Risk assessment device, risk assessment method, and program

Abstract

To allow a risk value based on installed security measures to be calculated with greater accuracy.SOLUTION: A risk evaluation apparatus of an embodiment includes a vulnerability information input unit, an individual measures acquisition unit, a parameter acquisition unit, a determination unit, and a calculation unit. The vulnerability information input unit receives an input of vulnerability information on a risk evaluation target. The individual measures acquisition unit acquires at least one security measure introduced in an evaluation target system. The parameter acquisition unit acquires, for each security measure, a candidate of a parameter value used for calculating a risk of the vulnerability based on the security measures and the vulnerability information. The determination unit determines the parameter used for calculating the risk of the vulnerability from the candidates of the parameter value. The calculation unit calculates a risk value indicating the risk of the vulnerability using the parameter determined by the determination unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] An embodiment of the present invention relates to a risk assessment device, a risk assessment method, and a program. [Background technology]

[0002] Security vulnerabilities are reported every day, and one technology for understanding the risk associated with vulnerabilities is the Common Vulnerability Scoring System (CVSS) developed by the US Common Vulnerability Scoring System (FIRST). For example, there is a known technology that determines the need for countermeasures against vulnerabilities based on the results of calculations of the CVSS environmental and current values, and also determines the need for countermeasures based on the attack path and the presence or absence of security measures along that path. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2021 / 130897 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with conventional techniques, it has been difficult to calculate with higher accuracy a risk value based on security measures that have already been implemented. [Means for solving the problem]

[0005] A risk assessment device according to an embodiment includes a vulnerability information input unit, an individual measure acquisition unit, a parameter acquisition unit, a determination unit, and a calculation unit. The vulnerability information input unit accepts input of vulnerability information of a risk assessment target. The individual measure acquisition unit acquires at least one security measure introduced into a system to be assessed. The parameter acquisition unit acquires candidate values ​​of parameters used to calculate the risk of a vulnerability for each security measure based on the security measure and the vulnerability information. The determination unit determines the parameters used to calculate the risk of a vulnerability from the candidate value of the parameters. The calculation unit calculates a risk value indicating the risk of a vulnerability using the parameters determined by the determination unit. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 2 is a diagram showing an example of the functional configuration of the risk assessment apparatus according to the first embodiment. [Figure 2] FIG. 2 is a diagram showing an example of an implemented security countermeasure DB according to the first embodiment. [Figure 3] FIG. 4 is a diagram showing an example of a mitigation measure DB according to the first embodiment. [Figure 4A] FIG. 2 is a diagram showing Example 1 of a product vulnerability response DB according to the first embodiment. [Figure 4B] FIG. 10 is a diagram showing Example 2 of the product vulnerability response DB according to the first embodiment. [Figure 5] 3 is a flowchart showing an example of a risk assessment method according to the first embodiment. [Figure 6] FIG. 10 is a diagram showing an example of the functional configuration of a risk assessment apparatus according to a second embodiment. [Figure 7] FIG. 10 is a diagram showing an example of an adjustment rule according to the second embodiment. [Figure 8] FIG. 10 is a diagram showing an example of a security countermeasure DB according to the second embodiment. [Figure 9] 10 is a flowchart showing an example of a risk assessment method according to the second embodiment. [Figure 10] 10 is a flowchart showing an example of a process (step S25-2) for evaluating the effectiveness of measures according to the second embodiment. [Figure 11]10 is a flowchart showing an example of a security requirement value adjustment process (step S29-2) according to the second embodiment. [Figure 12] 10 is a flowchart showing an example of a process for recommending security measures (step S31-2) according to the second embodiment. [Figure 13] FIG. 1 is a diagram showing an example of the hardware configuration of a risk assessment device according to the first and second embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0007] Hereinafter, embodiments of a risk assessment device, a risk assessment method, and a program will be described in detail with reference to the accompanying drawings.

[0008] (First embodiment) In vulnerability handling, the CVSS base score, i.e., the characteristics of the vulnerability itself, is considered to be the risk, but in reality, the risk changes depending on each environment, such as security requirements, system configuration, and implemented security measures. In other words, using the base score may result in excessive measures being taken or serious risks not being addressed.

[0009] When a vulnerability is discovered, it is often assumed that a patch must be applied, but other measures may also be considered depending on the risk. For example, measures can be taken by changing firewall settings (hereafter referred to as "mitigation measures"). However, there is no established method for calculating risk values ​​depending on whether or not mitigation measures have been implemented. In other words, it is unclear to what extent risk will be reduced by mitigation measures, making it difficult to determine whether additional measures should be implemented.

[0010] Therefore, the risk assessment device of the first embodiment is capable of calculating a risk value (e.g., CVSS v3 environmental value) based on security measures that have already been implemented with high accuracy, and making it possible to quantitatively grasp the risk tailored to the system to be assessed. Furthermore, the risk assessment device of the first embodiment automatically recommends mitigation measures and makes it possible to quantitatively grasp the risk reduction effect at the time of implementation, thereby enabling appropriate and easy vulnerability handling.

[0011] [Example of functional configuration] 1 is a diagram showing an example of the functional configuration of a risk assessment device 100 according to the first embodiment. The risk assessment device 100 according to the first embodiment includes a vulnerability information input unit 1, an individual measure acquisition unit 2, a parameter acquisition unit 3, a determination unit 4, a calculation unit 5, a target risk value input unit 6, and an output unit 7. The risk assessment device 100 according to the first embodiment also stores an implemented security measure DB 101, a mitigation measure DB 102, and a product vulnerability response DB 103. The implemented security measure DB 101, the mitigation measure DB 102, and the product vulnerability response DB 103 may be stored in a storage unit inside the risk assessment device 100, or may be stored in a server device or the like external to the risk assessment device 100.

[0012] The vulnerability information input unit 1 receives input of information about vulnerabilities to be assessed for risk, and passes the information to the determination unit 4. The vulnerability information referred to here is, for example, CVE (Common Vulnerabilities and Exposures) information provided by NVD (National Vulnerability Database) and JVN (Japan Vulnerability Notes), etc.

[0013] CVE includes a base score calculated using the basic evaluation criteria of the Common Vulnerability Scoring System (CVSS) and various parameters used to calculate the base score.

[0014] The base value is used to calculate the risk of a vulnerability along with the Common Weakness Enumeration (CWE), which indicates the software or hardware affected by the vulnerability, a description, and the type of vulnerability.

[0015] The various parameters used to calculate the base score should include the vectors defined by CVSS, i.e., Attack Vector (AV), Access Complexity (AC), etc. The following explains the case where the various parameters used to calculate the base score include the parameters specified in CVSS Version 3.

[0016] The individual measure acquisition unit 2 acquires, from the implemented security measure DB 101, security measures that have been implemented in the target system (for example, a list of security measures).

[0017] Fig. 2 is a diagram showing an example of the implemented security measures DB 101 according to the first embodiment. In the example of Fig. 2, a list of implemented security measures is stored in a tabular table including security measure names (types) and specific product names. The simplest method for the individual measure acquisition unit 2 to acquire the list of implemented security measures from the implemented security measures DB shown in the example of Fig. 2 is to automatically scan the system to be evaluated and identify the implemented measures.

[0018] 3 is a diagram illustrating an example of the mitigation measures DB 102 according to the first embodiment. The mitigation measures DB 102 according to the first embodiment includes security measure names, CWEs, and parameter conditions. In the example of FIG. 3, parameter conditions are stored for each combination of security measure names and CWEs.

[0019] 1, the parameter acquisition unit 3 acquires an environmental value calculation vector (candidates for parameter values ​​used to calculate the risk of a vulnerability) based on the names of security measures implemented and specific product names, by referring to the mitigation measures DB 102. For example, assume that the CWE assigned to the vulnerability to be assessed for risk is CWE-XX, the base value calculation vectors are AV=N (A indicates the attack source category, and N indicates the network) and C=H (C indicates the possibility of information leakage, and H indicates high), and the type of implemented security product acquired by the individual measures acquisition unit 2 is a firewall.

[0020] At this time, the parameter acquisition unit 3 refers to the mitigation measures DB in FIG. 3 and identifies that the parameter conditions are the following expressions (1) and (2).

[0021] if AV=N then MAV=L...Equation (1) if C=H or C=L then MC=N...Equation (2)

[0022] Then, the parameter acquisition unit 3 applies AV=N and C=H to equations (1) and (2) to obtain the environment value calculation vectors MAV=L and MC=L. In this way, the parameter acquisition unit 3 acquires the environment value calculation vectors for each of a plurality of security measures. For example, the parameter acquisition unit 3 may acquire the environment value calculation vectors for a firewall and an IPS (Intrusion Prevention System) as security measures. If both the Firewall and IPS are installed, MAV=L and MC=L are obtained from the firewall parameter conditions, and MAV=L and MC=L are obtained from the IPS parameter conditions.

[0023] In the above example, the parameter acquisition unit 3 acquires the environmental value calculation vector using the CWE and the product type, but some security products publish data on the vulnerabilities they address. If the parameter acquisition unit 3 can acquire the types of vulnerabilities that the security products can address for each security product installed in the system to be evaluated, the parameter acquisition unit 3 acquires candidate parameter values ​​based on the vulnerability types. For example, the parameter acquisition unit 3 may acquire the environmental value calculation vector using the product vulnerability response DB 103.

[0024] 4A is a diagram showing Example 1 of the product vulnerability response DB 103 according to the first embodiment. In Example 1 of FIG. 4A, the product vulnerability response DB 103 includes, for each vulnerability (CVE) number, whether or not each product can be addressed. For example, in the example of FIG. 4A, in an environment where a product named Product A is installed, it is possible to address the vulnerability risk of CVE-XXXXX1.

[0025] Fig. 4B is a diagram showing Example 2 of the product vulnerability response DB 103 according to the first embodiment. Example 2 in Fig. 4B includes parameter conditions for each product for each vulnerability (CVE) number.

[0026] Specifically, the parameter acquisition unit 3 can acquire parameters for calculating environmental values ​​from the mitigation measures DB 102 (Figure 3) and example 1 (Figure 4A) of the product vulnerability response DB 103 based on the product name acquired by the individual measures acquisition unit 2, or calculate parameters for calculating environmental values ​​from example 2 (Figure 4B) of the product vulnerability response DB 103.

[0027] In the former case, the parameter acquisition unit 3 first identifies the vulnerability (CVE) number to be assessed based on the product name of the security measure and Example 1 of the product vulnerability response DB 103 in Fig. 4A. Then, the parameter acquisition unit 3 acquires an environment value calculation vector from the combination of the identified vulnerability (CVE) number and the name of the security measure for the product identified by the product name, by referring to the implemented security measure DB 101 (Fig. 2).

[0028] For example, when evaluating the risk of CVE-XXXXX1 in an environment where a product named Product A is installed, in Example 1 (FIG. 4A) of the product vulnerability response DB 103, Product A is assigned an "O" mark, and it is possible to address the vulnerability risk of CVE-XXXXX1. Therefore, the parameter acquisition unit 3 refers to the mitigation measures DB 102 (FIG. 2) and acquires an environment value calculation vector from the combination of the CWE identified from CVE-XXXXX1 and the security measure name of Product A. On the other hand, when evaluating the risk of CVE-XXXXX2, since Product A is not assigned an "O" mark in Example 1 (FIG. 4A) of the product vulnerability response DB 103, the parameter acquisition unit 3 determines that it is impossible to address the risk of CVE-XXXXX2 with Product A.

[0029] Furthermore, when calculating the environmental value calculation parameters from Example 2 (FIG. 4B) of the product vulnerability response DB 103, the parameter acquisition unit 3 acquires the environmental value calculation vector by referring to the parameter conditions in the column of the intersection between the security countermeasure product name and the vulnerability (CVE) number that is the target of risk assessment. For example, when assessing the risk of CVE-XXXXX2 in an environment that uses product B, the parameter acquisition unit 3 acquires the environmental value calculation vector of the following formula (3).

[0030] MPR=H...Equation (3)

[0031] Returning to Figure 1, when the determination unit 4 receives one or more environmental value calculation vectors (group of parameters (vectors)) from the parameter acquisition unit 3, it determines an environmental value calculation vector to be used to calculate the environmental evaluation criteria specified in CVSS from the one or more environmental value calculation vectors.

[0032] The operation of the determination unit 4 of the first embodiment will be described using the example of the implemented security countermeasure DB 101 in FIG. 2, where a system has a firewall and an IPS installed. In vulnerability mitigation countermeasures when the CWE is CWE-XX and the environment value calculation vectors are C=H and AV=N, if a firewall is installed, the environment value calculation vectors become MAV=L and MC=N. On the other hand, if an IPS is installed, MAV=L and MC=L. When both are installed, the MAV for both is L, so MAV=L becomes the environment value calculation vector, but the determination of MC differs between N and L. In this case, the determination unit 4 selects the one with the lower risk. That is, in this example, the determination unit 4 determines MC=N as the environment value calculation vector.

[0033] The calculation unit 5 calculates the environmental value using the environmental value calculation vector and the environmental evaluation criteria determined by the determination unit 4. The calculation unit 5 uses the calculation method specified by CVSS, but calculates the environmental value as "unevaluated" for a vector for which an environmental value calculation vector has not been set.

[0034] Furthermore, the calculation unit 5 may further receive an input of the security requirement of the system to be evaluated, and calculate the environmental value (risk value, risk score) based on the security requirement. For example, the calculation unit 5 may receive an input of a vector (CR / AR / IR) related to the security requirement defined by CVSS, and may reflect the input of the vector (CR / AR / IR) in the calculation of the environmental value, such as calculating a higher environmental value in accordance with this input.

[0035] The target risk value input unit 6 accepts input of a target risk value (hereinafter referred to as the "target risk value"), accepts an environmental value from the calculation unit 5, compares the target risk value with the environmental value, and determines the environmental value to be output based on the comparison result.

[0036] For example, the target risk value is a numerical value input for the purpose of keeping the CVSS environmental value (risk score) below a certain level through security measures. In this case, the target risk value input unit 6 outputs environmental values ​​higher than the target risk value, allowing the user to understand the necessity of security measures for vulnerabilities according to the target risk value.

[0037] Furthermore, for example, since CVSS defines severity classifications such as emergency (risk score 9.0 to 10.0), important (risk score 7.0 to 8.9), and warning (risk score 4.0 to 6.9), a value indicating the classification may be used as the target risk value. For example, when a warning classification is input, the target risk value input unit 6 outputs environmental values ​​in classifications higher than warning (risk scores greater than 6.9).

[0038] If the target risk value input unit 6 does not receive the input of a target risk value, it may output all the environmental values ​​input from the calculation unit 5, for example.

[0039] The output unit 7 outputs output information indicating the risk of a vulnerability. For example, the output unit 7 outputs output information including the environmental value determined as the output target by the target risk value input unit 6. Specifically, the output unit outputs output information including vulnerability information related to the environmental value of the output target (for example, information including vulnerability identification information and the environmental value of the vulnerability).

[0040] The output information from the output unit 7 may be in any format. For example, the output information may be displayed on a display device, may be data in a computer-readable file format, or may be an email to a user. There are various possible formats for the output information from the output unit 7, and an appropriate format may be selected depending on the requirements.

[0041] [Example of risk assessment method] 5 is a flowchart showing an example of the risk assessment method according to the first embodiment. First, when the vulnerability information input unit 1 receives input of vulnerability information (e.g., CVE information) (step S1), the individual measure acquisition unit 2 acquires security measures that have been implemented in the system to be assessed for risk from the implemented security measure DB 101 (step S2). For example, the processing in step S2 acquires a list of security measures as shown in FIG. 2.

[0042] Next, the risk assessment device 100 calculates a vector for calculating the environmental value for each security measure. Here, a method for determining the vector using the product vulnerability response DB 103 (FIG. 4A or 4B) and the mitigation measure DB 102 (FIG. 3) will be described.

[0043] If vector acquisition has not been completed for all security countermeasures (Yes at step S3), the parameter acquisition unit 3 first determines whether or not there is information in the product vulnerability response DB 103 (step S4). Specifically, the parameter acquisition unit 3 determines whether or not a parameter condition can be acquired from the product name of the product used in the security countermeasure and the CVE number corresponding to the type of vulnerability (CWE) addressed by the security countermeasure to be processed, as in the product vulnerability response DB 103 of Fig. 4B.

[0044] If the product vulnerability response DB 103 contains information (Yes at step S4), the parameter acquisition unit 3 acquires the parameter condition from the product vulnerability response DB 103 (step S6).

[0045] If there is no information in the product vulnerability response DB 103 (No in step S4), the parameter acquisition unit 3 determines whether there is information in the mitigation measures DB 102 (step S5). Specifically, the parameter acquisition unit 3 determines whether a parameter condition can be acquired from a combination of the security measure name of the introduced product and the CWE number of the vulnerability.

[0046] If the mitigation measures DB 102 does not contain the information (step S5, No), the process returns to step S3. If the mitigation measures DB 102 contains the information (step S5, Yes), the parameter acquisition unit 3 acquires parameter conditions from the mitigation measures DB 102 (step S6).

[0047] Note that the processes in steps S4 and S5 are both processes for acquiring parameter conditions, but in the example of the flowchart in FIG. 5, the process in step S4 is not essential.

[0048] Next, the parameter acquisition unit 3 determines a vector for each security measure from the parameter conditions obtained by the process of step S6 and the CVE base value calculation vector (step S7).

[0049] When the parameter acquisition unit 3 has completed acquisition of vectors for all security measures, i.e., when there are no security measures for which vectors for environment value calculation have not yet been acquired (step S3, No), the determination unit 4 determines whether or not there are any unprocessed vectors (step S8). For example, there are multiple vectors for environment value calculation, such as MAV, MAC, MC, MI, and MA, and the determination unit 4 checks whether or not there are any unprocessed vectors among the multiple vectors.

[0050] If there are unprocessed vectors (step S8, Yes), the determination unit 4 determines the value of the vector for environment value calculation based on, for example, the value that results in the lowest risk among the values ​​of the unprocessed vectors (step S9). Note that, when making a conservative judgment, the determination unit 4 may determine the value of the vector for environment value calculation to be the value that results in the highest risk, or may determine the median value of the values ​​of the unprocessed vectors as the value of the vector for environment value calculation.

[0051] The determination unit 4 repeats the processing of step S9 for each vector, and when there are no unprocessed vectors (step S8, No), the calculation unit 5 calculates the environment value using the vector related to the security requirement level (CR / AR / IR) and the value of the vector determined by the determination unit 4 (step S10).

[0052] Next, the target risk value input unit 6 checks whether the environmental value calculated by the processing of step S10 is lower than the target risk value input by the user (step S11). If the environmental value is equal to or greater than the target risk value input by the user (step S11, No), the output unit 7 outputs output information including the environmental value (step S12). For example, the output information includes information on the CVE and the value of the environmental value.

[0053] If the environment value is lower than the target risk value input by the user (step S11, Yes), the processing ends. Note that even if the environment value is lower than the target risk value input by the user (step S11, Yes), the output unit 7 may output output information indicating that the environment value is lower than the target risk value for each CVE information.

[0054] As described above, in the risk assessment device 100 of the first embodiment, the vulnerability information input unit 1 accepts input of vulnerability information of a risk assessment target. The individual measure acquisition unit 2 acquires at least one security measure introduced into the system to be assessed. The parameter acquisition unit 3 acquires candidate values ​​of parameters used to calculate the risk of vulnerability for each security measure, based on the security measure and vulnerability information (e.g., CVE). The determination unit determines parameters to be used to calculate the risk of vulnerability from the candidate parameter values. Then, the calculation unit 5 calculates a risk value indicating the risk of vulnerability using the parameters determined by the determination unit 4.

[0055] The risk assessment device 100 of the first embodiment can calculate a risk value (for example, a CVSS v3 environmental value) based on security measures that have already been implemented with higher accuracy, allowing the user to quantitatively grasp the risk associated with the security measures that have been implemented in the system to be evaluated.

[0056] (Second embodiment) Next, a second embodiment will be described. In the description of the second embodiment, the same description as in the first embodiment will be omitted, and only the differences from the first embodiment will be described.

[0057] According to the first embodiment described above, it is possible to calculate a risk score (CVSS v3 environmental score) with high accuracy based on the security measures that have been implemented. However, since only vulnerability information and risk scores are output, it is unclear how to respond to the risk. Furthermore, the security requirements such as CR / IR / AR vary depending on how vulnerable modules are used within the system, and it is difficult for users to grasp how the modules are used. Furthermore, some security measures require devices to be installed on the network, which may be ineffective depending on the source of the attack.

[0058] In the second embodiment, in consideration of these issues, we will explain an embodiment that determines the effectiveness of countermeasures and how modules are used within the system, calculates risks with greater accuracy, and allows users to further understand appropriate countermeasures.

[0059] [Example of functional configuration] 6 is a diagram showing an example of the functional configuration of the risk assessment device 100-2 of the first embodiment. The risk assessment device 100-2 of the second embodiment includes a vulnerability information input unit 1, an individual measure acquisition unit 2, a parameter acquisition unit 3, a determination unit 4, a calculation unit 5, a target risk value input unit 6, an output unit 7, an evaluation unit 8, an adjustment unit 9, a generation unit 10, and a constraint consideration unit 11. The risk assessment device 100-2 of the second embodiment also stores an implemented security measure DB 101, a mitigation measure DB 102, a product vulnerability response DB 103, and a security measure DB 104. That is, the risk assessment device 100-2 of the second embodiment additionally includes the evaluation unit 8, the adjustment unit 9, the generation unit 10, the constraint consideration unit 11, and the security measure DB 104.

[0060] Specifically, the evaluation unit 8 first evaluates whether the security measures implemented are effective against the vulnerabilities for which vulnerability risk is determined, taking into account the system configuration. A possible method for evaluating whether the security measures are effective is, for example, to identify a possible attack source and evaluate whether the security measures are effective based on whether a device implementing the security measures is present on the path from the attack source to the system being evaluated. If the security measures are not effective, the evaluation unit 8 changes the candidate values ​​of the parameters acquired for each security measure.

[0061] Furthermore, the evaluation unit 8 may not simply determine whether a vector is effective, but may also determine that only a specific vector is effective based on the settings. For example, consider a case where a firewall is installed on a path and configured to block external-to-internal communications and allow internal-to-external communications. In the mitigation measures DB 102 of FIG. 3, the parameter conditions are MAV=L when AV=N, MC=N when C=H, or MC=N when C=L. However, since outbound communications are permitted, the installation of the firewall does not contribute to confidentiality. The evaluation unit 8 may evaluate MAV=L as shown here, but leave MC at H or L. In other words, if there is a device on the path that implements security measures, the evaluation unit 8 may further evaluate whether the security measures are effective based on the device settings. If the security measures are not effective, the evaluation unit 8 may change the candidate parameter values ​​acquired for each security measure (in the above example, change MC=N to MC=H or L).

[0062] The adjustment unit 9 adjusts the security requirement level based on the program information of the program running on the system to be evaluated and a predetermined adjustment rule. For example, the adjustment unit 9 adjusts the security requirement level vector (CR / IR / AR) input by the user using the program information and the adjustment rule.

[0063] For example, the program information includes the operation time of the program. In this case, the adjustment rule is, for example, a rule that adjusts the security requirement level depending on the operation time. Also, for example, the program information includes the usage status of a library linked to the program. In this case, the adjustment rule is, for example, a rule that adjusts the security requirement level depending on the usage status of the library. Also, for example, the program information includes information indicating whether the program performs network communication. In this case, the adjustment rule is, for example, a rule that adjusts the security requirement level depending on the presence or absence of network communication.

[0064] Fig. 7 is a diagram showing an example of an adjustment rule according to the second embodiment. For example, the adjustment unit 9 adjusts the vector (CR / IR / AR) relating to the security requirement level from the program information by referring to the adjustment rule shown in Fig. 7.

[0065] For example, if the program information includes operation history information for a process or library, the adjustment rule includes a rule that calculates the operation time rate of the process or library relative to the system operation time (for example, unit time such as one hour or one day), and lowers the CR / IR / AR value as the operation time rate decreases. Also, for example, if the program information includes whether or not a process communicates over a network, the adjustment rule includes a rule that lowers the CR / IR / AR value by one level if there is no communication over the network. Also, for example, if the program information includes link information indicating the link status of a library from a program, the adjustment rule includes a rule that lowers the CR / IR / AR value by two levels if the library is not linked from a program.

[0066] Returning to FIG. 6, the generation unit 10 refers to the security countermeasure DB 104 and generates a combination of security countermeasures that have not been introduced in the system that is the target of risk assessment.

[0067] 8 is a diagram showing an example of the security countermeasure DB 104 according to the second embodiment. For example, suppose that the security countermeasures not yet implemented in a system that is the target of risk assessment are a firewall, an IPS, and deny list execution control. In this case, the generator 10 generates seven combinations: firewall only, IPS only, deny list execution control only, firewall + IPS, firewall + deny list execution control, IPS + deny list execution control, and firewall + IPS + deny list execution control.

[0068] 6, the calculation unit 5 of the second embodiment further has a function of calculating an environment value (risk value) assuming that a combination of security measures generated by the generation unit 10 has been further introduced. As a method of calculating the environment value, as described in the first embodiment, a method may be used in which an environment value calculation vector is determined for the case in which each security measure has been introduced, and the environment value is calculated based on the environment value calculation vector.

[0069] The constraint consideration unit 11 determines whether or not constraint conditions can be satisfied when unintroduced security measures are newly introduced, and prioritizes the introduction of the security measures. For example, the constraint consideration unit 11 uses information in the security measure DB 104 to prioritize the introduction of the security measures.

[0070] For example, suppose there is a constraint that "security measures that affect network latency should not be introduced" as a constraint. The constraint consideration unit 11 refers to the security measure DB 104 in FIG. 8 and identifies that the security measure that affects network latency is a firewall. Therefore, the constraint consideration unit 11 lowers the priority of the combination of security measures that includes a firewall. Furthermore, the constraint consideration unit 11 obtains information from the target risk value input unit 6 indicating whether the target risk value will be lowered if a combination of security measures that has not yet been introduced is introduced, and finally determines the priority of the security measures. In other words, the constraint consideration unit 11 determines the security measures to be output that are lower than the target risk value and satisfy the constraint.

[0071] The output unit 7 of the second embodiment has the function of outputting a combination of security measures (one or more security measures) and their priorities obtained from the constraint consideration unit 11, in addition to the function of the output unit 7 of the first embodiment. In this case, the output unit 7 may output output information further including constraints arising from the introduction of the security measures determined by the constraint consideration unit 11, and changes in environmental values.

[0072] Fig. 9 is a flowchart showing an example of the risk assessment method of the second embodiment. The main differences from the risk assessment method of the first embodiment are three steps: the process of evaluating the effectiveness of measures (step S25-2), the process of adjusting the security requirement value (step S29-2), and the process of recommending security measures (step S31-2). The flowcharts of each process are as shown in Figs. 10 to 12.

[0073] 10 is a flowchart showing an example of the process of evaluating the effectiveness of countermeasures (step S25-2) in the second embodiment. First, the evaluation unit 8 identifies a suspected attack source (step S41). Any method may be used to identify the suspected attack source. For example, the evaluation unit 8 receives input information indicating the suspected attack source from a user, and identifies the suspected attack source from the input information.

[0074] Next, the evaluation unit 8 checks whether or not security measures are installed on the route (step S42). If security measures are installed on the route (step S42, No), the evaluation unit 8 evaluates that the security measures are effective and determines an effective vector for calculating the environment value (step S43).

[0075] On the other hand, if no security measures are installed on the path (step S42, No), the evaluation unit 8 evaluates that the security measures are ineffective (step S44). For example, if a firewall that does not block communication from the inside to the outside is installed on the path, the evaluation unit 8 evaluates that the firewall does not change the confidentiality (MC) (is ineffective).

[0076] 11 is a flowchart showing an example of the adjustment process (step S29-2) of the security requirement value in the second embodiment. First, the adjustment unit 9 accepts the input of the security requirement value (CR / IR / AR) (step S51). Note that the security requirement value (CR / IR / AR) is the same as in the first embodiment, and therefore the explanation will be omitted.

[0077] Next, the adjustment unit 9 accepts input of the above-mentioned program information (step S52). Next, the adjustment unit 9 refers to adjustment rules such as those shown in Fig. 12, for example, and determines whether or not there are any unprocessed rules (step S54). If there are any unprocessed adjustment rules (step S54, Yes), the adjustment unit 9 adjusts the CR / IR / AR input in step S51 based on the adjustment rules and the program information input by the processing of step S52 (step S55).

[0078] On the other hand, if there are no unprocessed adjustment rules (step S54, No), the adjustment unit 9 selects the smallest CR / IR / AR for each of the CR / IR / AR obtained by the processing up to step S55, and outputs the selected CR / IR / AR (step S56).

[0079] 11, the adjustment unit 9 adjusts CR / IR / AR independently for each adjustment rule and then selects the smallest CR / IR / AR, but it is not necessary to adjust CR / IR / AR independently for each adjustment rule. For example, the adjustment unit 9 may obtain adjusted values ​​of CR / IR / AR in the process of rule number 1, and then adjust (update) CR / IR / AR using the CR / IR / AR adjusted by rule number 1 in the process of rule number 2.

[0080] FIG. 12 is a flowchart showing an example of the process of recommending security measures (step S31-2) according to the second embodiment.

[0081] 13 shows the flow of recommending measures in S3. First, the generation unit 10 refers to the security measure DB 104 to acquire security measures (unimplemented measures) that have not been implemented in the system that is the target of risk assessment (step S61), and generates a combination of unimplemented measures (measure set) (step S62).

[0082] Next, the determination unit 4 determines whether or not there is a countermeasure set for which vectors have not been processed for each countermeasure set generated by the process of step S62 (step S63). If there is a countermeasure set for which vectors have not been calculated (step S63, Yes), the parameter acquisition unit 3 determines whether or not there is a countermeasure for which vectors have not been acquired among the countermeasures included in the countermeasure set for which vectors have not been calculated (step S64).

[0083] If there are measures for which vectors have not been acquired (step S64, Yes), the parameter acquisition unit 3 determines the vector for calculating the environment value for each security measure (step S65). Note that the detailed processing from step S64 to step S65 is the same as the processing from step S3 to S7 in the first embodiment.

[0084] If there are no measures for which vectors have not been acquired (step S64, No), the determination unit 4 determines the value of the vector for environment value calculation for each vector (steps S66 and S67). For example, the determination unit 4 determines the value of the vector that has the lowest risk among the vectors of one or more measures as the vector for environment value calculation.

[0085] If there is no unprocessed vector (step S66, No), the calculation unit 5 calculates the environment value using the environment value calculation vector (step S68).

[0086] Next, the target risk value input unit 6 determines whether the environmental value calculated by the processing of step S68 is lower than the target risk value (step S69). If the environmental value is lower than the target risk value (step S69, Yes), the target risk value input unit 6 determines this countermeasure set as an effective countermeasure set (step S70), and the processing returns to step S63.

[0087] On the other hand, if the risk is higher than the target risk value (step S69, No), the process returns to step S63.

[0088] The processes of steps S63 to S70 are repeated, and when there are no more countermeasure sets for which vectors have not been processed (step S63, No), the constraint consideration unit 11 prioritizes the effective countermeasure sets determined in step S70 based on the above-mentioned constraint conditions and the information in the security countermeasure DB 104 of FIG. 8 (step S71), and outputs them as recommendation results (step S72).

[0089] As described above, the risk assessment device 100-2 of the second embodiment can calculate risks with higher accuracy and recommend appropriate measures by taking into account the effectiveness of security measures and the usage (constraints) of modules within the system.

[0090] Finally, an example of the hardware configuration of the risk assessment device 100 (100-2) of the first and second embodiments will be described. The risk assessment device 100 (100-2) of the first and second embodiments can be realized, for example, by using any computer device as basic hardware.

[0091] [Example of hardware configuration] 13 is a diagram showing an example of the hardware configuration of the risk assessment device 100 (100-2) of the first and second embodiments. The risk assessment device 100 (100-2) of the first and second embodiments includes a processor 201, a main memory device 202, an auxiliary memory device 203, a display device 204, an input device 205, and a communication device 206. The processor 201, the main memory device 202, the auxiliary memory device 203, the display device 204, the input device 205, and the communication device 206 are connected via a bus 210.

[0092] The risk assessment device 100 (100-2) may not be equipped with some of the above components. For example, if the risk assessment device 100 (100-2) can use the input function and display function of an external device, the risk assessment device 100 (100-2) may not be equipped with the display device 204 and the input device 205.

[0093] The processor 201 executes a program read from the auxiliary storage device 203 to the main storage device 202. The main storage device 202 is a memory such as a ROM and a RAM. The auxiliary storage device 203 is a hard disk drive (HDD), a memory card, or the like.

[0094] The display device 204 is, for example, a liquid crystal display. The input device 205 is an interface for operating the risk assessment device 100 (100-2). The display device 204 and the input device 205 may be realized by a touch panel or the like having a display function and an input function. The communication device 206 is an interface for communicating with other devices.

[0095] For example, the program executed by the risk assessment device 100 (100-2) is provided as a computer program product in the form of an installable or executable file recorded on a computer-readable storage medium such as a memory card, hard disk, CD-RW, CD-ROM, CD-R, DVD-RAM, and DVD-R.

[0096] Furthermore, for example, the program executed by the risk assessment device 100 (100-2) may be stored on a computer connected to a network such as the Internet, and may be provided by being downloaded via the network.

[0097] Furthermore, for example, the program executed by the risk assessment device 100 (100-2) may be provided via a network such as the Internet without being downloaded. Specifically, the risk assessment process may be executed by, for example, an ASP (Application Service Provider) type cloud service.

[0098] Furthermore, for example, the program for the risk assessment device 100 (100-2) may be provided by being pre-installed in a ROM or the like.

[0099] The program executed by the risk assessment device 100 (100-2) has a modular configuration that includes functions that can be realized by the program among the above-mentioned functional configurations. As for each function, as actual hardware, the processor 201 reads the program from a storage medium and executes it, and the above-mentioned functional blocks are loaded onto the main memory device 202. In other words, the above-mentioned functional blocks are generated on the main memory device 202.

[0100] Note that some or all of the above-described functions may be realized by hardware such as an integrated circuit (IC) rather than by software.

[0101] Furthermore, each function may be realized using a plurality of processors 201, and in this case, each processor 201 may realize one of the functions, or may realize two or more of the functions.

[0102] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0103] 1 Vulnerability information input section 2. Individual Measures Acquisition Department 3 Parameter acquisition section 4 Decision Section 5 Calculation part 6 Target risk value input section 7 Output section 8 Evaluation Section 9 Adjustment part 10 Generation part 11 Constraint consideration part 100 Risk Assessment Device 101 Implemented security measures DB 102 Mitigation Measures DB 103 Product Vulnerability Response DB 104 Security Measures DB 201 processor 202 Main storage 203 Auxiliary storage device 204 Display device 205 Input Device 206 Communication Equipment 210 Bus

Claims

1. An individual measures acquisition unit that acquires at least one security measure introduced into a system to be evaluated; a parameter acquisition unit that refers to a parameter condition that determines candidate values ​​of parameters used in vulnerability risk calculation from vulnerability information of a risk assessment target for each security measure, and acquires candidate values ​​of the parameters for each security measure; a determination unit that determines parameters used in calculating the risk of a vulnerability by selecting, from among candidate values ​​of the parameters, values ​​of the parameters that result in a lower risk of the vulnerability; a calculation unit that calculates a risk value indicating a risk of vulnerability using the parameters determined by the determination unit; A risk assessment device comprising:

2. The vulnerability information is CVE (Common Vulnerabilities and Exposures). The risk assessment device according to claim 1 .

3. a target risk value input unit that receives an input of a target risk value and determines a risk value higher than the target risk value as a risk value to be output; an output unit that outputs the risk value to be output; The risk assessment device according to claim 1 or 2, further comprising:

4. When the parameter acquisition unit can acquire the type of vulnerability that can be addressed by each security product introduced into the evaluation target system, the parameter acquisition unit acquires candidate values ​​of the parameter further based on the type of vulnerability. The risk assessment device according to claim 1 or 2.

5. an evaluation unit that identifies a possible source of the attack, evaluates whether the security measures are effective based on whether a device that implements the security measures is present on a path from the attack source to the system under evaluation, and changes the candidate value acquired for each security measure if the security measures are not effective; The risk assessment device according to claim 1 or 2, further comprising:

6. the evaluation unit, when there is a device on the route that implements the security measures, further evaluates whether the security measures are effective based on the settings of the device, and when the security measures are not effective, changes the candidate values ​​acquired for each of the security measures. The risk assessment device according to claim 5 .

7. the calculation unit further receives an input of a security requirement of the evaluation target system, and calculates the risk value based on the security requirement. The risk assessment device according to claim 1 or 2.

8. an adjustment unit that adjusts the security requirement level based on program information of the program running on the evaluation target system and a predetermined adjustment rule; The risk assessment device of claim 7 further comprising:

9. the program information includes an operation time of the program; the adjustment rule is a rule for adjusting the security requirement level according to the operation time; The risk assessment device according to claim 8.

10. the program information includes a usage status of a library linked to the program; the adjustment rule is a rule for adjusting the security requirement level according to the usage situation; The risk assessment device according to claim 8.

11. the program information includes information indicating whether the program performs network communication; the adjustment rule is a rule for adjusting the security requirement level depending on whether or not the network communication is present; The risk assessment device according to claim 8.

12. a generating unit that generates a combination of security measures that have not yet been introduced into the evaluation target system, the calculation unit further calculates a risk value when the combination of security measures not yet implemented is implemented. The risk assessment device according to claim 1 or 2.

13. a constraint consideration unit that prioritizes the combination of security measures that have not yet been introduced based on constraints when the combination of security measures that have not yet been introduced is introduced; an output unit that outputs the combination of security measures not yet implemented and the priority; The risk assessment device of claim 12 further comprising:

14. A step in which a risk assessment device acquires at least one security measure introduced into a system to be assessed; the risk assessment device refers to parameter conditions that determine candidate values ​​of parameters used in calculating vulnerability risks from vulnerability information of risk assessment targets for each of the security measures, and acquires candidate values ​​of the parameters for each of the security measures; The risk assessment device determines parameters to be used in calculating the risk of the vulnerability by selecting, from the candidate values ​​of the parameters, values ​​of the parameters that result in a lower risk of the vulnerability; said risk assessment device calculating a risk value indicative of the risk of the vulnerability using the determined parameters; Risk assessment methods, including:

15. Computer, an individual measure acquisition unit that acquires at least one security measure introduced into the evaluation target system; a parameter acquisition unit that refers to a parameter condition that determines candidate values ​​of parameters used in vulnerability risk calculation from vulnerability information of a risk assessment target for each security measure, and acquires candidate values ​​of the parameters for each security measure; a determination unit that determines parameters used in calculating the risk of a vulnerability by selecting, from among candidate values ​​of the parameters, values ​​of the parameters that result in a lower risk of the vulnerability; a calculation unit that calculates a risk value indicating a risk of a vulnerability using the parameters determined by the determination unit; A program to function as a

Images