, etc.).

[0024] Here, the attack graph 310 is extracted by analyzing the configuration information 101 of the system to be diagnosed 210, and the attack source and destination nodes PC1, PC2, PC3, PC4, Server1, and Server2 of the attack graph 310 correspond to the hosts PC1, PC2, PC3, PC4, Server1, and Server2 in the system to be diagnosed 210. The attack routes in the attack routes and risk values ​​250 are attack routes that connect attack steps (edges) from the attack graph 310, and each attack route on the attack graph from the entry point to the attack target is shown by sequentially listing the nodes. Also, the risk values ​​(Risk B, Risk A, etc.) in the attack routes and risk values ​​250 indicate the risk values ​​of each attack route.

[0025] Here, an attack graph is a chart or diagram showing the flow (attack route) of possible combinations of attack steps. Each stage leading to another state (node) by an attack method is called an attack step, and an attack route is a connection of each attack step (edges showing attack methods).

[0026] Next, the risk change estimation unit 120 of FIG. 1 estimates a risk time series change, which is a future risk estimation value of the risk value of the attack route extracted by the risk analysis unit 110. In this embodiment, as an example, a change in vulnerability level is estimated to estimate a risk time series change. In estimating a risk time series change by estimating a change in vulnerability level, the risk change estimation unit 120 extracts an implementable measure 320 as illustrated in FIG. 4. The contents of the measure include, for example, updating the operating system (OS) in the personal computer PC2 (measure plan 1), introducing an intrusion prevention system (IPS) in the server room network (NW) (measure plan 2), introducing antivirus software in the server 1 (measure plan 3), introducing antivirus software in the server 2 (measure plan 4), and the like, as illustrated in FIG. 4.

[0027] Next, the risk change estimation unit 120 in Fig. 1 calculates risk time series changes 330, 335, which are estimated values ​​of future risks when each countermeasure plan is applied to each attack route. For example, as illustrated in Fig. 4, when countermeasure plan 1 is applied, the risk time series changes are estimated (330) such that the risk value of attack route 1 becomes E after one week, D after one month, and C after six months. Also, when countermeasure plan 2 is applied, the risk time series changes are estimated (335) such that the risk value of attack route 1 becomes C after one week, C after one month, and C after six months. The same applies to attack routes 2 and 3.

[0028] Next, the countermeasure decision unit 130 in Fig. 1 selects and outputs countermeasure proposal 102 according to the risk time-series changes 330, 335 estimated by the risk change estimation unit 120. For example, as illustrated in Fig. 4, in accordance with policy 340 of minimizing the average risk after two months, countermeasure proposal 2, which is to introduce an IPS into the server room NW, is selected as the final countermeasure proposal 102 and output.

[0029] As described above, according to one embodiment of the present invention, it is possible to provide a security countermeasure planning system that contributes to selecting countermeasures based on the time-dependent change in security risks inherent in a system.

[0030] [First embodiment] Next, the configuration of the security countermeasures planning system according to the first embodiment of the present invention will be described with reference to the drawings. Fig. 5 is a diagram showing an example of the configuration of the security countermeasures planning system 100 according to the first embodiment of the present invention.

[0031] 5, a security countermeasure planning system 100 according to the first embodiment of the present invention includes a risk analysis unit 110, a risk change estimation unit 120, a countermeasure decision unit 130, a future risk estimation information unit 140, and a countermeasure candidate information unit 150. Configuration information 101 of a system to be diagnosed is input to the risk analysis unit 110, and the countermeasure decision unit 130 selects and outputs a countermeasure proposal 102 based on a countermeasure policy (policy information) 106.

[0032] Fig. 6 is a diagram showing an example of the configuration of the risk analysis unit 110 of the security countermeasure planning system 100 according to the first embodiment of the present invention. Referring to Fig. 6, the risk analysis unit 110 includes a vulnerability information database (DB) 111, an analysis rule storage unit 112, an inference unit 113, an attack graph information output unit 114, an attack route extraction unit 115, and a risk calculation unit 116. The risk analysis unit 110 performs risk analysis to extract attack routes 1, 2, and 3 and the risk value of each attack route, as shown in Fig. 3, from the configuration information 101 of the system to be diagnosed.

[0033] The inference unit 113 infers what kind of attack is possible from which host to which host based on the collected configuration information 101 of the diagnosis target system 210 illustrated in FIG. 3. The configuration information 101 includes host information included in the diagnosis target system 210, network configuration, operating systems (OS) and software installed on each host, vulnerability information of each OS and software, data flow information, and the like. The vulnerability information DB 111 stores attack conditions for each vulnerability and attack results, and the like. The analysis rule storage unit 112 stores analysis rules that describe information on what kind of attack can be performed under what conditions. The attack graph information output unit 114 connects the above information to output an attack graph, such as the attack graph 310 illustrated in FIG. 3. Next, the attack route extraction unit 115 extracts attack routes included in the attack graph, such as the attack routes illustrated in FIG. 3 and attack routes 1, 2, and 3 in the risk value 250, based on the attack graph. Furthermore, the risk calculation unit 116 calculates a risk value for each extracted attack route, such as the risk values ​​(Risk B, Risk B, Risk A) in the attack route and risk value 250 illustrated in Fig. 3. As described above, the risk analysis unit 110 performs risk analysis from the configuration information 101 of the system to be diagnosed, and extracts the attack routes and the risk value of each attack route.

[0034] As an example of calculating the risk value of an attack route, the minimum risk value of the attack steps included in the attack route can be set as the risk value of the attack route. As an example of calculating the risk value of an attack step, a risk value can be determined for each attack means used in the attack step and each vulnerability used in the attack. Furthermore, a table of risk values ​​can be prepared for each attack means to calculate the risk value. Also, the risk value can be determined using the CVSS (Common Vulnerability Scoring System) score of the vulnerability.

[0035] The risk change estimation unit 120 of the security countermeasure planning system of the first embodiment of the present invention shown in Figure 5 uses information stored in the future risk estimation information unit 140 and the countermeasure candidate information unit 150 to estimate risk time-series changes, which are future risk estimates.

[0036] First, the information stored in the future risk estimation information section 140 and the countermeasure candidate information section 150 will be described.

[0037] 7 and 8 are diagrams showing an example of information stored in the future risk estimation information unit 140 of the security countermeasure planning system 100 according to the first embodiment of the present invention.

[0038] The future risk estimation information unit 140 stores external factors including a configuration change history 141 of the system to be diagnosed, an asset type 142 of the host, an asset aggregation state 143 of the system to be diagnosed at the time of risk analysis, an asset operation rule (operation information) 144 of the system to be diagnosed, and an attack code appearance probability 145 and a threat prediction 146 as illustrated in FIG. 8, as illustrated in FIG. 7. The future risk estimation information unit 140 may manually input the necessary information as illustrated above in advance. The asset aggregation state 143 may be set by the risk analysis unit 110. The attack code appearance probability 145 and the threat prediction 146 may also be collected from the Web. Furthermore, the configuration change history 141 may be created based on configuration information used in past risk analyses.

[0039] 9 is a diagram showing an example of information stored in the countermeasure candidate information unit 150 of the security countermeasure planning system 100 according to the first embodiment of the present invention. The countermeasure candidate information unit 150 stores countermeasure types 151, countermeasureable attack means (countermeasure targets) 152, countermeasure costs 153, countermeasure introduction time (time period until the countermeasure can be introduced) 154, and information 156 related to timing including fluctuation information 155 of the effect of the countermeasure.

[0040] 10 is a diagram showing an example of a schematic configuration of the risk change estimation unit 120 of the security countermeasure planning system 100 according to the first embodiment of the present invention. Referring to FIG. 10, the risk change estimation unit 120 includes a countermeasure extraction unit 121 and a risk time-series change estimation unit 122.

[0041] The risk change estimation unit 120 illustrated in Fig. 10 determines a future risk estimation value for the attack route and the risk value 104 of each attack route output by the risk analysis unit 110, based on an estimated value of future changes in at least one of the business damage level, threat level, and vulnerability level. That is, for each attack route, it estimates how the risk value of each attack route will change in the future based on at least one of the estimated values ​​of future changes in the business damage level, threat level, and vulnerability level. The estimated values ​​of future changes in the business damage level, threat level, and vulnerability level are estimated as follows.

[0042] [1. Estimation of changes in threat levels] The risk time-series change estimation unit 122 estimates the change in the threat level based on the risk value 104 of the attack route at the time of risk analysis output by the risk analysis unit 110, as follows, based on at least one piece of information such as the configuration change history 141 of the diagnosed system stored in the future risk estimation information unit 140, the asset type 142 of the host, the aggregated asset state 143 of the diagnosed system at the time of risk analysis, the operation rules (operation information) 144 of the assets of the diagnosed system, and external factors including the probability of appearance of attack code 145 and threat prediction 146.

[0043] (1-1) In the configuration change history 141 of the system to be diagnosed, (1-1a) If new software is frequently installed, it is estimated that there is a change in the threat level, that is, there is a possibility that vulnerable software will be installed in the future. For example, if software has been installed a predetermined number of times or more within a predetermined period in the configuration change history, it can be determined that new software is being installed frequently.

[0044] (1-1b) If firewall (FW) policies are frequently changed, it is estimated that there is a change in the threat level, which may lead to remote attacks in the future. For example, if the configuration change history shows that FW policies have been changed more than a predetermined number of times within a predetermined period, it can be determined that FW policies are being changed frequently.

[0045] (1-2) Host asset type 142 In the case of operational technology (OT) equipment, the change in threat level is expected to increase as the equipment cannot be updated.

[0046] (1-3) Aggregation of assets of the system to be diagnosed during risk analysis 143 When conducting risk analysis, assets with the same configuration may be consolidated onto a single machine for analysis. In such cases, if many hosts are consolidated, it is estimated that the threat level will change, as the risk is likely to increase if only one of them is attacked.

[0047] (1-4) Operational rules for assets of the system to be diagnosed (operational information) 144 When a server is discarded N years after purchase, a change in the threat level is estimated, which means that the risk of the host being attacked in the future will disappear.

[0048] (1-5) Probability of external attack code appearing: 145 After a vulnerability is found in a piece of software, the probability that attack code will be discovered is predicted based on past statistical information, and the threat level is estimated.

[0049] (1-6) Prediction of external threats 146 For popular attack methods, the immediate risk is increased. For example, during an event, the organizers and systems in the same area are more likely to be targeted, so the threat level is estimated to be high.

[0050] In addition, a table that converts each of the above information (1-1) to (1-6) into a specific numerical value may be used to calculate an estimate of future changes in the threat level for the risk value 104 of the attack route at the time of risk analysis output by the risk analysis unit 110.

[0051] [2. Estimation of changes in vulnerability levels] The countermeasure extraction unit 121 of the risk change estimation unit 120 extracts countermeasure locations to which the countermeasures can be applied, based on the countermeasureable attack means (countermeasure target) 152 and countermeasure type 151 stored in the countermeasure candidate information unit 150, for the attack route 103 output by the risk analysis unit 110. Next, for each pair of countermeasure and countermeasure location, the countermeasure extraction unit 121 calculates the future vulnerability level when the countermeasure is introduced, based on the countermeasure type 151, countermeasure introduction possible time 154, and countermeasure effect variation information 155 of each countermeasure. The countermeasure extraction unit 121 estimates the vulnerability level based on at least one of the countermeasure type 151, countermeasure introduction possible time 154, and countermeasure effect variation information 155 as follows.

[0052] (2-1) Countermeasure type Depending on the type of measure 151, whether it is temporary or permanent is determined, and the change in the vulnerability level is estimated differently.

[0053] (2-2) Time until measures can be introduced (Time until measures can be introduced 154) The change in vulnerability level is estimated differently depending on whether the implementation is possible immediately, whether it takes time until the product is purchased, whether it is necessary to wait until the next time a configuration change is made, whether it is necessary to wait until the budget is secured, etc.

[0054] (2-3) Operational rules for countermeasure type 151 For example, if software (SW) or operating system (OS) updates are performed every N months, it is estimated that the probability of an attack exploiting a vulnerability being carried out every N months decreases.

[0055] (2-4) Time until the countermeasures take effect (information on fluctuations in the effectiveness of countermeasures 155) When learning a whitelist, if the learning process takes a long time, it will take a long time for the countermeasures to take effect, and it is estimated that the vulnerability level will not improve during that time.

[0056] [3. Estimation of changes in business damage levels] Changes in the business damage level are estimated using information on the business damage level that was entered in advance. For example, if the impact of a system outage would be large during the busy period from month X to month Y, the vulnerability level is estimated to be high.

[0057] In the risk change estimation unit 120, as described above, the countermeasure extraction unit 121 estimates and outputs an estimated value of a time change in the vulnerability level when each countermeasure plan stored in the countermeasure candidate information unit 150 is applied to the attack route 103 output by the risk analysis unit 110, and the risk time series change estimation unit 122 estimates an estimated value of a change in the threat level based on the information stored in the future risk estimation information unit 140. Then, the risk time series change estimation unit 122 multiplies the risk value 104 of the attack route at the time of risk analysis output by the risk analysis unit 110 by the estimated value of the time change in the vulnerability level estimated by the countermeasure extraction unit 121 and the estimated value of the change in the threat level estimated by the risk time series change estimation unit 122, and outputs a risk time series change 105 that is a future risk estimate. In addition, the risk time series change 105 may be estimated by further multiplying it by an estimated value of a change in the business damage level input in advance. In addition, a risk time series change 105, which is a future risk estimate, may be estimated based on at least one of an estimated value of a time change in vulnerability level, an estimated value of a change in threat level, and an estimated value of a change in business damage level.

[0058] 11 is a diagram showing an example of a schematic configuration of the countermeasure decision unit 130 of the security countermeasure planning system 100 according to the first embodiment of the present invention. Referring to FIG. 11, the countermeasure decision unit 130 includes a countermeasure effect verification unit 131 and a combined countermeasure plan configuration unit 132.

[0059] The countermeasure decision unit 130 shown in FIG. 11 verifies in a countermeasure effect verification unit 131 whether each countermeasure plan satisfies a given countermeasure policy 106 by referring to the cost of each countermeasure stored in the countermeasure candidate information unit 150, based on a risk time-series change 105 which is an estimated future risk value for an attack route for each countermeasure plan estimated by the risk change estimation unit 120.

[0060] An example of the countermeasure policy 106 input to the countermeasure effectiveness verification section 131 of the countermeasure decision section 130 is as follows. (1) Reduce risk to below α within A weeks with countermeasures costing less than XX. (2) The cost of the measures must be less than YY and the risk value must be less than β for as long as possible. (3) Minimize the risk between month B and month C by implementing measures at a cost less than ZZ.

[0061] When a countermeasure that satisfies the countermeasure policy 106 is found, the countermeasure effectiveness verification unit 131 selects it as the countermeasure 102 and outputs it.

[0062] On the other hand, if no countermeasures that satisfy the countermeasures policy 106 are found, the countermeasures combination configuration unit 132 combines the countermeasures to configure a new countermeasure, and the countermeasures effect verification unit 131 again verifies whether the new countermeasure satisfies the given countermeasures policy 106. For example, a simple method can configure all combinations of countermeasures. It is also possible to gradually increase the number of countermeasures to be combined, for example, a combination of two countermeasures the first time and a combination of three countermeasures the second time.

[0063] FIG. 12 is a diagram showing an example of the operation of the countermeasure decision unit 130 of the security countermeasure planning system 100 according to the first embodiment of the present invention. As a simple method, the countermeasure combination configuration unit 132 of the countermeasure decision unit 130 can search for a combination of attack routes that have been taken measures and that satisfies the countermeasure policy in a brute force manner. That is, as shown in the left side of FIG. 12 (1201, 1202), countermeasure 1 or countermeasure 2 that satisfies the countermeasure policy 106 to which the countermeasure is applied can be selected and output. Note that, among the example risks shown in FIG. 12, A is the highest, and the order of risk is A>B>C>D>E. Also, as shown in the right side of FIG. 12 (1203), a combination of countermeasure 1 and countermeasure 2 that satisfies the countermeasure policy 106 to which the countermeasure is applied can be selected and output. In the case of countermeasures combined in this way, the estimated risk value can be the minimum value among the estimated risks, as shown in the shaded area shown in the right side of FIG. 12 (1203). Alternatively, measures can be selected and output for each cost, such as measures that satisfy the policy at a cost of XX or less, and measures that satisfy the policy at a cost of YY or less.

[0064] Fig. 13 is a diagram showing output examples (output example 1 and output example 2) of the countermeasure decision unit 130 of the security countermeasure planning system 100 according to the first embodiment of the present invention. As illustrated in Fig. 13, in addition to outputting countermeasure proposals, the output can include an estimated value of the time-series risk of the attack route. Output example 1 of Fig. 13 is a graph 1300 showing the change over time of the average risk value of each attack route when no countermeasure 1301, countermeasure proposal X 1302, and countermeasure proposal Y 1303 are applied, and output example 2 is an output in table format 1310 of the change over time of the risk value of each attack route when no countermeasure 1301, countermeasure proposal X 1302, and countermeasure proposal Y 1303 are applied.

[0065] As described above, the first embodiment of the present invention can provide a security countermeasure planning system that contributes to selecting countermeasures based on the time-dependent change in security risks inherent in a system.

[0066] [Second embodiment] Next, a security countermeasure planning system 1400 according to a second embodiment of the present invention will be described with reference to the drawings. Fig. 14 is a diagram showing an example of the configuration of the security countermeasure planning system 1400 according to the second embodiment of the present invention. In Fig. 14, components with the same reference numerals as those in Fig. 5 are assumed to be the same components, and their description will be omitted.

[0067] A security countermeasure planning system 1400 according to the second embodiment of the present invention shown in FIG. 14 is configured such that in addition to the countermeasure policy 106, cost and budget information 170 is also input to the countermeasure decision unit 130 of the security countermeasure planning system 100 according to the first embodiment of the present invention shown in FIG. 5, and the countermeasure decision unit 130 determines the final countermeasure proposal 102 according to the risk time-series change, which is the future risk estimate value estimated by the risk change estimation unit 120, the input countermeasure policy 106, and the cost and budget information 170.

[0068] The cost of each countermeasure stored in the countermeasure candidate information section 150 changes over time, such as changes in product prices (long-term discounts, etc.) and changes in labor costs, which can be implemented at low cost at the timing of regular maintenance. Meanwhile, the budget for each fiscal year also changes over time. Therefore, the countermeasure decision section 130 changes the cost of each countermeasure stored in the countermeasure candidate information section 150 and referenced by the countermeasure decision section 130 according to the cost information in the input cost / budget information 170, and also changes the countermeasure policy 106 according to the budget information in the input cost / budget information 170, thereby making it possible to determine the countermeasure proposal 102 based on the change over time in the countermeasure cost / budget.

[0069] [Third embodiment] Next, a security countermeasure planning system according to a third embodiment of the present invention will be described with reference to the drawings. Fig. 15 is a diagram showing an example of the configuration of a security countermeasure planning system 1500 according to the third embodiment of the present invention. In Fig. 15, components with the same reference numerals as those in Fig. 5 are assumed to be the same components, and their description will be omitted.

[0070] A security countermeasure planning system 1500 of the third embodiment of the present invention shown in FIG. 15 has a configuration in which an assessment timing decision unit 180 is further added to the output of the countermeasure decision unit 130 of the security countermeasure planning system 100 of the first embodiment of the present invention shown in FIG. 5.

[0071] 16 is a diagram showing an example of the configuration of the diagnosis timing determining unit 180 of the security countermeasure planning system 1500 according to the third embodiment of the present invention. The diagnosis timing determining unit 180 has a function of proposing the next diagnosis timing when the countermeasure proposal 102 selected and output by the countermeasure determining unit 130 is adopted. Referring to FIG. 16, the diagnosis timing determining unit 180 includes a risk change calculation unit 181 and a next diagnosis timing determining unit 182.

[0072] The risk change calculation unit 181 of the assessment timing decision unit 180 calculates the change in risk value when the countermeasure proposal 102 is used. For example, the average of the risk values ​​of the attack routes at each time point can be calculated as the change in risk value. Also, the change in risk value can be the change in risk value of a specific representative attack route.

[0073] The next diagnosis time determination unit 182 outputs the time when the changed risk value calculated by the risk change calculation unit 181 becomes equal to or greater than a predetermined threshold as the next diagnosis time 108.

[0074] FIG. 17 is a diagram showing an example of the operation of the security countermeasure planning system 1500 according to the third exemplary embodiment of the present invention.

[0075] Based on the risk time series change, which is an estimated value of the future risk of the average risk value of the attack route, the diagnosis time decision unit 180 outputs the next period when the risk is expected to be high as the next diagnosis time 108. For example, when the risk time series change, which is the estimated value of the future risk of each attack route for the countermeasure proposal 102, changes over time as illustrated in the table on the left side of FIG. 17, the time when the estimated value 1702 of the average risk of the attack route exceeds a threshold is output as the next diagnosis time 108, as illustrated in the right side of FIG. 17 (1701). The next diagnosis time 108 can be the time to perform risk analysis again, or the time to review the countermeasure proposal 102. The threshold value used to determine the next diagnosis time 108 and the threshold value used to determine the time to perform risk analysis again may be different values.

[0076] [Fourth embodiment] Next, a security countermeasure planning system according to a fourth embodiment of the present invention will be described with reference to the drawings. Fig. 18 is a diagram showing an example of the configuration of a security countermeasure planning system 1800 according to the fourth embodiment of the present invention. In Fig. 18, components with the same reference numerals as those in Fig. 5 are assumed to be the same components, and their description will be omitted.

[0077] A security countermeasure planning system 1800 according to the fourth embodiment of the present invention shown in FIG. 18 has a configuration in which an alert information generating unit 190 is added to the countermeasure decision unit 130 of the security countermeasure planning system 100 according to the first embodiment of the present invention shown in FIG.

[0078] FIG. 19 is a diagram showing an example of the configuration of the warning information generating unit 190 of the security countermeasure planning system 1800 according to the fourth embodiment of the present invention.

[0079] The warning information generating unit 190 generates information on the time and attack route when the risk is expected to increase when the countermeasure proposal 102 selected and output by the countermeasure deciding unit 130 is adopted. Referring to FIG. 19 , the warning information generating unit 190 includes a risk value change calculating unit 191 and a warning time deciding unit 192.

[0080] The attention timing determination unit 192 and the risk value change calculation unit 191 calculate the change in risk value when the countermeasure proposal 102 is used. For example, the average of the risk values ​​of the attack route at each time point can be calculated as the change in risk value. Also, the change in risk value can be the change in risk value of a specific representative attack route.

[0081] The caution time determining section 192 outputs, as caution information 107, the time when the changing risk value calculated by the risk value change calculating section 191 will reach or exceed a predetermined threshold value.

[0082] Fig. 20 is a diagram showing an example of the operation of the security countermeasure planning system 1800 according to the fourth embodiment of the present invention. As shown in Fig. 20, the warning information generating unit 190 extracts a time when the risk of an attack route will be high based on the estimated future risk values ​​for each of the attack routes 1 to 3, and generates warning information 107.

[0083] 20, for attack route 1 (2001), the future risk estimate value exceeds the threshold value after 5 months, for attack route 2 (2002), the future risk estimate value exceeds the threshold value between 1 month and 5 months and between 6 months and 10 months, and for attack route 3 (2003), the threshold value is not exceeded. Note that, for the example of attack route 2 (2002), if the OS is updated periodically, the risk value may fluctuate like attack route 2 (2002).

[0084] Correspondingly, the periods when the risk value of the attack route exceeds the threshold, i.e., 5 months or later for attack route 1 (2001), and 1 month to 5 months and 6 months to 10 months for attack route 2 (2002), are extracted as periods requiring caution for the attack routes, and warning information 107 is generated. Note that no warning information is generated for attack route 3 (2003).

[0085] Although each embodiment of the present invention has been described above, the present invention is not limited to the above-mentioned embodiments, and further modifications, substitutions, and adjustments can be made without departing from the basic technical idea of ​​the present invention. For example, the system configuration, the configuration of each element, and the expression form of messages shown in each drawing are examples to help understand the present invention, and the present invention is not limited to the configurations shown in these drawings. In the following description, "A and / or B" is used to mean at least either A or B.

[0086] Moreover, the procedures shown in the above-mentioned first to fourth embodiments can be realized by a program that causes a computer (9000 in FIG. 21) functioning as the security countermeasure planning system 100, 1400, 1500, 1800 to realize the functions of the security countermeasure planning system 100, 1400, 1500, 1800. Such a computer is exemplified by a configuration including a CPU (Central Processing Unit) 9010, a communication interface 9020, a memory 9030, and an auxiliary storage device 9040 in FIG. 21. That is, the attack route extraction program is executed by the CPU 9010 in FIG. 21, and an update process of each calculation parameter held in the auxiliary storage device 9040 or the like is performed.

[0087] The memory 9030 is a RAM (Random Access Memory), a ROM (Read Only Memory), or the like.

[0088] In other words, each part (processing means, function) of the security countermeasure planning system shown in the first to fourth embodiments described above can be realized by a computer program that causes the processor of the computer to execute each of the above-mentioned processes using its hardware.

[0089] Finally, preferred embodiments of the present invention will be summarized. [First form] (See the first perspective attack route extraction system above) [Second Form] In the security countermeasures planning system described in the first aspect, it is preferable that the risk change estimation unit estimates the future risk estimate value based on an estimated value of future change in at least one of business damage level, threat level, and vulnerability level. [Third Form] In the security countermeasure planning system described in the second aspect, it is preferable that the risk change estimation unit estimates an estimate of future changes in the threat level based on the configuration change history of the system to be diagnosed, the asset type of the host, the aggregated state of the assets of the system to be diagnosed at the time of calculating the risk value of the assets, the operation rules of the assets of the system to be diagnosed, and at least one of the probability of attack code appearance and threat prediction. [Fourth Form] In the security countermeasure planning system according to the second or third aspect, the risk change estimation unit For each measure, extract the applicable measure location of the asset, It is preferable to estimate an estimate of a future change in the vulnerability level when the countermeasure is introduced for a pair of the countermeasure and the countermeasure location, based on at least one of the countermeasure type, the time when the countermeasure can be introduced, and fluctuation information on the effectiveness of the countermeasure. [Fifth Form] In the security countermeasure planning system described in the second to fourth embodiments, it is preferable that the countermeasure decision unit decides on the countermeasure plan using the future risk estimate, a countermeasure policy, and a cost required for the countermeasure. [Sixth Form] In the security countermeasure planning system described in the fifth aspect, it is preferable that the countermeasure decision unit decides on a final countermeasure plan according to the future risk estimation value estimated by the risk change estimation unit, the input countermeasure policy, the cost required for the countermeasure, and countermeasure cost and budget information. [7th form] It is preferable that the security countermeasure planning system according to the first to sixth aspects further includes a diagnosis timing decision unit that decides a next diagnosis timing for the selected countermeasure plan. [8th form] It is preferable that the security countermeasure planning system described in the first to seventh embodiments further includes an alert information generation unit that generates, for the selected countermeasure plan, information on the time when the risk value of the asset of the countermeasure plan is expected to become high. [9th form] (See the second perspective method above) [10th form] (See the program for the third perspective above) The ninth and tenth embodiments can be expanded into the second to eighth embodiments in the same manner as the first embodiment.

[0090] The disclosures of the above patent documents are incorporated herein by reference. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the disclosure of the present invention, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or subrange included in the range should be interpreted as being specifically described even if not otherwise specified. [Explanation of symbols]

[0091] 100 Security Measures Planning System 101 Configuration Information 102 Countermeasures 106 Measures Policy 107 Caution Information 108 Next diagnosis time 110 Risk Analysis Department 111 Vulnerability Information Database (DB) 112 Analysis rule storage section 113 Reasoning Department 114 Attack graph information output part 115 Attack Route Extraction Unit 116 Risk Value Calculation Unit 120 Risk Change Estimation Department 121 Countermeasure Extraction Unit 122 Risk Time Series Change Estimation Unit 130 Countermeasures Decision-Making Department 131 Countermeasures Effectiveness Verification Department 132 Combination measures plan component 140 Future Risk Estimation Information Department 150 Countermeasure Candidate Information Department 170 Cost and Budget Information 180 Diagnosis Timing Decision Unit 181 Risk Change Calculation Unit 182 Next Diagnosis Time Decision Department 190 Caution information generation section 191 Risk Value Change Calculation Unit 192 Attention Time Determination Unit 9000 Computers 9010 CPU 9020 Communication Interface 9030 Memory 9040 Auxiliary storage device

Claims

1. A functional unit for calculating a risk value of one or more assets included in a system to be diagnosed; a risk change estimation unit that estimates a future risk estimate value of the risk value of the asset calculated by the functional unit; A security countermeasure planning system including a countermeasure decision unit that selects a countermeasure plan based on the future risk estimated value estimated by a risk change estimation unit. a diagnosis time determination unit that determines a time when the risk estimation value is estimated to be equal to or greater than a predetermined threshold value for the selected countermeasure plan as a next diagnosis time and a time to perform a risk analysis again; A security countermeasure planning system, wherein the threshold value for determining the timing of the next diagnosis and the timing of the re-execution of the risk analysis are different values.

2. 2. The security countermeasure planning system according to claim 1, wherein the risk change estimation unit estimates the future risk estimate value based on an estimate of future change in at least one of a business damage level, a threat level, and a vulnerability level.

3. 3. The security countermeasure planning system of claim 2, wherein the risk change estimation unit estimates an estimate of future changes in the threat level based on the configuration change history of the system to be diagnosed, the asset type of the host, the aggregated state of the assets of the system to be diagnosed at the time of calculating the risk value of the assets, the operation rules of the assets of the system to be diagnosed, and at least one of the probability of attack code appearance and a threat prediction.

4. The risk change estimation unit For each measure, extract the applicable measure location of the asset, 4. The security countermeasure planning system according to claim 2 or 3, further comprising: a security countermeasure planning unit that estimates an estimated value of a future change in the vulnerability level when the countermeasure is introduced, for a pair of the countermeasure and the countermeasure location, based on at least one of the countermeasure type, the time when the countermeasure can be introduced, and fluctuation information on the effectiveness of the countermeasure.

5. 5. The security countermeasure planning system according to claim 4, wherein said countermeasure decision unit decides on said countermeasure plan using said future risk estimate value, a countermeasure policy, and a cost required for said countermeasure.

6. 6. The security countermeasure planning system according to claim 5, wherein the countermeasure decision unit decides on a final countermeasure plan according to the future risk estimation value estimated by the risk change estimation unit, the input countermeasure policy, the cost required for the countermeasure, and countermeasure cost and budget information.

7. 7. The security countermeasure planning system according to claim 1, further comprising an alert information generating unit that generates, for the selected countermeasure plan, information on the time when the risk value of the asset of the countermeasure plan is expected to become high.

8. A step of calculating a risk value of one or more assets included in the system to be diagnosed; a risk change estimation step of estimating a future risk estimate of the calculated risk value of the asset; A security countermeasure planning method including a countermeasure decision step of selecting a countermeasure plan based on the estimated future risk estimate value, The method further includes a diagnosis timing determination step of determining a time when the risk estimation value is estimated to be equal to or greater than a predetermined threshold value as a next diagnosis timing and a timing for performing a risk analysis again for the selected countermeasure plan, A security countermeasure planning method, wherein the threshold value for determining the timing of the next diagnosis and the timing of performing the risk analysis again are different values.

9. On the computer, A process of calculating a risk value of one or more assets included in the system to be diagnosed; a risk change estimation process for estimating future risk estimates of the calculated asset risk values; A countermeasure decision process for selecting a countermeasure based on the estimated future risk value; executing a diagnosis timing determination process for determining a time when the risk estimation value is estimated to be equal to or greater than a predetermined threshold value as a next diagnosis timing and a timing for performing a risk analysis again for the selected countermeasure plan; The threshold value for determining the timing of the next diagnosis and the timing for performing the risk analysis again are different values.

Images