Security Risk Assessment Device

Abstract

To provide a security risk evaluating device capable of evaluating a security risk against a cyberattack more appropriately.SOLUTION: A security risk evaluating device 1 includes: a vector analyzing unit 11 for analyzing an attack vector of a cyberattack on a target system 3 from configuration information on the target system 3; a first calculating unit 12 for calculating a damage score representing the magnitude of damage inflicted on the target system 3 by a cyberattack employing the attack vector; a second calculating unit 13 for calculating a probability score representing an ease of success of the cyberattack employing the attack vector, on the basis of a length of the attack vector; and an evaluating unit 14 for evaluating a security risk of the target system 3 on the basis of the damage score calculated by the first calculating unit 12 and the probability score calculated by the second calculating unit 13.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a security risk assessment device. [Background technology]

[0002] When a risk becomes apparent, a mechanism for evaluating the risk at any time while the system is running is required to determine whether to wait for scheduled maintenance to implement countermeasures or to implement countermeasures immediately, even if it means a decrease in productivity.As a technology for evaluating cybersecurity risks at any time while the system is running, Patent Document 1 discloses a technology that uses a security sensor to detect cyberattacks and accordingly estimates and presents the damage and impact of the attack. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2002-328893 Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology disclosed in Patent Document 1, the only type of risk evaluated is the impact of damage. Therefore, there is room for improvement in terms of appropriately evaluating security risks against cyber attacks. [Means for solving the problem]

[0005] A security risk assessment device according to one aspect of the present invention includes a path analysis unit that analyzes an attack path in a cyber attack against a target system based on configuration information of the target system, and a damage score that indicates the extent of damage that a cyber attack using the attack path will cause to the target system. For each of the plurality of nodes included in the target system a first calculation unit that calculates a probability score that indicates the likelihood of a cyber attack using the attack path being successful based on the length of the attack path; For each of the plurality of nodesa damage score calculated by the first calculation unit and the probability score calculated by the second calculation unit; and using the product as a risk score representing the magnitude of the security risk of each of the plurality of nodes, and using a representative value selected from the plurality of risk scores as a risk value representing the magnitude of the security risk of the target system. and an evaluation unit that evaluates the security risk of the target system. [Effects of the Invention]

[0006] According to the present invention, it is possible to provide a security risk assessment device that can more appropriately assess security risks against cyber attacks. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram showing the configuration of a security risk assessment device according to the first embodiment. [Figure 2] FIG. 2 is a schematic diagram showing an example of the configuration of a network system. [Figure 3] FIG. 3 is a diagram showing the data structure of the damage list output by the damage analysis unit. [Figure 4] FIG. 4 is a diagram showing the data structure of the probability list output by the probability analysis unit. [Figure 5] FIG. 5 is a diagram showing the data structure of the risk list output by the risk analysis unit. [Figure 6] FIG. 6 is a diagram showing the data structure of the damage calculation table held by the damage analysis unit. [Figure 7] FIG. 7 is a diagram showing the data structure of a probability calculation table held by the probability analysis unit. [Figure 8] FIG. 8 is a schematic diagram showing the configuration of a security risk assessment device according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] (First embodiment) 1 is a schematic diagram showing the configuration of a security risk assessment device 1 according to a first embodiment. The security risk assessment device 1 assesses the security risk of a network system 3 against cyber-attacks. In other words, the network system 3 is a target system to be assessed by the security risk assessment device 1. The configuration of the network system 3 will be described in detail later.

[0009] The security risk assessment device 1 is composed of a computer equipped with processing devices such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), and DSP (Digital Signal Processor), non-volatile memory such as ROM (Read Only Memory), flash memory, and hard disk drive, volatile memory known as RAM (Random Access Memory), an input / output interface, and other peripheral circuits. These hardware components work together to run software and realize multiple functions. The security risk assessment device 1 may be composed of a single computer or multiple computers. Furthermore, processing devices such as ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array) can be used.

[0010] The nonvolatile memory stores programs capable of executing various calculations. In other words, the nonvolatile memory is a storage medium (storage device) from which the programs that realize the functions of this embodiment can be read. The volatile memory is a storage medium (storage device) that temporarily stores the results of calculations performed by the processing device and signals input from the input / output interface. The processing device is a device that loads the programs stored in the nonvolatile memory into the volatile memory and executes the calculations, and performs predetermined calculations on data taken from the input / output interface, the nonvolatile memory, and the volatile memory in accordance with the programs.

[0011] The security risk assessment device 1 comprises a model storage unit 10, a path analysis unit 11, a damage analysis unit 12, a probability analysis unit 13, and a risk analysis unit 14. Each of these units is realized in software by the processing device executing a program stored in a non-volatile memory.

[0012] The model storage unit 10 stores model information 21 that indicates the configuration of the network system 3. The model information 21 stored in the model storage unit 10 is referenced by the route analysis unit 11, the damage analysis unit 12, and the probability analysis unit 13. The model information 21 is configured in a well-known format, for example, AAS (Asset Administration Shell).

[0013] The path analysis unit 11 uses the model information 21 stored in the model storage unit 10 and, using well-known technology, analyzes the path an attacker will take on the network system 3 for each network node (hereinafter simply referred to as a node) that constitutes the network system 3 until that node is ultimately subjected to a cyber-attack. In other words, the path analysis unit 11 analyzes the attack path of a cyber-attack on the network system 3 from the configuration information of the network system 3. The path analysis unit 11 analyzes a reasonable attack path based on, for example, the positional relationship of each node in the network system 3 and the attacker's tactics and attack methods that have been assumed in advance.

[0014] The damage analysis unit 12 has a damage calculation table 25, which will be described later. The damage analysis unit 12 outputs a damage list 22 based on its own damage calculation table 25, the model information 21 stored in the model storage unit 10, and the attack path analyzed by the path analysis unit 11. The damage list 22 is a list that lists, for each node that makes up the network system 3, the quantitative value of the damage that is expected if that node is subjected to a cyber attack.

[0015] The probability analysis unit 13 has a probability calculation table 26, which will be described later. The probability analysis unit 13 outputs a probability list 23 based on its own probability calculation table 26, the model information 21 stored in the model storage unit 10, and the attack path analyzed by the path analysis unit 11. The probability list 23 is a list that lists, for each node constituting the network system 3, the probability that an attacker's operation will reach that node and ultimately result in an attack such as destructive activity, i.e., a quantitative value of the ease with which an attack can reach that node.

[0016] The risk analysis unit 14 analyzes the overall risk of a cyber-attack on the network system 3 from the damage list 22 and the probability list 23, and outputs a risk list 24. The risk list 24 is a list that lists a risk score that quantifies the overall risk of a cyber-attack for each node that makes up the network system 3, as well as a representative value that indicates the overall risk of a cyber-attack on the network system 3 as a whole.

[0017] Fig. 2 is a schematic diagram showing an example of the configuration of a network system 3. In the following explanation, security risks will be evaluated assuming a network system 3 having the configuration shown in Fig. 2. This network system 3 is installed in, for example, an automated logistics warehouse. Model information 21 stored in the model storage unit 10 is data that expresses the configuration of the network system 3 shown in Fig. 2 in a predetermined format.

[0018] The network system 3 illustrated in Figure 2 has the following nodes: a first firewall 30, an update server 31, a second firewall 32, a production planning server 33, a robot control device 34, a picking robot 35, a position measurement server 36, a position measurement sensor 37, a path planning server 38, and an automated guided vehicle 39.

[0019] The first firewall 30 is provided between the external network 4 and the network system 3. The first firewall 30 monitors communication between each node in the network system 3 and the external network 4, relays only necessary data, and blocks other data. The first firewall 30 is directly connected to an update server 31, a second firewall 32, and a production planning server 33.

[0020] The update server 31 updates software programs used by other nodes to the latest programs. The production planning server 33 provides production plans to production equipment (e.g., a production line) installed in a logistics warehouse. The second firewall 32 is installed between the first firewall 30, update server 31, and production planning server 33 on the one hand, and the robot control device 34, position measurement server 36, and path planning server 38 on the other. The second firewall 32 monitors data traveling from one side (the first firewall 30, update server 31, and production planning server 33) to the other side (the robot control device 34, position measurement server 36, and path planning server 38) on the other hand, and relays only necessary data while blocking other data.

[0021] The robot control device 34 is interconnected with the picking robot 35 and controls the picking robot 35. The picking robot 35 is a robot that, for example, picks up products traveling on a certain line or products placed in a specific box, and moves them to another line or places them in another box. The position measurement server 36 is interconnected with the position measurement sensor 37 and controls the position measurement sensor 37. The position measurement sensor 37 is a sensor that measures the position of the automated guided vehicle 39 within the logistics warehouse. The route planning server 38 is interconnected with the automated guided vehicle 39, for example, wirelessly, and controls the automated guided vehicle 39. The automated guided vehicle 39 automatically transports products loaded at a certain point to another point, for example, along a route planned by the route planning server 38.

[0022] FIG. 3 illustrates the data structure of the damage list 22 output by the damage analysis unit 12. The damage list 22 includes a damage score calculated for each node included in the network system 3. The damage score is a numerical value that quantifies the expected damage if the node is subjected to a cyberattack. In other words, the higher the damage score of a node, the greater the expected damage to the node if subjected to a cyberattack. The damage referred to here includes not only direct damage, such as the complete or partial shutdown or malfunction of the network system 3, but also the resulting loss of social trust, loss of business opportunities, and social and economic damage caused by the theft or leakage of confidential information stored in the nodes of the network system 3. In other words, the damage analysis unit 12 calculates a damage score that represents the extent of damage inflicted on the network system 3 by a cyberattack using the attack path analyzed by the path analysis unit 11. The method for calculating the damage score will be described later.

[0023] FIG. 4 is a diagram showing the data structure of the probability list 23 output by the probability analysis unit 13. The probability list 23 includes a probability score calculated for each node included in the network system 3. The probability score is a numerical value that quantifies the node's susceptibility to cyber-attacks, i.e., the probability. A node with a larger probability score indicates that it is more susceptible to cyber-attacks. The easier it is for an attacker to launch a cyber-attack, i.e., the easier it is to successfully launch a cyber-attack, the higher the probability score. Conversely, the more difficult it is for an attacker to launch a cyber-attack, and the more secure the node, the lower the probability score. In general, it can be said that the longer the attack path, the more difficult the cyber-attack, and the shorter the attack path, the easier it is. In other words, the probability analysis unit 13 calculates a probability score that represents the likelihood (success rate) of a cyber-attack using the attack path based on the length of the attack path. A method for calculating the probability score will be described later.

[0024] FIG. 5 is a diagram showing the data structure of the risk list 24 output by the risk analysis unit 14. The risk list 24 includes a risk score calculated for each node included in the network system 3. The risk score is a numerical value that quantifies the overall security risk of the node, taking into account the node's susceptibility to cyberattacks and the extent of damage that would result from a cyberattack. A node with a relatively high risk score has a greater overall risk of cyberattack than a node with a relatively low risk score. The risk score in this embodiment is the product of the damage score and the risk score. For example, if the damage score of the production planning server 33 is 4 as shown in FIG. 3 and the probability score of the production planning server 33 is 1.00 as shown in FIG. 4, the risk score of the production planning server 33 is 4 × 1.00 = 4.00 as shown in FIG. 5.

[0025] The risk list 24 further includes a risk value calculated for the entire network system 3. The risk value is a numerical value that quantifies the overall security risk related to cyberattacks for the entire network system 3. For example, when the configuration of the network system 3 is changed, if the risk value obtained by evaluating the changed network system 3 is smaller than the risk value obtained by evaluating the network system 3 before the change, the change can be considered to have reduced the risk of cyberattacks for the network system 3. In this embodiment, the risk value is the maximum value among the risk scores obtained for each node in the network system 3. For example, as shown in FIG. 5, if the maximum risk score of all nodes is 4.00, which is the risk score of the production plan server 33, the value of 4.00 is adopted as the risk value for the network system 3. In other words, the risk analysis unit 14 evaluates the security risk of the network system 3 by calculating a risk value based on the damage score calculated by the damage analysis unit 12 and the probability score calculated by the probability analysis unit 13.

[0026] Fig. 6 is a diagram showing the data structure of a damage calculation table 25 possessed by the damage analysis unit 12. The damage calculation table 25 in this embodiment is created based on "ATT&CK," a knowledge base on attacker tactics and attack methods provided by the US non-profit organization "MITRE," and in particular "ATT&CK for ICS," which is organized for OT (Operation Technology) systems. The damage calculation table 25 illustrated in Fig. 6 stores the results of analyzing the expected safety and business consequences of a damage event occurring, with all 12 "Impact" items in "ATT&CK for ICS" as damage events.

[0027] Damage calculation table 25 includes, for each node constituting network system 3, one or more damage events expected at that node. For each of these damage events, damage calculation table 25 includes: the safety consequences expected at that node if the damage event occurs; a safety score quantifying the safety consequences; the business consequences expected at that node if the damage event occurs; a business score quantifying the business consequences; and a damage event score quantifying the overall magnitude of damage based on the safety score and the business score. Damage calculation table 25 further includes, for each node constituting network system 3, a node representative score representing one or more damage event scores calculated for that node. That is, there are one or more damage events, expected safety consequences, safety scores, expected business consequences, business scores, and damage event scores per node, and there is one node representative score per node.

[0028] Damage events refer to the damage that a cyberattack against a node directly causes to that node, such as destruction of the node, inability to operate, inability to display status, shutdown, or inability to control the node. Potential safety consequences refer to the physical damage and danger caused by such damage events, such as injuries or deaths. Potential business consequences refer to the social and financial damage caused to businesses using the network system 3 by such damage events, such as costs associated with repairing and restoring equipment and lost business opportunities.

[0029] For example, if the production planning server 33 is destroyed, the production planning server 33 will no longer be able to provide production plans to production equipment (e.g., a production line, etc.). Since the production equipment will stop in this situation, the damage calculation table 25 shown in FIG. 6 indicates that the expected safety outcome for the combination of the "production planning server 33" node and the "destruction of the node" is "no human damage." On the other hand, if the production planning server 33 is destroyed, the production planning server 33 will need to be repaired or replaced by an expert. Therefore, the expected business outcome for the combination of the "production planning server 33" node and the "destruction of the node" is "repair or replacement by an expert is required." On the other hand, if the position measurement sensor 37 is destroyed by a cyberattack, the position of the automated guided vehicle 39 will no longer be able to be measured, and there is a risk that the automated guided vehicle 39 will collide with other vehicles or equipment due to inaccurate position information. Therefore, the expected safety outcome for the combination of the "position measurement sensor 37" node and the "destruction of the node" is "a collision, etc. will occur due to inaccurate position information." In addition, because there is a possibility that an accident may occur due to the automated guided vehicle 39, it is written that the expected business outcome of the combination of the damage event of the "position measurement sensor 37" node and the "destruction of the node" is that "it will take a long time to recover from the accident, etc."

[0030] In the damage calculation table 25 of this embodiment, if the expected safety result is likely to lead to a serious result such as death or serious injury, the safety score is set to 5, if it is likely to lead to a medium result such as minor injury, the safety score is set to 3, and if no personnel are injured, the safety score is set to 1. In this way, the safety score is a quantification of the expected safety result according to a certain standard. The more serious the safety result, the higher the safety score.

[0031] In the damage calculation table 25 of this embodiment, if the expected business consequences are likely to result in a serious business shutdown of one day or more, the business score is set to 3; if they are likely to result in a medium business shutdown of 10 minutes or more, the business score is set to 1; and if they are likely to result in a business shutdown of less than 10 minutes, the business score is set to 0. In this way, the business score is a quantification of the expected business consequences according to a certain standard. The more serious the business consequences, the higher the business score.

[0032] In the damage calculation table 25 of this embodiment, the damage event score is the sum of the safety score and the business score. For example, in Fig. 6, for the combination of the "production planning server 33" node and the damage event "destruction of the node", the safety score is "1" and the business score is "3". Therefore, the damage event score for this combination is 1 + 3 = 4.

[0033] In the damage calculation table 25 of this embodiment, the node representative score is set to the maximum value of all the damage event scores calculated for that node. For example, in Fig. 6, for the "production planning server 33" node, the maximum value of the damage event scores calculated for each damage event is "4". Therefore, the node representative score for the "production planning server 33" node is 4.

[0034] The damage analysis unit 12 uses the node representative score in the damage calculation table 25 as the damage score of the corresponding node. Note that nodes that are analyzed by the path analysis unit 11 as having no attack path can be excluded from the calculation of the damage score. In this case, the damage score of the excluded node can be set to 0.

[0035] The damage calculation table 25 illustrated in Figure 6 may be prepared by, for example, an evaluator of the network system 3 making a complete evaluation in advance and inputting the evaluation into the damage analysis unit 12 in advance, or the damage analysis unit 12 may automatically create the damage calculation table 25 based on data different from the damage calculation table 25.

[0036] 7 is a diagram showing the data structure of a probability calculation table 26 held by the probability analysis unit 13. The probability calculation table 26 lists, for each assumed intrusion node where an attacker is assumed to intrude, the nodes assumed to be attacked via that assumed intrusion node among the nodes constituting the network system 3. For each combination of an assumed intrusion node and a node (attack target node) assumed to be attacked from that assumed intrusion node, the probability calculation table 26 includes the number of stages in the path from the assumed intrusion node to the attack target node, a numerical value according to whether or not there is a high-resistance node on that path, and an intrusion score.

[0037] The number of stages on the path from a suspected intruder node to an attack target node is the minimum number of nodes that must be passed from the suspected intruder node, which is the origin of communication, to the attack target node, which is the destination of communication (the attack target node is also counted as one). For example, if the update server 31 is the suspected intruder node and the production planning server 33 is the attack target node, there are no other nodes between the update server 31 and the production planning server 33, so the number of stages is counted as one, as shown in FIG. 7. Also, if the update server 31 is the suspected intruder node and the position measurement sensor 37 is the attack target node, data emitted from the update server 31 passes through the second firewall 32 and the position measurement server 36 and reaches the position measurement sensor 37. Therefore, as shown in FIG. 7, the number of stages in this case is three.

[0038] The presence or absence of a highly resistant node on the path from the assumed intruder node to the target node of attack refers to whether or not there is a node on the path that is relatively more resistant to cyber attacks than other nodes, i.e., whether or not there is a node on the path that is above a certain level of difficulty in cyber attacks. In this embodiment, for example, nodes such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) are treated as highly resistant nodes. Therefore, if such a highly resistant node exists on the path from the assumed intruder node to the target node of attack, the value corresponding to "presence or absence of a highly resistant node" is set to "3." On the other hand, if no highly resistant node exists, the value corresponding to "presence or absence of a highly resistant node" is set to "0."

[0039] The intrusion score is a numerical value that quantifies the difficulty of a cyberattack from a suspected intrusion node to a target node, calculated based on the number of steps in the path from the suspected intrusion node to the target node and the presence or absence of a high-resistance node. The more difficult the cyberattack, the higher the intrusion score. In this embodiment, the intrusion score is the inverse of the sum of the numerical values ​​corresponding to the "number of steps in the path from the suspected intrusion node" and the "presence or absence of a high-resistance node." In other words, the greater the number of steps in the attack path, i.e., the longer the attack path, the lower the intrusion score. Furthermore, if a high-resistance node is present, the intrusion score will be lower than if a high-resistance node is not present. For example, in FIG. 7, if the suspected intrusion node is the "update server 31" and the target node is the "production planning server 33," the "number of steps in the path from the suspected intrusion node" is "1" and the numerical value corresponding to the "presence or absence of a high-resistance node" is "0," so the intrusion score is 1 / (1 + 0) = 1.00. On the other hand, if the expected intruder node is the "update server 31" and the target node of attack is the "location measurement sensor 37," the "number of steps in the route from the expected intruder node" is "3," and the value corresponding to the presence or absence of a high-resistance node is "3," so the intrusion score is 1 / (3+3)=0.17.

[0040] The probability analysis unit 13 uses the largest intrusion score for each attack target node in the probability calculation table 26 as the probability score for the corresponding node. In other words, the greater the number of stages in the attack path, i.e., the longer the attack path, the smaller the intrusion score and therefore the smaller the probability score. Also, if a high-resistance node exists, the intrusion score will be smaller than when a high-resistance node does not exist, and therefore the probability score will also be smaller. Note that nodes that are analyzed by the path analysis unit 11 as having no attack path can be excluded from the calculation of the probability score. In this case, the probability score of the excluded node can be set to 0.

[0041] The probability calculation table 26 illustrated in FIG. 7 may be prepared by, for example, an evaluator of the network system 3 making a series of evaluations in advance and inputting the evaluation results into the probability analysis unit 13 in advance, or the probability calculation table 26 may be automatically prepared by the probability analysis unit 13 based on data different from the probability calculation table 26.

[0042] According to the above-described first embodiment, the following advantageous effects are achieved.

[0043] (1) The damage analysis unit 12 (first calculation unit) calculates a damage score that represents the magnitude of damage that a cyber-attack using the attack path analyzed by the path analysis unit 11 will cause to the network system 3 (target system). The probability analysis unit 13 (second calculation unit) calculates a probability score that represents the likelihood of a cyber-attack using that attack path being successful, based on the length of the attack path. The risk analysis unit 14 (evaluation unit) evaluates the security risk of the network system 3 based on the damage score calculated by the damage analysis unit 12 and the probability score calculated by the probability analysis unit 13. In this way, by taking into account both the magnitude of the damage and the likelihood (the likelihood of a cyber-attack being successful), it is possible to provide a security risk assessment device 1 that can more appropriately evaluate security risks from cyber-attacks.

[0044] (2) The risk analysis unit 14 (evaluation unit) calculates the product of the damage score and the probability score, and uses the product as a risk value that represents the magnitude of the security risk of the network system 3 (target system). In this way, it is possible to quantify both the magnitude of the damage and the degree of probability (the likelihood of a cyber attack succeeding) in an easy-to-understand and natural way.

[0045] (3) The damage analysis unit 12 (first calculation unit) calculates a damage score for each of the multiple nodes included in the network system 3 (target system), and the probability analysis unit 13 (second calculation unit) calculates a probability score for each of the multiple nodes. The risk analysis unit 14 (evaluation unit) calculates the product of the damage score and the probability score calculated for each of the multiple nodes and uses this product as a risk score representing the magnitude of the security risk of each of the multiple nodes. The risk analysis unit 14 also uses a representative value selected from the multiple risk scores as the risk value of the network system 3. In this way, it is possible to handle more appropriate risk values ​​that reflect the magnitude of the risk at each node.

[0046] (4) The risk analysis unit 14 (evaluation unit) treats the maximum value selected from the multiple risk scores calculated for each of the multiple nodes as the risk value of the network system 3 (target system). Therefore, the node that is most vulnerable to cyber attacks in the network system 3 will determine the evaluation of the security risk of the entire network system 3, making it possible to make the evaluation result more reliable (more accurately represent the security risk of the network system 3).

[0047] (5) The damage analysis unit 12 (first calculation unit) calculates a damage score based on the magnitude of damage in terms of security that a cyber-attack using the attack path analyzed by the path analysis unit 11 would cause to the network system 3 (target system) and the magnitude of damage in terms of business that a cyber-attack using that attack path would cause to the network system 3. This allows for an evaluation that takes into consideration both security and business aspects without omission.

[0048] (6) When a node with high resistance to cyber-attacks exists on the attack path analyzed by the path analysis unit 11, the probability analysis unit 13 (second calculation unit) lowers the probability score compared to when no node with high resistance to cyber-attacks exists on the attack path. This makes it possible to perform an evaluation that more precisely reflects the actual likelihood of success of a cyber-attack.

[0049] (7) The probability analysis unit 13 (second calculation unit) treats firewalls, intrusion detection systems, and intrusion prevention systems as nodes that are highly resistant to cyber attacks. Therefore, the criteria for determining "nodes that are highly resistant to cyber attacks" can be presented in a form that is clear to the user.

[0050] (Second embodiment) A security risk assessment device 101 according to a second embodiment of the present invention will be described with reference to Fig. 8. Note that components that are the same as or equivalent to those described in the first embodiment will be given the same reference symbols, and differences will be mainly described.

[0051] Fig. 8 is a schematic diagram similar to Fig. 1, showing the configuration of a security risk assessment device 101 according to a second embodiment. The security risk assessment device 101 further includes a risk determination unit 15 and a risk notification unit 16 in addition to the units included in the security risk assessment device 1 according to the first embodiment.

[0052] The risk determination unit 15 refers to the risk list 24 output by the risk analysis unit 14 and determines whether the risk value of the network system 3 is higher than a predetermined threshold value. If the risk determination unit 15 determines that the risk value of the network system 3 is higher than the predetermined threshold value, the risk notification unit 16 notifies the result of the determination.

[0053] The risk notification unit 16 issues the notification by, for example, displaying a message on a display device such as an LCD display, sending an email to a predetermined destination via a communication device, or playing a message from a speaker. The display device, communication device, and speaker function as a notification device for notifying the user of the determination result of the risk assessment unit 15. Note that the risk notification unit 16 may output to the notification device not only the result of the determination by the risk assessment unit 15, but also the risk list 24, which is the analysis result by the risk analysis unit 14, as well as the damage list 22 and probability list 23 used to create the risk list 24.

[0054] The determination result by the risk determination unit 15 can be used as a basis for determining whether or not to make a change to the network system 3. For example, when a new node is added to the network system 3 or a new communication path between nodes within the network system 3, the change is promptly reflected in the model information 21. The security risk assessment device 101 is configured so that, in response to a change to the model information 21, analyses are performed by the path analysis unit 11, the damage analysis unit 12, the probability analysis unit 13, and the risk analysis unit 14. If the risk determination unit 15 makes a determination in response to a change to the model information 21 and determines that the risk value of the network system 3 is higher than a predetermined threshold, it can be determined that the change to the network system 3 is undesirable from a security perspective.

[0055] The model information 21 may be updated automatically in response to a change in the network system 3, or may be updated manually by a user based on the planned changes before actually changing the network system 3. Furthermore, the analyses by the route analysis unit 11, the damage analysis unit 12, the probability analysis unit 13, and the risk analysis unit 14 and the judgments by the risk determination unit 15 may be performed automatically in response to an update of the model information 21, or may be performed periodically regardless of an update of the model information 21.

[0056] In recent years, in the OT field, a "co-evolutionary system" that dynamically changes the system configuration has been proposed. This aims to mitigate the decline in productivity and safety that accompanies changes in the environment and conditions by flexibly changing the system configuration in response to changes in the environment and conditions.

[0057] For example, in an automated logistics warehouse, if a change occurs, such as an outside person entering the warehouse who is unfamiliar with the warehouse rules, there is a risk of a collision between the outside person and the automated guided vehicle if no measures are taken.Of course, the control of the automated guided vehicle generally includes safety measures such as detecting nearby people and slowing down the automated guided vehicle or changing its route to avoid a collision.While this can avoid safety issues such as collisions, it also comes at the cost of a significant drop in the productivity of the automated guided vehicle (in this example, the amount of goods transported per hour).

[0058] Co-evolutionary systems aim to improve this. When a change occurs, such as the entry of external personnel as mentioned above, a co-evolutionary system constantly detects the position and direction of the external personnel, predicts their future location, and corrects the route of the automated guided vehicle accordingly. Therefore, a co-evolutionary system can minimize declines in productivity by evolving in response to changes in the environment and conditions.

[0059] In order to evolve a system, it is necessary to change or update the system's hardware or software. Software updates are particularly popular because they incur little additional cost, but there is a risk of cyberattacks if the update mechanism is exploited.

[0060] This risk is generally evaluated when the system is designed and manufactured, and the system is constructed to ensure that the risk is sufficiently low. However, the environment and conditions change during the system's operation, and as the system evolves, the risk also changes, so risk assessment at the design and manufacturing stage alone is insufficient.

[0061] Furthermore, especially in OT systems, it is not always best to take measures against all existing risks. This is because availability is important in OT systems. In other words, applying security measures may require shutting down the system, which entails a significant drop in productivity. Therefore, if the security risk is small, it may be better not to take measures immediately, but to wait until a time when productivity will not be affected, such as during scheduled maintenance, before taking measures.

[0062] When a risk becomes apparent, a mechanism for evaluating the risk at any time while the system is running is required to determine whether to wait for scheduled maintenance to implement countermeasures or to implement countermeasures immediately, even if it means a decrease in productivity. The security risk assessment device 101 according to this embodiment can simultaneously quantify the probability of damage as well as the impact of the damage, and determine the necessity and timing of security countermeasures based on the overall risk that takes both into account. Furthermore, because cybersecurity risks can be evaluated at any time while the system is running, risk assessment can be performed without reducing system availability.

[0063] According to the second embodiment described above, the following advantageous effects are achieved. (1) The risk determination unit 15 (determination unit) determines whether the risk value of the network system 3 (target system) is higher than a predetermined threshold, and if it is determined that the risk value is higher than the predetermined threshold, the risk notification unit 16 (notification unit) notifies the result of the determination. This allows, for example, for the user to know in real time whether a change made to the network system 3 is appropriate from a security perspective without delay. Therefore, when an inappropriate change is made to the network system 3, the user can quickly determine whether the change is appropriate and cancel the change, restoring the system to its original state, thereby avoiding an increase in security risk. Furthermore, by updating the model information 21 based on the planned changes and making the above determination before actually making the changes to the network system 3, the user can know in advance whether the changes to the network system 3 are appropriate from a security perspective. This prevents the construction of a network system 3 that increases security risks.

[0064] The following modified examples are also within the scope of the present invention, and it is possible to combine the configuration shown in the modified example with the configuration described in the above embodiment, to combine the configurations described in the different embodiments above, or to combine the configurations described in the different modified examples below.

[0065] <Variation 1> If the network system 3 includes an intrusion detection system or an intrusion prevention system that can detect and prevent cyber-attacks not only on a single node but also on multiple nodes within the network, even if such a system does not exist on the route, the value corresponding to the "presence or absence of a high-resistance node" may be set to "3" as long as the route is capable of detecting and preventing cyber-attacks using such a system. Note that the value "3" here is just an example, and other values ​​may also be used.

[0066] <Variation 2> In the above embodiment, an example has been described in which the presence or absence of a high-resistance node is taken into consideration when calculating the probability score, but the probability score may be calculated based only on the number of stages in the attack path. However, for a more appropriate security risk assessment, it is preferable to treat at least one of a firewall, an intrusion detection system, and an intrusion prevention system as a node that is highly resistant to cyber attacks, and to take the presence or absence of a high-resistance node into consideration when calculating the probability score.

[0067] Although the embodiments of the present invention have been described above, the above embodiments merely illustrate some of the application examples of the present invention, and it is not intended that the technical scope of the present invention be limited to the specific configurations of the above embodiments. [Explanation of symbols]

[0068] 1, 101...security risk assessment device, 3...network system (target system), 10...model storage unit, 11...path analysis unit, 12...damage analysis unit (first calculation unit), 13...probability analysis unit (second calculation unit), 14...risk analysis unit (evaluation unit), 15...risk judgment unit (judgment unit), 16...risk notification unit (notification unit), 21...model information (configuration information), 22...damage list, 23...probability list, 24...risk list, 25...damage calculation table, 26...probability calculation table

Claims

1. a path analysis unit that analyzes an attack path of a cyber attack against the target system based on configuration information of the target system; a first calculation unit that calculates a damage score representing the extent of damage that a cyber-attack using the attack path will cause to the target system for each of a plurality of nodes included in the target system; a second calculation unit that calculates a probability score for each of the plurality of nodes based on the length of the attack path, the probability score representing the likelihood of a cyber attack using the attack path being successful; an evaluation unit that calculates the product of the damage score calculated by the first calculation unit and the probability score calculated by the second calculation unit, uses the product as a risk score that represents the magnitude of the security risk of each of the plurality of nodes, and evaluates the security risk of the target system by using a representative value selected from the plurality of risk scores as a risk value that represents the magnitude of the security risk of the target system; A security risk assessment device comprising:

2. 2. The security risk assessment device according to claim 1, The evaluation unit is a security risk evaluation device that treats the maximum value selected from the multiple risk scores calculated for each of the multiple nodes as the risk value of the target system.

3. 3. The security risk assessment device according to claim 2, a determination unit that determines whether the risk value of the target system is higher than a predetermined threshold value; a notification unit that notifies a result of the determination when the determination unit determines that the risk value of the target system is higher than the predetermined threshold value; The security risk assessment device further comprises:

4. 2. The security risk assessment device according to claim 1, The first calculation unit is a security risk assessment device that calculates the damage score based on the extent of security damage caused to the target system by a cyber attack using the attack path and the extent of business damage caused to the target system by a cyber attack using the attack path.

5. 2. The security risk assessment device according to claim 1, The second calculation unit is a security risk assessment device that lowers the probability score when there is a node with high resistance to cyber attacks on the attack path compared to when there is no node with high resistance to cyber attacks on the attack path.

6. 6. The security risk assessment device according to claim 5, The second calculation unit is a security risk assessment device that treats at least one of a firewall, an intrusion detection system, and an intrusion prevention system as a node that is highly resistant to cyber attacks.

Images