SECURITY MEASURE PLANNING SUPPORT DEVICE AND SECURITY MEASURE PLANNING SUPPORT METHOD

Abstract

To quantitatively evaluate how much multi-layer defense is actualized by selecting a component of an analysis objective system into which security measures need to be introduced preferentially and introducing the measures into the component.SOLUTION: A security measure planning support device 1 comprises: an attack scenario generation part 102 which generates an attack scenario of an analysis objective system; a measure-requiring component selection part 104 which selects a component into which security measures need to be introduced by the analysis objective system and determines a priority level of the component into which the security measures need to be introduced so as to form a defense layer representing a layer of defense constituting multi-layer defense against the attach scenario; and a result output part 105 which outputs the priority level of the component together with the number of defense layers formable by introducing the measures into the component.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a security countermeasures planning support device and a security countermeasures planning support method for supporting the planning of security countermeasures for a large-scale system made up of a large number of computer devices. [Background technology]

[0002] In recent years, security threats to computer systems (industrial control systems) in the industrial field have become apparent. Conventional industrial control systems were mainly operated in closed environments isolated from external networks, using their own operating systems (OS) and proprietary communication protocols. However, nowadays, it is common to adopt general-purpose OSs and standardized communication protocols that are commonly used in IT systems for the purpose of efficient data collection and remote monitoring. In addition, IoT (Internet of Things) technology is being actively adopted, in which the controlled equipment itself is directly connected to the Internet and operation data is accumulated in the cloud, etc., making it useful for failure prediction and maintenance. Against this background, industrial control systems are becoming larger and more complex, and the attack surface (area to be attacked) is also increasing year by year. As a result, industrial control systems are becoming a convenient target for attackers.

[0003] In the field of IT (Information Technology) systems, the limitations of traditional perimeter security, which focuses on security measures at the boundaries between internal and external networks, have been pointed out. The idea of ​​zero trust security, which states that the network boundary does not serve as a line of defense and that all communications should be viewed with suspicion, is now generally accepted. In order to achieve zero trust security, it is important to introduce security measures not only at the network boundary but also all over the place, from cloud environments to endpoints such as computer terminals. In recent years, even in industrial control systems, where the attack surface is increasing, it is required to take defensive measures based on the above-mentioned zero trust security concept and minimize risks.

[0004] With the increasing demand for security measures for industrial control systems, various countermeasure planning technologies have been invented. For example, the technology in Patent Document 1 generates an attack scenario to realize security threats inherent in the system to be analyzed, and then automatically outputs effective security measures for each step of the attack scenario. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-219898 A Summary of the Invention [Problem to be solved by the invention]

[0006] When performing security diagnosis and countermeasure planning for industrial control systems, the use of an inventive technology as typified by Patent Document 1 makes it possible to automatically output possible security threats and recommended countermeasures. On the other hand, there is a problem in that it is not possible to plan security countermeasures that also include the perspective of defense in depth. In this case, the countermeasures implemented individually for each device (hardware) are defined as "layers." Defense in depth means taking individual measures for multiple devices that make up the system to be analyzed. For example, if an attacker invades via the route A→B→C→D, implementing a countermeasure on A is considered to have formed one layer of defense, and implementing countermeasures on A and B is considered to have formed two layers of defense.

[0007] Therefore, the objective of the present invention is to select components of a system under analysis for which security measures should be implemented as a priority, and to quantitatively evaluate the degree to which multi-layered defense has been achieved by implementing the measures in those components. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, a security countermeasure planning support device comprises: Includes possible attack vectors based on the configuration of the analyzed system, which is made up of components. an attack scenario generation unit that generates an attack scenario; and a security measure that should be introduced in the analysis target system in order to form a defense layer that indicates a defense layer constituting a defense in depth against the attack scenario. The above Components The components are selected in order according to a method set by the user, and the threat coverage rate of the countermeasures in the attack scenario of the selected components is calculated. Determine the priority of the above components for which security measures should be implemented and then forming the protective layer. A component selection section that selects components that require countermeasures and the priority order of the components and the number of defense layers formed in a component in which the security measure should be implemented and which exists on a path to a component that is the target of an attack in the attack scenario. and a result output unit for outputting the result.

[0009] The security countermeasure planning support device of the present invention comprises: Includes possible attack vectors based on the configuration of the analyzed system, which is made up of components. an attack scenario generation unit that generates an attack scenario; and a security measure that should be introduced in the analysis target system in order to form a defense layer that indicates a defense layer constituting a defense in depth against the attack scenario. The aboveThe combination of components and their attack methods The components are selected in order according to a method set by the user, and the threat coverage rate of the countermeasures in the attack scenario of the selected components is calculated. Determine the priority of the above combination elements for which security measures should be implemented and then forming the protective layer. Selection of components requiring countermeasures and the priority order of the combination elements and the number of defense layers formed in a component in which the security measure should be implemented and which exists on a path to a component that is the target of an attack in the attack scenario. and a result output unit for outputting the result.

[0010] The security countermeasure planning support method of the present invention comprises the steps of: The attack scenario generation unit generates a scenario including possible attack paths of an attacker based on the configuration of the analysis target system composed of components. generating an attack scenario; The Countermeasures Requiring Component Selection Department In order to form defense layers that represent layers of defense in depth against the attack scenario, security measures should be implemented in the system under analysis. The above Components , selected in order according to the method set by the user and the countermeasure-required component selection unit calculates a threat coverage rate of the selected component by the countermeasure in the attack scenario, and selects the component having the highest threat coverage rate as the countermeasure-required component. Determine the priority of the above components for which security measures should be implemented and then forming the protective layer. Steps and The result output section is Priority of said components and the number of defense layers formed in a component in which the security measure should be implemented and which exists on a path to a component that is the target of an attack in the attack scenario. and outputting the result. Other means will be described in the description of the embodiment of the invention. Effect of the Invention

[0011] According to the present invention, it is possible to select components of a system under analysis for which security measures should be implemented as a priority, and to quantitatively evaluate the degree to which defense in depth has been achieved by implementing the measures in those components. [Brief description of the drawings]

[0012] [Figure 1] 1 is a hardware configuration diagram of a security countermeasure planning device according to a first embodiment. [Diagram 2] FIG. 2 is a logical block diagram of the security countermeasures planning support device. [Diagram 3] FIG. 4 illustrates an example of a component database. [Figure 4] FIG. 11 is a diagram illustrating an example of a countermeasure database. [Diagram 5] 13 is a flowchart of a security countermeasure planning support process. [Figure 6] FIG. 13 is a diagram illustrating an example of a screen for inputting information about components that configure a system to be analyzed. [Figure 7] FIG. 13 is a diagram illustrating an example of a screen for inputting information about a network that constitutes a system to be analyzed. [Figure 8] FIG. 13 is a diagram showing an example of a prioritization method setting screen for setting a method for prioritizing attack scenarios and components requiring countermeasures. [Figure 9] FIG. 11 is a diagram illustrating an example of attack scenario information. [Figure 10] FIG. 13 is a diagram showing an example of result information regarding prioritization of countermeasure components. [Figure 11] A figure showing an example of attack scenario information in the second embodiment. [Figure 12] 13 is a flowchart of a security countermeasure planning support process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. According to the present invention, in a large-scale industrial control system, components for which measures should be implemented are prioritized, and the security level that can be ensured by implementing the measures is quantified using an index called the number of defense layers, and then security measures can be planned.

[0014] (First embodiment) FIG. 1 is a hardware configuration diagram of a security countermeasure planning support device 1 according to the first embodiment. The security countermeasure planning support device 1 includes a memory 13, a storage device 12, an input / output interface 14, a CPU (Central Processing Unit) 11, a recording medium reader 15, and the like, all connected to one another via a bus or the like. The security countermeasure planning support device 1 prioritizes components in which countermeasures should be introduced in the system under analysis, and outputs a numerical value of the security level that can be ensured by introducing the countermeasures, using an index called the number of defense layers. In this way, the security countermeasure planning support device 1 supports the administrator of the system under analysis in planning security countermeasures.

[0015] The CPU 11 is a central processing unit that controls the security countermeasures planning support apparatus 1. When the security countermeasures planning support apparatus 1 is running, the CPU 11 executes a security countermeasures planning support program 123 stored in the storage device 12.

[0016] The memory 13 is, for example, a RAM (Random Access Memory) and is used as a working area when the CPU 11 executes a program.

[0017] The storage device 12 is, for example, an HDD (Hard Disk Drive) and stores a component database 121 and a countermeasure database 122 (described later) in addition to a security countermeasure planning support program 123. The storage device 12 may be provided outside the security countermeasure planning support device 1 and connected via an input / output interface 14.

[0018] The recording medium reader 15 is a reader device capable of reading an optical drive such as a compact disc, etc. The security countermeasures planning support program 123 described above is installed from the recording medium 3 in which the security countermeasures planning support program 123 is stored.

[0019] In addition, an input / output device 2 is connected to the security countermeasure planning support device 1 via an input / output interface 14. The input / output device 2 is a device that enables a user to input and output data to and from the security countermeasure planning support device 1, and is mainly composed of a keyboard, a mouse, a display, etc.

[0020] FIG. 2 is a logical block diagram of the security countermeasure planning support device 1. As shown in FIG. When the security countermeasure planning support device 1 is executed, the CPU 11 loads the security countermeasure planning support program 123 into the memory 13 and executes it. This embodies the functional units of the input reception unit 101, the attack scenario generation unit 102, the attack scenario evaluation unit 103, the countermeasure requiring component selection unit 104, and the result output unit 105. The storage unit 120 corresponds to the storage device 12 shown in Fig. 1. The storage unit 120 stores a component database 121 and a countermeasure database 122.

[0021] The input receiving unit 101 is a functional unit that receives input of information about components that configure the system to be analyzed. The input receiving unit 101 receives input of classification criteria that the attack scenario evaluation unit 103 uses to group attack scenarios according to their risk levels.

[0022] The attack scenario generation unit 102 is a functional unit that generates an attack scenario for the analysis target system. The attack scenario generation unit 102 further generates an attack scenario including an attack path of an attacker based on the configuration of the analysis target system accepted by the input acceptance unit 101.

[0023] The attack scenario evaluation unit 103 is a functional unit that groups attack scenarios in the analysis target system according to the degree of risk. The attack scenario evaluation unit 103 calculates the risk value of the attack scenario based on the type or function of the components included in the attack path, using a calculation method specified by the user.

[0024] The countermeasure-requiring component selection unit 104 forms defense layers that indicate layers of defense constituting a multi-layer defense against attack scenarios. The countermeasure-requiring component selection unit 104 selects components for which countermeasures should be introduced in order from attack scenarios classified into high-risk groups.

[0025] The countermeasure-requiring component selection unit 104 selects a component that is the starting point of an attack and a component that is the target of the attack. The countermeasure-requiring component selection unit 104 repeats the selection of components for which security measures should be implemented in the analysis target system, while changing the risk level group and the number of defense layers to be analyzed, until no candidates remain. The countermeasure-requiring component selection unit 104 selects components for which security measures should be implemented in the analysis target system based on the attack probability of each component, or preferentially selects those closest to the intrusion source.

[0026] When outputting the priority order of components to which measures should be implemented, the result output unit 105 simultaneously outputs examples of representative security measures recommended for the components and the costs required for implementing the measures.

[0027] The component database 121 stores information about components in the system to be analyzed. Details of the component database 121 will be described later with reference to FIG. The countermeasure database 122 stores information indicating the relationship between the contents of countermeasures and their costs. Details of the countermeasure database 122 will be described later with reference to FIG.

[0028] FIG. 3 is a diagram showing an example of the component database 121. As shown in FIG. The component database 121 includes a component ID column 1211 that can uniquely identify a component type column 1212, and each component type column 1212 is associated with an attack difficulty column 1213 that indicates the difficulty of an attack, and a countermeasure ID column 1214 of an implementable security countermeasure. The countermeasure ID column 1214 is managed in the countermeasure database 122.

[0029] FIG. 4 is a diagram showing an example of the countermeasure database 122. As shown in FIG. The measure database 122 includes a measure ID column 1221 that can uniquely identify a measure content column 1222, and stores a cost column 1223 required for implementing each measure. The measure ID column 1221 is referenced in the component database 121 as an external key.

[0030] FIG. 5 is a flowchart of the security countermeasures planning support process executed by the security countermeasures planning support apparatus 1. As shown in FIG. In step S10, the input receiving unit 101 receives an input of the system configuration to be analyzed, and further receives an input of setting execution conditions for the attack scenario evaluation unit 103. The input receiving unit 101 inputs information of the components that configure the system to be analyzed while linking it with information stored in the component database 121. The input receiving unit 101 also receives input of components that may be the starting point of an attack and components assumed to be targets of an attack.

[0031] 6, 7, and 8 show examples of a user interface displayed on the input / output device 2 when the input reception unit 101 operates.

[0032] FIG. 6 is a diagram showing an example of a system configuration input screen 4 for inputting information on components that configure the system to be analyzed. The system configuration input screen 4 has both a component tab 41 and a network tab 42. The import button 43 is a button for importing the information into the security countermeasure planning support apparatus 1 after inputting component information in the component tab 41 and network information in the network tab 42.

[0033] In FIG. 6, the component tab 41 is selected, and a screen for inputting component information is displayed. The component tab 41 displays a number of components text box 411, a name text box 412, a type combo box 413, and an attack target check box 414. 7 is entered in the number of components text box 411. This inputs that the number of components in the system to be analyzed is seven, and screen elements corresponding to these components are displayed.

[0034] "Component A" is entered in the name text box 412, and the menu "Host device / general-purpose OS" is selected in the type combo box 413. This indicates that the system to be analyzed has component A, and that its type is host device / general-purpose OS. The attack target check box 414 is not checked. This indicates that component A is not an attack target.

[0035] Similarly, the component tab 41 displays a name text box 415, a type combo box 416, an attack target check box 417, a name text box 418, a type combo box 419, and an attack target check box 410. The remaining four components are not displayed on the screen, but can be made to appear on the screen by dragging the slide bar on the right.

[0036] "Component B" is entered in the name text box 415, and the menu "embedded device / general-purpose OS" is selected in the type combo box 416. This indicates that the system to be analyzed has component B, and that its type is embedded device / general-purpose OS. The attack target check box 417 is checked. This indicates that component A is an attack target.

[0037] "Network X-managed switch" is entered in the name text box 418, and the "network switch" menu is selected in the type combo box 419. This indicates that the system to be analyzed has a network X-managed switch, and that its type is a network switch. The attack target check box 410 is not checked. This indicates that the network X-managed switch is not an attack target.

[0038] The operator inputs the number of components constituting the system in a component number text box 411, and inputs the names and types of the set number of components. The selection menus in component type combo boxes 413, 416, and 419 are based on the component type column 1212 registered in the component database 121. In addition, when generating an attack scenario, the operator checks the attack target check boxes 414, 417, and 410 of components assumed to be attack targets.

[0039] As with the three components mentioned above, the operator drags the slide bar to reveal the remaining four components, and inputs the name, type, and whether or not they are targets of attack.

[0040] FIG. 7 is a diagram showing an example of a system configuration input screen 4 for inputting information about a network that constitutes a system to be analyzed. The system configuration input screen 4, like Fig. 6, has both a component tab 41 and a network tab 42. In Fig. 7, the network tab 42 has been selected, and a screen for inputting network information is displayed.

[0041] The network tab 42 displays a connected device combo box 421, an Add button 422, a number of LANs text box 423, a name text box 424, a managed device combo box 425, a connected device combo box 426, a connected device combo box 427, an Add button 428, and a name text box 429.

[0042] First, the operator selects a component that is connected to an untrusted network (such as the Internet used by an unspecified number of users) and that could be the starting point of an attack from the menu in the connected device combo box 421. The names of components registered in the component tab 41 of the system configuration information are displayed in a menu in the connected device combo box 421. In FIG. 7, component A is registered in the connected device combo box 421, which means that component A could be the starting point of an attack. When the operator clicks the add button 422, the number of connected device combo boxes can be increased.

[0043] Next, the operator enters "3" in number of LANs text box 423, enters "Network X" in name text box 424, and selects "Network X managed switch", which is the component managing network X, from the menu of managed device combo box 425. Then, the operator selects "Component A" from the menu of connected device combo box 426, and selects "Component B" from the menu of connected device combo box 427. This means that components A and B are connected to network X. The operator can add connected device combo boxes for each network by pressing add button 428. Once the operator has completed inputting the information on the components and network that make up the system, he or she clicks the Import button 43. This causes the screen to transition to a prioritization method setting screen 5 shown in FIG.

[0044] FIG. 8 is a diagram showing an example of a prioritization method setting screen 5 for setting a method for prioritizing attack scenarios and components requiring countermeasures. The prioritization method setting screen 5 is a screen for setting the execution conditions of the attack scenario evaluation unit 103 and the countermeasure-requiring component selection unit 104. The prioritization method setting screen 5 displays a risk value calculation method combo box 51, a risk group number text box 52, risk value score text boxes 53a and 53b, risk value score text boxes 54a and 54b, a countermeasure-requiring component selection method combo box 55, and an analysis execution button 56.

[0045] The risk value calculation method combo box 51 selects a method to be used for calculating the risk value of an attack scenario. For example, the "shortest path priority method" is a method that outputs a large risk value for an attack scenario with a short path, regardless of the type of component through which the attacker passes. On the other hand, the "component-specific attack difficulty priority method" is a method that calculates a risk value by prioritizing the type of component through which the attacker passes over the length of the attack path. In the "component-specific attack difficulty priority method", for example, the risk value of an attack scenario in which a component that is difficult to use as a springboard for an attack is passed through many times is calculated to be low. In this embodiment, the risk value is evaluated as a value between 0 and 10, and the higher the risk value, the higher the risk of the attack scenario is. The shortest path priority method has the advantage that it is not necessary to set the asset type in detail because it can be prioritized based on only the information of the attack path, but the accuracy of the risk evaluation is reduced. On the other hand, the asset-specific attack difficulty priority method requires detailed setting of the asset type, which takes time to collect input information, but it enables a risk evaluation with high accuracy.

[0046] Next, input for grouping attack scenarios will be described. In the Number of Risk Groups text box 52, set the number of groups into which the attack scenarios are to be classified. Then, in the Risk Value Score text boxes 53a and 53b and the Risk Value Score text boxes 54a and 54b, input the range of the risk value scores of the attack scenarios to be assigned to each risk group.

[0047] The countermeasure-requiring component selection method combo box 55 selects the method used to select components requiring countermeasures. For example, the "attack probability priority method" is a method in which components are selected in order of the highest attack probability. In this method, for components with the same overlap, the component closest to the intrusion source is selected in order. The "intrusion source neighbor point priority method" is a method in which components are selected in order of the closest to the intrusion source. In this method, if there are multiple candidates, the component with the highest attack probability is selected.

[0048] After entering this information, clicking the execute analysis button 56 will transition to the attack scenario generation process shown in step S11 of FIG.

[0049] Returning to Fig. 5, the explanation will be continued with reference to Fig. 1 and Fig. 2 as necessary. The attack scenario generation unit 102 automatically generates possible attack scenarios based on the system configuration input by the input reception unit 101 (step S11). The attack scenario information generated by the attack scenario generation unit 102 includes information on the path an attacker takes from the component that is the starting point of the attack to the component that is the target of the attack. The attack scenario evaluation unit 103 evaluates the risk of the attack scenario generated by the attack scenario generation unit 102 and gives a risk value to the attack scenario. Then, the attack scenario evaluation unit 103 classifies the attack scenarios by risk based on the risk value (step S12).

[0050] An example of an attack scenario generated by the attack scenario generation unit 102 and evaluated by the attack scenario evaluation unit 103 is shown in FIG.

[0051] FIG. 9 is a diagram showing an example of the attack scenario information 8. As shown in FIG. The attack scenario information 8 includes an identification number column 8001 , an attack scenario column 8002 , a risk value column 8003 , and a risk level group column 8004 . The identification number column 8001 stores the identification number of the attack scenario. The attack scenario column 8002 stores the attack scenario. The risk value column 8003 stores the risk value of each attack scenario. The risk group column 8004 stores which risk group each attack scenario belongs to.

[0052] Here, the following seven attack scenarios are stored in the attack scenario information 8. Note that networks X, Y, and Z here refer to devices (components) that manage each network. (Identification number 1) Component A → Network X → Component B (Identification number 2) Component A → Network X → Component D (Identification number 3) Component C → Network X → Component B (Identification number 4) Component C → Network Y → Component B (Identification number 5) Component C → Network Y → Component E (Identification number 6) Component C → Network Z → Component E (Identification number 7) Component C → Network Z → Component D

[0053] First, the attack scenario generation unit 102 outputs an attack scenario to which an identification number is assigned. The attack scenario stores route information that an attacker takes from the component that is the attack origin to the component that is the target of the attack. The component that is the attack origin is selected from among the components added in the network tab 42 of the system configuration input screen 4 shown in Fig. 7. The component that is the target of the attack is selected from among the components that have been checked in the attack target checkboxes 414, 417, 410, ... on the system configuration input screen 4.

[0054] Next, the attack scenario evaluation unit 103 calculates a risk value for each attack scenario and stores the calculated risk value in the risk value column 8003. The risk value calculation method is selected in the risk value calculation method combo box 51 of the prioritization method setting screen 5 of FIG. 8. Then, the attack scenarios are classified into groups by risk level based on the risk value by the attack scenario evaluation unit 103. The classification conditions are input in the risk value score text boxes 53a, 53b, 54a, 54b, ... of the prioritization method setting screen 5 of FIG. 8. Here, attack scenarios 1 to 3 with risk values ​​of 6 or more and less than 10 are classified into risk level group 1. Attack scenarios 4 to 6 with risk values ​​of 3 or more and less than 6 are classified into risk level group 2. Attack scenarios with identification number 7, which have a risk value less than 3, are not assigned to a group and are not subject to analysis.

[0055] In this embodiment, as described in the risk group column 8004, attack scenarios with identification numbers 1 to 3 are classified into risk group 1, and attack scenarios with identification numbers 4 to 6 are classified into risk group 2. Other attack scenarios are not classified into any risk group.

[0056] The countermeasure-requiring component selection unit 104 selects components (hereinafter sometimes referred to as "countermeasure-requiring components") for which countermeasures should be introduced in order to form defense layers (hereinafter referred to as "defense layers") that constitute multi-layer defense in order to form the required number of defense layers against attack scenarios classified into the risk group of the defense target (step S13). The method for selecting components requiring countermeasures is selected in the component selection method combo box 55 on the prioritization method setting screen 5 in Fig. 8. The "attack probability priority method" selected in Fig. 8 is a method for selecting components in descending order of attack probability.

[0057] The countermeasure-requiring component selection unit 104 calculates a threat coverage rate, which is the percentage of attack scenarios in each risk group that are covered when countermeasures are introduced to each component, and selects components with a high threat coverage rate.

[0058] In the first processing cycle, the countermeasure-requiring component selection unit 104 selects components for which countermeasures should be introduced to form one defense layer, starting from the attack scenarios classified into risk group 1, which has the highest risk level.

[0059] Here, the number of defense layers refers to the number of components with security measures implemented that exist on the path an attacker takes to reach the component that is the target of the attack. For example, a state in which one defense layer has been formed means that the path an attacker takes to reach the component that is the target of the attack includes at least one component with security measures implemented. Similarly, if two defense layers have been formed, it means that the attack path includes at least two components with security measures implemented.

[0060] Next, the countermeasure-requiring component selection unit 104 determines whether a defense layer against the attack scenario has been formed by introducing countermeasures to the components selected so far (step S14). If a defense layer has not been formed (No) in step S14, the countermeasure-requiring component selection unit 104 returns to step S13, and the selection of components to which countermeasures should be introduced in order to form a defense layer is repeated.

[0061] For example, for the attack scenario shown in FIG. 9, the threat coverage rate (overlap) for risk group 1 is as follows: Threat coverage rate when countermeasures are implemented in component A: 2 / 3 Threat coverage rate when countermeasures are implemented in component B: 2 / 3 Threat coverage rate when countermeasures are implemented in component C: 1 / 3 Threat coverage rate when countermeasures are implemented in component D: 1 / 3 Threat coverage rate when countermeasures are implemented for component E: 0 / 3 Threat coverage rate when countermeasures are implemented in network X: 3 / 3 Threat coverage rate when countermeasures are implemented in network Y: 0 / 3 Threat coverage rate when countermeasures are implemented in network Z: 0 / 3 In this case, since the threat coverage rate is highest when measures are introduced to the managed device of network X, the countermeasure-requiring component selection unit 104 selects the managed device of network X. This forms one layer of defense against attack scenarios of risk level group 1.

[0062] Furthermore, the countermeasure-requiring component selection unit 104 calculates the threat coverage rate for risk level group 2 when countermeasures are introduced to each component, and selects components with high threat coverage rates. Threat coverage rate when countermeasures are implemented in component A: 0 / 3 Threat coverage rate when countermeasures are implemented in component B: 1 / 3 Threat coverage rate when countermeasures are implemented in component C: 3 / 3 Threat coverage rate when countermeasures are implemented for component D: 0 / 3 Threat coverage rate when countermeasures are implemented for component E: 2 / 3 Threat coverage rate when countermeasures are implemented in network Y: 2 / 3 Threat coverage rate when countermeasures are implemented in network Z: 1 / 3 In this case, since the threat coverage rate is highest when measures are introduced to component C, the countermeasure-requiring component selection unit 104 selects component C. This forms one layer of defense against attack scenarios in risk level group 2.

[0063] Next, the countermeasure-requiring component selection unit 104 calculates the second-layer threat coverage rate for risk level group 1 when countermeasures are introduced to each component or network, and selects a component with a high threat coverage rate. Here, since network X and component C have been selected so far, two defense layers have already been formed against the attack scenario with identification number 3, and a threat coverage rate of 1 / 3 has already been secured. Threat coverage rate when countermeasures are implemented in component A: 3 / 3 Threat coverage rate when countermeasures are implemented in component B: 2 / 3 Threat coverage rate when countermeasures are implemented in component D: 2 / 3 Threat coverage rate when countermeasures are implemented for component E: 1 / 3 Threat coverage rate when countermeasures are implemented in network Y: 1 / 3 Threat coverage rate when countermeasures are implemented in network Z: 1 / 3 In this case, since the threat coverage rate is highest when measures are introduced into component A, the countermeasure-requiring component selection unit 104 selects component A. As a result, two layers of defense against attack scenarios in risk group 2 are formed.

[0064] Next, the countermeasure-requiring component selection unit 104 calculates the threat coverage rate of the second layer for the risk level group 2 when countermeasures are introduced to each component, and selects a component with a high threat coverage rate. Threat coverage rate when countermeasures are implemented in component B: 1 / 3 Threat coverage rate when countermeasures are implemented for component D: 0 / 3 Threat coverage rate when countermeasures are implemented for component E: 2 / 3 Threat coverage rate when countermeasures are implemented in network Y: 2 / 3 Threat coverage rate when countermeasures are implemented in network Z: 1 / 3 At this time, the threat coverage rate when the countermeasure is introduced to component E and the threat coverage rate when the countermeasure is introduced to network Y are the highest. In the case of components with the same threat coverage rate, countermeasure-requiring component selection unit 104 selects network Y which is closer to the intrusion point. At this time, since the second defense layer against risk group 2 has not yet been sufficiently formed, a further component is selected.

[0065] Next, when measures are introduced to each component or network, the countermeasure-requiring component selection unit 104 calculates the second-layer threat coverage rate for risk level group 2 and selects a component with a high threat coverage rate. Here, since network X, component C, component A, and network Y have been selected so far, two defense layers have already been formed against the attack scenarios with identification numbers 4 and 5, and a threat coverage rate of 2 / 3 has already been secured. Threat coverage rate when countermeasures are implemented in component B: 2 / 3 Threat coverage rate when countermeasures are implemented in component D: 2 / 3 Threat coverage rate when countermeasures are implemented for component E: 3 / 3 Threat coverage rate when countermeasures are implemented in network Z: 3 / 3 In this case, the threat coverage rate when the countermeasure is introduced to component E and the threat coverage rate when the countermeasure is introduced to network Z are the highest. In the case of components with the same threat coverage rate, the countermeasure-requiring component selection unit 104 selects network Z which is closer to the intrusion point.

[0066] If a defense layer has been formed (Yes), the countermeasure-requiring component selection unit 104 proceeds to step S15 and determines whether prioritization of all components has been completed.

[0067] In step S15, if the prioritization of all components has not been completed (No), the countermeasure-requiring component selection unit 104 resets the number of defense layers required and the risk group of the defense target (step S16), and then returns to step S13. For example, if the formation of defense layers has been completed for the attack scenario classified as risk group 1, the countermeasure-requiring component selection unit 104 leaves the number of defense layers required unchanged, lowers the level of the risk group of the defense target by one, and resets it to risk group 2, and returns to step S13. Also, if the countermeasure-requiring component selection unit 104 has been able to form defense layers for the attack scenarios of all risk groups, it increases the number of defense layers required by one, and returns to step S13. If the prioritization of all components has been completed (Yes), the countermeasure-requiring component selection unit 104 proceeds to step S17.

[0068] FIG. 10 is a diagram showing an example of result information 9 regarding the prioritization of measure components. The result information 9 is a result of prioritizing components for which measures should be introduced, performed by the countermeasure requiring component selection unit 104 based on the data of the attack scenario. The result information 9 includes a priority order column 9001, a component column 9002, a number of defense layers column 9003, a defense target risk level group column 9004, a threat coverage rate column 9005, a recommended countermeasure column 9006, and a cost column 9007.

[0069] The component column 9002 stores components for which measures should be introduced. When the countermeasure-requiring component selection unit 104 selects a network, the component column 9002 stores the management device of the network as a component for which measures should be introduced. For example, when the countermeasure-requiring component selection unit 104 selects network X, the component column 9002 stores a network X management switch that manages network X. The priority column 9001 stores the priority of the countermeasures for the component. The number of defense layers column 9003 stores the number of defense layers that can be formed by protecting the component. The defense target risk group column 9004 stores the risk group of the attack scenario that is the defense target. In addition, the threat coverage rate column 9005 stores the threat coverage rate for each risk group. The recommended countermeasure column 9006 stores recommended countermeasures for this component. The cost column 9007 stores the cost required for the recommended countermeasures for this component.

[0070] As described above, the prioritized component types are linked to information in the component database 121. Therefore, in the component database 121, the contents of measures stored in the measures database 122 are stored in the recommended measures column 9006 using the measure ID as an external key, and the costs required for implementation are retrieved and stored in the cost column 9007. This enables the user to simultaneously grasp the priority order of components requiring measures, the specific contents of the measures to be implemented, and the costs required for them.

[0071] For example, for the attack scenarios in risk group 1 in the attack scenario information 8 shown in Fig. 9, network X is most frequently used as a springboard for attacks. Therefore, in order to most efficiently form one defense layer, it is sufficient to introduce countermeasures into network X, and therefore the network X management switch, which is its management device, is selected as priority level 1. Here, since the attack scenarios to be defended against are classified into risk group 1, "1" is stored in the defense target risk group column 9004.

[0072] Furthermore, because the introduction of countermeasures to the network X managed switch covers all threats in the attack scenarios of risk group 1, "1.0" is entered into the threat coverage rate for risk group 1. On the other hand, the introduction of countermeasures to the network X managed switch does not cover threats in the attack scenarios of risk group 2, so "0.0" is entered into the threat coverage rate for risk group 2.

[0073] By introducing countermeasures to the network X managed switch, the formation of one defense layer against the attack scenarios of risk group 1 has been completed, so next, components requiring countermeasures will be selected for the attack scenarios of risk group 2. As a result, component C, which has the highest probability of being a springboard for attacks, is selected, and the threat coverage rate for risk group 2 is also 1.0. Now that one defense layer has been formed against the attack scenarios of all the set risk groups, the next step is to set the number of defense layers to two, and again select components requiring countermeasures starting from the attack scenarios of risk group 1. This selection process is repeated until the priorities of all components have been determined.

[0074] In this embodiment, the countermeasure-requiring component selection unit 104 employs an algorithm that preferentially selects components that are highly likely to become a springboard for attacks, as described above. In contrast to this, it is also possible to employ an algorithm that preferentially selects components that are close to the starting point of an attack, or an algorithm that preferentially selects components that have a large total risk value of attack scenarios that can be prevented by introducing countermeasures.

[0075] In addition, in this embodiment, a method is adopted in which attack scenarios are classified into groups according to the degree of danger, and then components requiring countermeasures are selected. In contrast to this, it is in principle possible to evaluate attack scenarios collectively without group classification, and prioritize components requiring countermeasures (networks requiring countermeasures). For example, a method can be considered in which a pattern of defense layers formed by introducing measures into each component or network is comprehensively calculated, and based on that, a priority is assigned to components requiring countermeasures that can form defense layers most efficiently.

[0076] However, since the above method requires enormous computational costs, in this embodiment, an algorithm is adopted that first classifies attack scenarios into groups based on their level of danger, and then prioritizes components that are simply more likely to serve as springboards for attacks.

[0077] Returning to Fig. 5, the description will be continued with reference to Fig. 1 and Fig. 2 as appropriate. The result output unit 105 links the result obtained by the countermeasure requiring component selection unit 104 with the database, outputs it to the input / output device 2 (step S17), and the processing in Fig. 5 ends.

[0078] Second embodiment In the first embodiment, an attack scenario is generated with each component as the target of attack. In contrast, in the second embodiment, an attack scenario is generated with a combination of each component and an attack method as the target of attack. This makes it possible to evaluate an appropriate defense layer when multiple attack methods are possible against a component.

[0079] FIG. 11 is a diagram showing an example of the attack scenario information 8 in the second embodiment. Unlike the attack scenario information 8 shown in Fig. 9, the attack methods against component A are subdivided into two, α and β, and the attack methods against component C are subdivided into two, ζ and η. The attack methods against other components are single attacks.

[0080] FIG. 12 is a flowchart of the security countermeasure planning support process. This flowchart proceeds in the same manner as steps S10 to S12 shown in Fig. 5. In step S13A, the countermeasure-requiring component selection unit 104 selects combination elements (hereinafter sometimes referred to as "countermeasure-requiring elements") of components and attack methods for which countermeasures should be implemented in order to form a required number of defense layers for the attack scenarios classified into the danger group of the defense target.

[0081] Next, the countermeasure-requiring component selection unit 104 judges whether or not a defense layer has been formed against the attack scenario by introducing measures to the countermeasure-requiring elements selected so far (step S14). If a defense layer has not been formed (No) in step S14, the countermeasure-requiring component selection unit 104 returns to step S13A, and the selection of the countermeasure-requiring elements to which measures should be introduced in order to form a defense layer is repeated. If a defense layer has been formed (Yes), the countermeasure-requiring component selection unit 104 proceeds to step S15A, and judges whether or not prioritization of all countermeasure-requiring elements has been completed. The processes in steps S16 and S17 are the same as those in steps S16 and S17 shown in FIG. 5.

[0082] (Modification) The present invention is not limited to the above-described embodiment, and includes various modified examples. For example, the above-described embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all of the configurations described. It is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0083] The above configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware such as an integrated circuit. The above configurations, functions, etc. may be realized by software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a recording device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as a flash memory card or a DVD (Digital Versatile Disk).

[0084] In each embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it may be considered that almost all components are connected to each other. [Explanation of symbols]

[0085] 1. Security countermeasure planning support device 101 Input reception section 102 Attack scenario generation unit 103 Attack Scenario Evaluation Department 104 Component Selection Department 105 Result output section 120 Storage section 11 CPU 12 Storage device 121 Component Database 1211 Component ID column 1212 Type column 1213 Attack difficulty column 1214 Measure ID column 122 Countermeasures Database 1221 Measure ID column 1222 Content column 1223 Cost column 123 Security Measures Planning Support Program 13. Memory 14 Input / Output Interface 15 Recording medium reader 2 Input / Output Devices 3 Recording media 4 System configuration input screen 41 Components Tab 42 Network Tab 43 Import button 411 Number of components text box 412 Name text box 413 Type Combo Box 414 Attack target checkbox 415 Name text box 416 types combo box 417 Attack Target Checkbox 418 Name text box 419 Type Combo Box 410 Attack Target Checkbox 421 Connected Device Combo Box 422 Add button 423 Number of LANs text box 424 Name text box 425 Management Equipment Combo Box 426 Connected Device Combo Box 427 Connected Device Combo Box 428 Add button 429 Name text box 5 Prioritization setting screen 51 Risk value calculation method combo box 52 Number of risk groups text box 53a, 53b, 54a, 54b Risk score text boxes 55 Component selection method combo box 56 Analysis execution button 8. Attack Scenario Information 8001 Identification number column 8002 Attack Scenario Column 8003 Risk value column 8004 Risk Group Column 9 Result information 9001 Priority field 9002 Component column 9003 Number of defense layers column 9004 Defense target risk group column 9005 Threat Coverage Column 9006 Recommended measures 9007 Cost column

Claims

1. An attack scenario generation unit that generates an attack scenario including possible attack paths of an attacker based on the configuration of an analysis target system composed of components; a countermeasure-requiring component selection unit that sequentially selects the components in which security measures should be implemented in the analysis target system in a manner set by a user, in order to form defense layers indicating layers of defense constituting a defense in depth against the attack scenarios, calculates a threat coverage rate of the selected components by the measures in the attack scenarios, and determines a priority order of the components in which the security measures should be implemented starting from the component with the highest threat coverage rate, thereby forming the defense layers in order; a result output unit that outputs the priority order of the components and the number of defense layers formed in the components in which the security measures should be implemented and which are present on a path to a component that is a target of an attack in the attack scenario; A security countermeasure planning support device comprising:

2. further comprising an attack scenario evaluation unit that calculates a risk value of the attack scenario based on a calculation method designated by a user and based on the type or function of the component included in the attack path, and groups the attack scenarios in the analysis target system according to the risk value; the countermeasure-requiring component selection unit selects components for which countermeasures should be implemented in order from the attack scenarios classified into high-risk groups; 2. The security countermeasure planning support device according to claim 1.

3. An input receiving unit that receives input of information about components and / or a network that configure the system to be analyzed, the countermeasure-required component selection unit selects a component that is a starting point of an attack and a component that is a target of an attack by receiving the component from the input receiving unit; 3. The security countermeasure planning support device according to claim 2.

4. The attack scenario generation unit generating the attack scenario based on the configuration of the analysis target system accepted by the input acceptance unit; 4. The security countermeasure planning support device according to claim 3.

5. the input receiving unit receives an input of classification criteria by which the attack scenario evaluation unit classifies the attack scenarios into groups according to their risk levels; 5. The security countermeasure planning support device according to claim 4.

6. the countermeasure-requiring component selection unit sets the defense layer to one layer and prioritizes all of the components for which security measures should be introduced in the analysis target system for the group of attack scenarios of the analysis target divided by the risk level, and then sets the defense layer to two layers and prioritizes all of the components for which security measures should be introduced in the analysis target system for the group of attack scenarios of the analysis target divided by the risk level; 6. The security countermeasure planning support device according to claim 5.

7. the countermeasure-required component selection unit selects components in descending order of attack probability, the method received by the input reception unit being an attack probability priority method, and selecting the components in descending order of attack probability, 7. The security countermeasure planning support device according to claim 6.

8. the countermeasure-required component selection unit, when there are a plurality of components for which the security countermeasure should be introduced in the analysis target system that have the same attack probability, selects a component that is closer to the component that may be a starting point of an attack with priority; 8. The security countermeasure planning support device according to claim 7.

9. the countermeasure-required component selection unit selects components for which the security countermeasure should be introduced in the analysis target system, with a priority given to components that are closer to the component that may be a starting point of an attack; 7. The security countermeasure planning support device according to claim 6.

10. the countermeasure-required component selection unit, when there are a plurality of components in the analysis target system that are equally distant from a component that may be a starting point of an attack on the component for which the security countermeasure should be implemented, preferentially selects a component having a higher probability of attack.

10. The security countermeasure planning support device according to claim 9.

11. Further comprising a countermeasure database showing information showing the relationship between the content of the countermeasure and the cost, when outputting the priority order of the components to which the countermeasures should be introduced, the result output unit simultaneously outputs examples of representative security countermeasures recommended for each component and the costs required for introducing the countermeasures, using identifiers indicating the countermeasures.

7. The security countermeasure planning support device according to claim 6.

12. An attack scenario generation unit that generates an attack scenario including possible attack paths of an attacker based on a configuration of an analysis target system composed of components; a countermeasure-requiring component selection unit which, in order to form defense layers indicating defense layers constituting a defense in depth against the attack scenario, selects combination elements of the components and their attack methods in which security measures should be implemented in the analysis target system in sequence according to a method set by a user, calculates a threat coverage rate of the selected components by the measures in the attack scenario, and determines a priority order of the combination elements in which the security measures should be implemented starting from the one with the highest threat coverage rate, thereby forming the defense layers in sequence; a result output unit that outputs the priority order of the combination elements and the number of defense layers formed in the components in which the security measures should be implemented and which are present on a path to a component that is a target of an attack in the attack scenario; A security countermeasure planning support device comprising:

13. an attack scenario evaluation unit that calculates a risk value of the attack scenario based on a combination of a type or function of a component included in the attack path and the attack method thereof, based on a calculation method designated by a user; 13. The security countermeasure planning support device according to claim 12.

14. A step in which an attack scenario generation unit generates an attack scenario including possible attack paths of an attacker based on a configuration of an analysis target system composed of components; a step of a countermeasure-requiring component selection unit sequentially selecting the components for which security countermeasures should be implemented in the analysis target system in a manner set by a user in order to form defense layers that indicate layers of defense constituting a defense in depth against the attack scenario; the countermeasure-requiring component selection unit calculates a threat coverage rate of the selected components by the countermeasures in the attack scenario, and determines a priority order of the components in which the security countermeasures should be introduced starting from the component with the highest threat coverage rate, thereby forming the defense layers in order; a result output unit outputting the priority order of the components and the number of defense layers formed in the components that should have the security measures and that are present on a path to a component that is a target of an attack in the attack scenario; A security countermeasure planning support method comprising the steps of:

Images