Security quality evaluation device, security quality evaluation system, security quality evaluation method, and security quality evaluation program

Abstract

The zone model generation unit (112) has a first axis for a countermeasure value that is an index of the number of countermeasures applied to a security threat, and a second axis for a threat value that is an index of the number of threats to be countered, and divides a space formed by the first axis and the second axis into a plurality of sections, and generates one or more zone models in which a security opinion is set for each section.The zone analysis unit (113) identifies a target countermeasure value and a target threat value based on countermeasure threat information of one or more evaluation targets, and obtains an opinion corresponding to the pair of the target countermeasure value and the target threat value from the zone model as a quality opinion for the security quality of the evaluation target.

Description

[Technical Field]

[0001] The present disclosure relates to a technique for evaluating security quality. [Background technology]

[0002] Non-Patent Document 1 discloses "quality prediction" in software development. The "zone model" is a quality prediction model for software development. The zone model is a model that classifies a space consisting of a set of multiple measurement quantities (scales) into multiple zones. For a given theme, the space is divided into multiple zones based on a viewpoint that focuses on certain characteristics. Analyzing each zone is called "zone analysis." To predict the remaining defects in software testing, a zone analysis is commonly used, where the vertical axis represents defect density and the horizontal axis represents test density. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Information-technology Promotion Agency, Software Engineering Center, "Quantitative Quality Prediction: A Practical Approach to Quality Prediction in IT System Development," IPA SEC BOOKS, Ohmsha, October 1, 2008 Summary of the Invention [Problem to be solved by the invention]

[0004] The present disclosure aims to enable the quality of security to be evaluated. [Means for solving the problem]

[0005] The security quality evaluation device of the present disclosure includes: a zone model generation unit which has a first axis for a countermeasure value which is an index of the number of countermeasures applied to a security threat, and a second axis for a threat value which is an index of the number of threats to be countered, and which divides a space formed by the first axis and the second axis into a plurality of sections, and generates one or more zone models in which a security perspective is set for each of the sections; and a zone analysis unit that identifies a target countermeasure value that is the countermeasure value of the evaluation target and a target threat value that is the threat value of the evaluation target based on countermeasure threat information including countermeasure value information for identifying countermeasure values ​​of countermeasures applied to one or more evaluation targets and threat value information for identifying threat values ​​of threats against which the evaluation targets have been countered, and obtains an opinion corresponding to the pair of the target countermeasure value and the target threat value from the zone model as a quality opinion on the quality of security of the evaluation target. [Effects of the Invention]

[0006] According to the present disclosure, a quality opinion can be obtained as an evaluation of the quality of security. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a configuration diagram of a security quality evaluation device 100 according to a first embodiment. [Figure 2] FIG. 1 is a functional configuration diagram of a security quality evaluation device 100 according to the first embodiment. [Figure 3] 3 is a flowchart of a security quality evaluation method according to the first embodiment. [Figure 4] FIG. 3 is a diagram showing an example of a zone model 122 according to the first embodiment. [Figure 5] 10 is a flowchart of step S120A in the first embodiment. [Figure 6] FIG. 10 is a diagram showing an overview of step S121A in the first embodiment. [Figure 7] FIG. 1 is a diagram showing an example of the configuration of a reference system according to the first embodiment. [Figure 8] FIG. 10 is a diagram showing an overview of step S122A according to the first embodiment. [Figure 9] FIG. 10 is a diagram showing an overview of step S123A and step S124A according to the first embodiment. [Figure 10] 10 is a flowchart of step S120B in the first embodiment. [Figure 11] FIG. 10 is a diagram showing an overview of step S122B and step S123B according to the first embodiment. [Figure 12] FIG. 10 is a diagram showing an overview of step S124B according to the first embodiment. [Figure 13] FIG. 1 is a diagram showing an example of the configuration of a target system according to the first embodiment. [Figure 14] FIG. 10 shows an example of a quality evaluation result 124 according to the first embodiment. [Figure 15] FIG. 1 is a configuration diagram of a security quality evaluation system 200A according to the first embodiment. [Figure 16] FIG. 2 is a configuration diagram of a security quality evaluation system 200B according to the first embodiment. [Figure 17] FIG. 10 is a functional configuration diagram of a security quality evaluation device 100 according to a second embodiment. [Figure 18] FIG. 10 is a configuration diagram of a security quality evaluation system 200A according to a second embodiment. [Figure 19] FIG. 10 is a configuration diagram of a security quality evaluation system 200B according to the second embodiment. [Figure 20] 10 is a flowchart of a security quality evaluation method according to the second embodiment. [Figure 21] FIG. 11 is a functional configuration diagram of a security quality evaluation device 100 according to a third embodiment. [Figure 22] FIG. 11 is a diagram showing an example of the configuration of a target system according to a third embodiment. [Figure 23] 11 is a flowchart of a security quality evaluation method according to the third embodiment. [Figure 24] FIG. 1 is a hardware configuration diagram of a security quality evaluation device 100 according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numerals. The description of elements denoted by the same reference numerals as those already described will be omitted or simplified as appropriate. Arrows in the drawings primarily indicate the flow of data or the flow of processing.

[0009] Embodiment 1 The security quality evaluation device 100 will be described with reference to FIGS.

[0010] ***Configuration Description*** The configuration of the security quality evaluation device 100 will be described with reference to FIG. The security quality evaluation device 100 is a computer comprising hardware such as a processor 101, a memory 102, an auxiliary storage device 103, a communication device 104, and an input / output interface 105. These pieces of hardware are connected to one another via signal lines.

[0011] The processor 101 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 101 is a CPU, a DSP, or a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0012] The memory 102 is a volatile or non-volatile storage device. The memory 102 is also called a primary storage device or a main memory. For example, the memory 102 is a RAM. Data stored in the memory 102 is saved in the secondary storage device 103 as needed. RAM is an abbreviation for Random Access Memory.

[0013] The auxiliary storage device 103 is a non-volatile storage device. For example, the auxiliary storage device 103 is a ROM, a HDD, a flash memory, or a combination thereof. Data stored in the auxiliary storage device 103 is loaded into the memory 102 as needed. ROM is an abbreviation for Read Only Memory. HDD is an abbreviation for Hard Disk Drive.

[0014] The communication device 104 is a receiver and a transmitter. For example, the communication device 104 is a communication chip or a NIC. The security quality evaluation device 100 communicates using the communication device 104. NIC is an abbreviation for Network Interface Card.

[0015] The input / output interface 105 is a port to which an input device and an output device are connected. For example, the input / output interface 105 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. Input and output of the security quality evaluation device 100 are performed via the input / output interface 105. USB is an abbreviation for Universal Serial Bus.

[0016] The security quality evaluation device 100 comprises elements such as an information receiving unit 111, a zone model generating unit 112, a zone analyzing unit 113, and a result output unit 114. These elements are realized by software.

[0017] The auxiliary storage device 103 stores a security quality evaluation program for causing the computer to function as an information receiving unit 111, a zone model generating unit 112, a zone analyzing unit 113, and a result output unit 114. The security quality evaluation program is loaded into the memory 102 and executed by the processor 101. The auxiliary storage device 103 also stores an OS. At least a part of the OS is loaded into the memory 102 and executed by the processor 101. The processor 101 executes the security quality evaluation program while executing the OS. OS is an abbreviation for Operating System.

[0018] The data (input data, output data, etc.) of the security quality evaluation program is stored in the storage unit 120. The memory 102 functions as the storage unit 120. However, a storage device such as the auxiliary storage device 103, a register in the processor 101, or a cache memory in the processor 101 may function as the storage unit 120 instead of or together with the memory 102.

[0019] The security quality evaluation program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0020] FIG. 2 shows the functional configuration of the security quality evaluation device 100. The operation of each element of the security quality evaluation device 100 will be described later.

[0021] ***Explanation of Operation*** The operation procedure of the security quality evaluation device 100 corresponds to a security quality evaluation method, and also corresponds to a processing procedure by a security quality evaluation program.

[0022] The security quality evaluation method will be described with reference to FIG. In step S110, the information receiving unit 111 receives the zone setting information 121.

[0023] The zone setting information 121 is received, for example, as follows. The user inputs the zone setting information 121 into the security quality evaluation device 100 . The information receiving unit 111 receives the input zone setting information 121 .

[0024] The zone setting information 121 is data indicating the configuration of the zone model 122 .

[0025] The configuration of the zone model 122 will be described with reference to FIG. The zone model 122 is a graph of data with an x-axis and a y-axis. The x-axis is the axis (first axis) for the countermeasure value, which is a value that indicates the number of countermeasures applied to a security threat. The y-axis is the axis for the threat value (second axis), which is a value that indicates the number of threats that are countered.

[0026] In the zone model 122, the space defined by the x-axis and y-axis is divided into multiple sections. 4, the space of the zone model 122 is divided into 12 sections. However, the space of the zone model 122 may be divided into fewer than 12 sections or into more than 12 sections. Furthermore, each line dividing the space of the zone model 122 may be a line that is not a straight line (for example, a curved line).

[0027] Each section of the zone model 122 has a security perspective. In FIG. 4, the following views are set for each section of the zone model 122. A cross indicates a "poor quality" rating. For example, "poor quality" means that the product has many vulnerabilities and cannot be shipped. The black triangle represents the view that there are "high residual threats." For example, "high residual threats" means that there is a high probability of an attack. The open triangle represents the view that there is a "residual threat." For example, a "residual threat" means that there is a possibility of an attack. A circle represents a "good quality" opinion, which means that most attacks have been addressed. A double circle represents a "good quality" opinion, which means that there are few possible attacks. However, each section of the zone model 122 may have a different type of view than that shown in FIG.

[0028] Returning to FIG. 3, the description continues from step S120. In step S120, the zone model generating unit 112 generates the zone model 122.

[0029] The procedure of step S120A will be described with reference to FIG. Step S120A is an example of step S120.

[0030] In step S121A, the zone model generating unit 112 generates a template of the zone model 122 based on the zone setting information 121.

[0031] Step S121A will be described in detail with reference to FIG. The zone setting information 121 indicates domain information and range information. The domain information is information for specifying the x-axis domain, which is the range of the countermeasure values. The range information is information for specifying the y-axis range, which is the range of threat values.

[0032] For example, the zone setting information 121 indicates a lower limit and an upper limit of the countermeasure value as domain information, and indicates a lower limit and an upper limit of the countermeasure value as range information. The zone setting information 121 is obtained, for example, from an analysis guideline. The upper limit of the countermeasure value is a theoretical maximum value. The upper limit of the countermeasure value is obtained, for example, from a knowledge base such as MITRE ATT&CK. MITRE ATT&CK and ATT&CK are registered trademarks. ATT&CK is an abbreviation for Adversarial Tactics, Techniques, and Common Knowledge. The zone model generation unit 112 generates a template for a graph having an x-axis domain ranging from the lower limit of the countermeasure value to the upper limit of the countermeasure value and a y-axis range ranging from the lower limit of the threat value to the upper limit of the threat value. The generated template becomes the template for the zone model 122.

[0033] For example, the zone setting information 121 indicates the configuration of the reference system, a list of measures applied to the reference system, and a list of threats against which the reference system has been protected. The reference system is a system that has already been analyzed. The scale of the reference system is the same as the expected scale of the system (target system) whose security quality is to be evaluated. The zone setting information 121 is obtained, for example, from the analysis results of the reference system.

[0034] The target system is an example of the form of the evaluation target. The evaluation target is an entity whose security quality is evaluated by the security quality evaluation method, such as a system, a product, or software.

[0035] Figure 7 shows an example of the configuration of a reference system. The ovals represent components of the reference system, such as servers, the Internet, and devices. The diamonds represent the measures applied to each component of the reference system, such as (A) authentication, (B) encryption, and (C) input restrictions. The boxes represent the threats that are countered by each component of the reference system, such as (a) unauthorized access, (b) eavesdropping, (c) tampering, (d) unauthorized operation, and (e) failure.

[0036] The template for the zone model 122 is generated as follows. First, the zone model generation unit 112 divides the number of measures applied to the reference system by the number of components of the reference system. The calculated quotient is the number (average) of measures expected to be applied per element of the target system, and is the upper limit of the measure value. The zone model generation unit 112 also divides the number of threats that have been addressed in the reference system by the number of components of the reference system. The calculated quotient is the number of threats that can be addressed (average) per component of the target system, and is the upper limit of the threat value. Then, the zone model generation unit 112 generates a template for a graph having an x-axis domain ranging from the lower limit (zero) of the countermeasure value to the upper limit of the countermeasure value, and a y-axis range ranging from the lower limit (zero) of the threat value to the upper limit of the threat value. The generated template becomes the template for the zone model 122.

[0037] Returning to FIG. 5, the description continues from step S122A. In step S122A, the zone model generating unit 112 divides the space of the zone model 122 into a grid pattern.

[0038] Step S122A will be described in detail with reference to FIG. The zone setting information 121 indicates domain range information and value range information. The domain range information indicates a plurality of ranges that make up the x-axis domain. The range information indicates multiple ranges that make up the y-axis range. The zone model generation unit 112 divides the x-axis domain into multiple ranges according to the domain range information. Furthermore, the zone model generation unit 112 divides the y-axis domain into multiple ranges according to the range range information. As a result, the space of the zone model 122 is divided into a lattice pattern. In FIG. 8, the space of the zone model 122 is divided into nine sections in a grid pattern.

[0039] Returning to FIG. 5, the description continues from step S123A. In step S123A, the zone model generating unit 112 draws a boundary line in the space of the zone model 122.

[0040] The spatial boundary of the zone model 122 will be described with reference to FIG. The boundary line is the line connecting the lower and upper limits. The lower limit point is a point corresponding to the pair of the lower limit of the x-axis domain range and the lower limit of the y-axis range range. The upper limit point is a point corresponding to the pair of the upper limit of the x-axis domain range and the upper limit of the y-axis range range. 9, the boundary line is a diagonal straight line that passes through the origin (zero), the lower limit point, and the upper limit point. However, the boundary line may be a line that is not a straight line (for example, a curved line).

[0041] Boundary lines are drawn to separate each of the sections through which they pass. 9, each of the three sections through which the boundary line passes is divided into two sections, resulting in the space of the zone model 122 being divided into 12 sections.

[0042] Returning to FIG. 5, step S124A will be described. In step S124A, the zone model generation unit 112 sets a security view for each section of the zone model 122 based on the zone setting information 121.

[0043] Step S124A will be described in detail with reference to FIG. The zone setting information 121 indicates the zone view information. The section view information is information that identifies the view set for each section of the zone model 122. The zone model generation unit 112 sets a security view for each partition of the zone model 122 according to the partition view information. This resulted in the generation of the zone model 122.

[0044] The procedure of step S120B will be described with reference to FIG. Step S120B is an example of step S120.

[0045] In step S121B, the zone model generation unit 112 generates a template of the zone model 122 based on the zone setting information 121. Step S121B is the same as step S121A.

[0046] In step S122B, the zone model generating unit 112 draws one or more division lines on the reference axis of the zone model 122.

[0047] The reference axes of the zone model 122 will be described with reference to FIG. The reference axis is one of the x-axis and the y-axis. The dividing line is a line that divides the range of values ​​on the reference axis. In Figure 11, the reference axis is the x-axis. Two dividing lines are drawn on the x-axis, which is the reference axis. As a result, the x-axis domain is divided into three ranges.

[0048] Returning to FIG. 10, the description continues from step S123B. In step S123B, the zone model generating unit 112 draws a boundary line in the space of the zone model 122 based on the zone setting information 121. The boundary line is as described in step S123A.

[0049] Step S123B will be described in detail with reference to FIG. The zone setting information 121 indicates the gradient of the boundary line. The zone model generation unit 112 draws a boundary line in the space of the zone model 122, which has a slope indicated in the zone setting information 121 and passes through the origin (zero) of the x-axis and y-axis. In Fig. 11, the diagonal line drawn from the origin (zero) with a slope is the boundary line.

[0050] Returning to Fig. 10, step S124B will be described. In step S124B, the zone model generating unit 112 draws a delimiter line for each delimiter line of the reference axis with respect to the mating axis of the zone model 122.

[0051] The mating shaft and the dividing line will be described with reference to FIG. The counter axis is the axis that is not the reference axis, either the x-axis or the y-axis. The dividing line for the counterpart axis is a line that divides the range of values ​​of the counterpart axis through the intersection of the dividing line for the reference axis and the boundary line. In Figure 12, the reference axis is the x-axis and the counterpart axis is the y-axis. For each division line on the x-axis, a division line is drawn on the y-axis that passes through the intersection of the division line on the x-axis and the boundary line. As a result, the y-axis domain is divided into three ranges. The space of the zone model 122 is then divided into 12 sections.

[0052] Returning to FIG. 10, step S125B will be described. In step S125B, the zone model generation unit 112 sets a security view for each section of the zone model 122 based on the zone setting information 121. Step S125B is the same as step S124A. This resulted in the generation of the zone model 122.

[0053] Returning to FIG. 3, the description continues from step S130. In step S130, the zone model generating unit 112 stores the zone model 122 in the storage unit 120.

[0054] Steps S140 to S160 are executed after measures against security threats are applied to the evaluation target.

[0055] In step S140, the information receiving unit 111 receives the countermeasure threat information 123.

[0056] Countermeasure threat information 123 is received, for example, as follows. The target system transmits countermeasure threat information 123 to the security quality evaluation device 100 . The information receiving unit 111 receives the transmitted countermeasure threat information 123 .

[0057] Countermeasure threat information 123 includes countermeasure value information and threat value information. The target value information is information for identifying the countermeasure value of the countermeasure applied to the evaluation target. The threat value information is information for identifying the threat value of the threat that has been addressed in the evaluation target.

[0058] In step S150, the zone analysis unit 113 performs a zone analysis using the zone model 122 and the countermeasure threat information 123.

[0059] The zonal analysis is performed as follows. First, the zone analysis unit 113 identifies a target countermeasure value and a target threat value based on the countermeasure threat information 123 . The target measure value is the measure value to be evaluated. The target threat value is the threat value of the evaluation target.

[0060] FIG. 13 shows an example of the configuration of the target system. The ovals represent components of the target system, the diamonds represent countermeasures applied to each component of the target system, the squares represent threats that occur in each component of the target system, and the crossed squares represent threats that have been countered.

[0061] An example of specifying the target countermeasure value and the target threat value will be described with reference to FIG. Countermeasure threat information 123 indicates the configuration of the target system, a list of countermeasures applied to the target system, and a list of threats that have been countered in each component of the target system. The zone analysis unit 113 divides the number of measures applied to the target system by the number of components of the target system, and the calculated quotient becomes the target measure value. In Figure 13, measure C is applied to each of the three devices, so the number of applied measures C is "3", and the number of applied measures (A to C) is "5". Also, the number of components is "5". Therefore, the target measure value is "1 (=5 / 5)". The zone analysis unit 113 divides the number of threats that have been addressed in the target system by the number of components of the target system, and the calculated quotient becomes the target threat value. In Figure 13, threat d has been addressed by each of the three devices, so the number of addressed threats d is "3," and the number of addressed threats (a to d) is "6." Also, the number of components is "5." Therefore, the target threat value is "1.2 (=6 / 5)."

[0062] The explanation of zone analysis continues. Then, the zone analysis unit 113 acquires an opinion corresponding to the pair of the target countermeasure value and the target threat value from the zone model 122 .

[0063] The view obtained from the zone model 122 is called the quality view. The quality opinion is information that indicates an opinion on the quality of the security of the evaluation target.

[0064] An example of obtaining a quality opinion will be described based on FIG. First, the zone analysis unit 113 plots points (evaluation points) corresponding to pairs of target countermeasure values ​​and target threat values ​​in the space of the zone model 122. Then, the zone analysis unit 113 acquires the opinion set in the section where the evaluation score is plotted from the zone model 122. The acquired opinion becomes the quality opinion.

[0065] A diagram showing the zone model 122 on which the evaluation points are plotted is called a zone model diagram 125.

[0066] In FIG. 14, the target countermeasure value is "1", the target threat value is "1.2", and the coordinate value of the evaluation point is (1, 1.2). The stars in the zone model diagram 125 represent the plot of the evaluation point. The view (circle) set in the section where the evaluation point is plotted is the view of "good quality". Therefore, the quality view of "good quality" is obtained.

[0067] Returning to FIG. 3, step S160 will be described. In step S160, the result output unit 114 outputs the quality evaluation result 124.

[0068] The quality evaluation result 124 shows a quality opinion and a zone model diagram 125 .

[0069] For example, the result output unit 114 displays the quality evaluation result 124 on a display.

[0070] ***Additional explanation*** The explanation of step S110 will be supplemented. For example, the zone setting information specifies the domain and range of the range of two axes. For example, the zone setting information specifies the slope of the boundary line and either the domain or range of the two axes.

[0071] The explanation of step S120A will be supplemented. Based on knowledge bases such as MITRE ATT&CK, the x-axis defines "countermeasure density" and the y-axis defines "mitigated threat density." From the range of the two axes specified in the zone setting information, lines are drawn connecting the intersections of the lower limits and upper limits to generate 12 sections. Quality ratings are set for 12 plots.

[0072] The explanation of step S121A will be supplemented. The x-axis is defined by calculating the theoretical maximum value from the total number of types of measures that can be applied to the system components. The y-axis is defined as the maximum number of threats that can be addressed from attack knowledge bases such as MITRE ATT&CK.

[0073] The explanation of steps S122A and S123A will be supplemented. For the system under evaluation, the upper and lower limits of the x-axis and y-axis are specified as zone setting information. The range of the x-axis is calculated, for example, from the total number of countermeasure types that can be applied to system components or the minimum countermeasure functions that the evaluation target should have. The range of the y-axis is determined, for example, from the range of attack techniques that are extremely difficult to counter and are likely to remain no matter how many countermeasures are taken. Lines are drawn connecting the lower limits of the x-axis and y-axis ranges and the upper limits of the x-axis and y-axis ranges to create 12 divisions.

[0074] The explanation of step S124A will be supplemented. A quality opinion is assigned to each of the 12 compartments. A two-axis model with 12 compartments and a quality opinion is used as the zone model.

[0075] The explanation of step S120B will be supplemented. A 12-zone zone model is created with boundaries defined first and either a range of countermeasure densities or a range of mitigated threat densities specified. The boundary line is the line obtained from the origin and the slope. The two lines indicating the range of the x-axis or y-axis specified in the zone setting information and the intersection of the boundary line determine the two lines (ranges) of the axis that was not specified, and 12 sections are generated. Quality ratings are set for 12 plots.

[0076] The explanation of step S121B will be supplemented. The x-axis is defined by calculating the theoretical maximum value from the total number of types of measures that can be applied to the system components. The y-axis is defined as the maximum number of threats that can be addressed from attack knowledge bases such as MITRE ATT&CK.

[0077] The explanation of steps S122B to S124B will be supplemented. For the system being evaluated, the slope of the boundary line and either the lower or upper limit of the x-axis or y-axis are specified as zone setting information. The ranges of the x-axis and y-axis are as shown above. For example, for the condition "the expected reduction in threats with one mitigation measure is 2," the slope of the boundary line is "2." The intersection of the boundary line with the x-axis or y-axis range determines the unspecified range. If an x-axis range is specified, two lines are generated that represent the x-axis range and the y-axis range, passing through the intersection of the boundary line and two lines. This creates 12 segments.

[0078] The explanation of step S125B will be supplemented. A quality opinion is assigned to each of the 12 compartments. A two-axis model with 12 compartments and a quality opinion is used as the zone model.

[0079] The explanation of step S130 will be supplemented. Based on the threat countermeasure information, an evaluation score is plotted on the zone model. The quality opinion assigned to the compartment to which the plotted point belongs is the security quality assessment.

[0080] The explanation of steps S140 to S160 will be supplemented. Information linking threats and countermeasures for the system components to be evaluated is entered. Points are plotted on the zone model with the x-axis coordinate being the total number of measures divided by the number of system components, and the y-axis coordinate being the total number of threats that have been eliminated by the measures divided by the number of system components. Note that the method of counting measures may be changed depending on the scope of the effect of the measures. The quality opinion assigned to the section to which the plotted point belongs is output as the security quality assessment.

[0081] The explanation of step S160 will be supplemented. The quality evaluation results show the results of judging whether the measures being evaluated are sufficient or not based on the quality opinions of the 12 sections.

[0082] ***Effects of the First Embodiment*** The main purpose of the first embodiment is to evaluate whether the security functions that digital products that may be subject to cyber attacks should have are sufficient against anticipated cybersecurity risks. The first embodiment makes it possible to perform zone analysis by creating a zone model for predicting security quality.

[0083] The security quality evaluation device 100 predicts remaining threats and quantifies security quality by zone analysis based on the "number of mitigation measures applied" and the "number of threats mitigated."

[0084] The first embodiment provides the following effects. (1) Conventional zone analysis for software quality cannot predict security quality. On the other hand, in the first embodiment, security quality can be determined by zone analysis in which the vertical axis represents defect density and the horizontal axis represents test density. (2) Conventional zone analysis cannot predict security quality, leading to excessive security measures. On the other hand, embodiment 1 can predict security quality, making it possible to implement the right amount of security measures. As a result, software production costs are reduced.

[0085] Step S120B provides the following effects. (3) Specifying the ranges of the x and y axes for the zone model requires advanced knowledge of security and is difficult. On the other hand, specifying trends for the x and y axes, such as "the expected reduction in threats with one mitigation measure is 2," allows you to specify either the x or y range, making it easier to create a zone model.

[0086] ***Example of Embodiment 1*** As an example of the first embodiment, a security quality evaluation system 200 will be described. The security quality evaluation system 200 is a system in which the security quality evaluation device 100 is used.

[0087] ***Explanation of the first embodiment*** The security quality evaluation system 200A will be described with reference to FIG. The security quality evaluation system 200A is the security quality evaluation system 200 in the first embodiment. The security quality evaluation system 200A includes a security quality evaluation device 100 and a security analysis system 210. The security analysis system 210 is a computer system that analyzes the security of an object to be evaluated. The security analysis system 210 comprises elements such as an information receiving unit 211 and a security analysis unit 212 . An analyst 201 inputs target configuration information into a security analysis system 210. The target configuration information is information about the configuration of the analysis target, and indicates information such as the system configuration, OS, communication protocol, and information handled. The analysis target includes software, digital products, and systems. The information receiving unit 211 receives target configuration information. The information receiving unit 211 also acquires threat countermeasure information from the threat knowledge 219. The threat countermeasure information includes information on threats posed by cyber attacks and information on countermeasures against the threats. The security analysis unit 212 performs security analysis using the target configuration information and threat countermeasure information, summarizes the threats and countermeasures against the analysis target, and outputs the analysis result. The analysis result is input to the security quality evaluation device 100 as countermeasure threat information 123. The analyst 201 inputs the zone setting information 121 into the security quality evaluation device 100 . The security quality evaluation device 100 generates a zone model using the zone setting information 121, performs a zone analysis using the zone model and countermeasure threat information 123, and outputs a quality evaluation result 124. The developer 202 refers to the quality evaluation result 124 and improves the security of the analysis target.

[0088] The security quality evaluation device 100 calculates the degree of threat reduction due to security measures based on the threats expected in the security analysis target and the measures derived by the security analysis system 210, and outputs a quality opinion based on the prediction of remaining threats.

[0089] The security quality evaluation device 100 comprises an information receiving unit 111 , a zone model generating unit 112 , a zone analyzing unit 113 , and a result output unit 114 . The zone setting information 121 specifies the upper and lower limits of the number of applicable countermeasures per component of the target system (x-axis of the zone model). The zone setting information 121 also specifies the upper and lower limits of the number of threats that can be countered assumed per component of the target system. The zone setting information 121 may specify the slope of a line passing through the origin and either the upper or lower limit of the x-axis or y-axis. The information receiving unit 111 receives the zone setting information 121 from the analyst 201. The method of receiving the information may be a UI such as a web screen, or may be by specifying parameters in an API. UI is an abbreviation for user interface. API is an abbreviation for application programming interface. First, the zone model generation unit 112 generates a template for a zone model. The zone model has the number of countermeasures for each component of the target system on the x-axis and the number of threats for which countermeasures have been taken for each component of the target system on the y-axis. Then, the zone model generation unit 112 generates an area having 12 sections and sets a quality view for each area based on the zone setting information 121. The quality view may be fixed or may be given from outside. The zone analysis unit 113 uses the countermeasure threat information 123 to calculate coordinates to be plotted on the zone model. Countermeasure threat information 123 indicates the configuration of the analysis target (information indicating the components and connections between the components), the countermeasures applied, and the threats dealt with by the countermeasures. The x-axis and y-axis coordinates are expressed as follows: x-axis coordinate = [number of measures for the entire analysis target] ÷ [number of components for the analysis target] Y-axis coordinate = [Number of threats addressed across all analyzed objects] ÷ [Number of components of analyzed objects] The zone analysis unit 113 sets the quality opinion set in the plotted area as the security quality to be analyzed. The result output unit 114 outputs a quality evaluation result 124 that indicates a quality opinion of the analysis target. The quality evaluation result 124 may be information in a report format including a plot diagram of the zone model, or may be text data or binary data that can be read by other software.

[0090] ***Explanation of the second embodiment*** The security quality evaluation system 200B will be described with reference to FIG. The security quality evaluation system 200B is the security quality evaluation system 200 in the second embodiment. The first embodiment may be incorporated into a system for automating tests, such as a CI / CD pipeline. CI is an abbreviation for continuous integration. CD is an abbreviation for continuous deployment. The security quality evaluation system 200B includes the security quality evaluation device 100 and a pipeline system 220. The pipeline system 220 is a computer system that implements the CI / CD pipeline. The pipeline system 220 includes a code commit unit 221, an automatic test unit 222, a result determination unit 224, and a configuration management DB 229. The automatic test unit 222 includes a security analysis unit 223. DB is an abbreviation for database. The configuration management DB 229 manages configuration information of a product that is made up of multiple program codes. The code commit unit 221 commits the program code to be tested. The automatic test unit 222 automatically performs testing when the program code is committed. The security analysis unit 223 performs security tests. The result determination unit 224 determines whether the test is complete. The countermeasure threat information 123 is output from the security analysis unit 223 and input to the security quality evaluation device 100. For example, the countermeasure threat information 123 is structured data expressed in a format such as JSON or XML. The zone setting information 121 is input to the security quality evaluation device 100 by an analyst 201 . The security quality evaluation device 100 generates a zone model using the zone setting information 121, performs zone analysis using the zone model and countermeasure threat information 123, and outputs a quality evaluation result 124. The quality evaluation result 124 is input to a result determination unit 224. The result determination unit 224 receives the quality evaluation result 124 and determines the completion of the security-related test by referring to the quality evaluation result 124. This automates the determination of the completion of the security-related test.

[0091] Embodiment 2 The form of evaluating the security quality of the evaluation target in time series will be described below, mainly with reference to FIGS. 17 to 20, with respect to the points that differ from the first embodiment.

[0092] ***Configuration Description*** The configuration of the security quality evaluation device 100 is the same as that in the first embodiment.

[0093] FIG. 17 shows the functional configuration of the security quality evaluation device 100. A plurality of countermeasure threat information 123 is input to the security quality evaluation device 100 .

[0094] FIG. 18 shows the functional configuration of the security quality evaluation system 200A. In the security quality evaluation system 200A, a plurality of countermeasure threat information 123 is input to the security quality evaluation device 100.

[0095] FIG. 19 shows the functional configuration of the security quality evaluation system 200B. In the security quality evaluation system 200B, a plurality of countermeasure threat information 123 is input to the security quality evaluation device 100.

[0096] ***Explanation of Operation*** The security quality evaluation method will be described with reference to FIG. Steps S210 to S230 are the same as steps S110 to S130 in the first embodiment.

[0097] Steps S240 to S260 are executed each time a new measure against a security threat is applied to the evaluation target. The countermeasure threat information 123 is generated every time a new security measure is applied to the evaluation target.

[0098] In step S240, the information receiving unit 111 receives the current countermeasure threat information 123. Step S240 is the same as step S140 in the first embodiment.

[0099] In step S250, the zone analysis unit 113 performs a zone analysis using the zone model 122 and the current countermeasure threat information 123. Step S250 is the same as step S150 in embodiment 1. However, step S250 from the second time onwards differs from step S150 in the following respects.

[0100] In step S250 from the second time onwards, the zone analysis unit 113 plots the current evaluation score on the previous zone model diagram 125. On the previous zone model diagram 125, each evaluation score from the previous time and before is plotted. As a result, a zone model diagram 125 is generated in which a plurality of evaluation points including the current evaluation point are plotted.

[0101] In step S260, the result output unit 114 outputs the quality evaluation result . Step S260 is the same as step S160 in embodiment 1. However, step S260 from the second time onwards differs from step S160 in the following respects.

[0102] In step S260 from the second time onwards, the quality evaluation result 124 indicates a plurality of quality opinions corresponding to a plurality of countermeasure threat information 123. In addition, the zone model diagram 125 plots a plurality of evaluation points corresponding to a plurality of countermeasure threat information 123.

[0103] ***Additional explanation*** The countermeasure threat information 123 input to the security quality evaluation device 100 may be divided into multiple pieces. In product development, the countermeasures implemented may change as the development progresses. In such cases, points equal to the number of countermeasure threat information 123 are plotted for a single zone model 122. The zone model diagram 125 of the quality evaluation result 124 includes a plurality of plot points relating to the post-measure information. Each plot point may be assigned information about the software version (for example, name and time), etc. This allows a time series of changes in security quality that accompany software version updates, etc. to be represented.

[0104] ***Effects of the Second Embodiment*** According to the second embodiment, it is possible to visualize changes in security quality that accompany repeated measures being taken.

[0105] Embodiment 3 In the first embodiment, the security quality evaluation of the target system is performed using one zone model. The security quality evaluation device of the present disclosure can also evaluate the security quality of the target system using multiple zone models. For example, a target system to which multiple zone models are applied is composed of multiple security areas with different quality requirements for security measures.

[0106] The third embodiment will be described with reference to FIGS. 21 to 23, focusing mainly on the differences from the first and second embodiments.

[0107] ***Configuration Description*** FIG. 21 shows the functional configuration of the security quality evaluation device 100. The configuration of the security quality evaluation device 100 is the same as that in the first embodiment. The security level information 126 is input to the security quality evaluation device 100. The security level information 126 will be described later.

[0108] FIG. 22 shows an example of the configuration of the target system. The target system is made up of multiple security areas 301. That is, the target system has multiple security areas 301. In Fig. 22, the target system is made up of four security areas (301A to 301D). The number of security areas 301 may be three or less, or may be five or more. Each security area (301A to 301D) has its own security level. The security area 301 is a network section that requires a set security level. The security area 301 is also called a security zone. The security level is the level of security quality that the devices in the security area 301 should achieve according to a system-level risk assessment. The security level is determined according to the strength of the security measures taken by the attacked party, depending on the severity of the attack. If advanced security measures are taken against attacks, the security measures are strong. Specifically, the security level of security area 301, where almost no security measures are taken, is low. The security level of security area 301 increases as more advanced security measures are taken. The security level information 126 indicates the security level set for each of the multiple security areas 301 .

[0109] The number, scope and security level of the security areas 301 are determined appropriately depending on the security quality required for the target system. The number, scope and security level of the security areas 301 may be determined in advance or may be determined dynamically in response to changes in threats to the target system.

[0110] The multiple security areas 301 are connected to one another via conduits (302A to 302C). Each device in each security area 301 communicates with each device in other security areas 301 via conduit 302 . Conduit 302 is a network boundary that connects security areas 301 to each other.

[0111] ***Explanation of Operation*** The security quality evaluation method will be described with reference to FIG. In step S310, the information receiving unit 111 receives the zone setting information 121 and the security level information 126. The security level information 126 is information indicating the quality requirements of security measures according to the security level. For example, the security level information 126 indicates information described in IEC 62443.

[0112] The zone setting information 121 and the security level information 126 are received, for example, as follows. A user inputs zone setting information 121 and security level information 126 to the security quality evaluation device 100. The information receiving unit 111 receives the input zone setting information 121 and security level information 126. The security level information 126 may be included in the zone setting information 121.

[0113] In step S320, the zone model generation unit 112 generates a zone model 122 for each security level using the security level information 126. The zone model 122 differs for each security level. The method for generating the zone model 122 for each security level is the same as the method in step S120 in the first embodiment.

[0114] In step S330, the zone model generating unit 112 stores the zone model 122 for each security level together with the security level information 126 in the storage unit 120.

[0115] In step S340, the information receiving unit 111 receives the countermeasure threat information 123. Step S340 is the same as step S140 in the first embodiment.

[0116] In step S350, the zone analysis unit 113 performs a zone analysis for each security area 301.

[0117] The zone analysis is performed for each security area 301 as follows. First, the zone analysis unit 113 selects the zone model 122 that corresponds to the security level set in the security area 301 . Then, the zone analysis unit 113 performs a zone analysis using the selected zone model 122, security level information 126, and countermeasure threat information 123. The method of the zone analysis is the same as the method in step S150 of the first embodiment. This allows a quality evaluation to be performed according to the security level. Also, for each security area 301, the quality opinion set in the section where the evaluation score is plotted in the zone model 122 is set as the security quality to be analyzed.

[0118] In step S360, the result output unit 114 outputs the quality evaluation result 124 for each security area 301.

[0119] Note that, if there are items common to the zone models in different security areas 301, the quality evaluation results 124 may be output together with the quality evaluation results of different security areas 301. For example, the quality evaluation results 124 may be displayed by overlapping a plurality of zone model diagrams 125.

[0120] ***Effects of the Third Embodiment*** According to the third embodiment, it is also possible to evaluate the security quality of a target system using multiple zone models. In other words, even if the target system has multiple security areas (i.e., network partitions) with different security levels, it is possible to evaluate the security quality. Furthermore, by outputting (displaying) the quality evaluation results for different security areas together, users can easily compare the security quality between security areas.

[0121] The configuration using a plurality of zone models explained in the third embodiment can also be applied to the security quality evaluation device 100 of the second embodiment. That is, the security quality evaluation device 100 may output a zone model diagram 125 in which a plurality of evaluation points corresponding to a plurality of countermeasure threat information 123 are plotted, together with a plurality of quality opinions corresponding to the plurality of countermeasure threat information 123.

[0122] ***Supplementary explanation of implementation form*** The hardware configuration of the security quality evaluation device 100 will be described with reference to FIG. The security quality assessment device 100 includes a processing circuit 109 . The processing circuit 109 is hardware that realizes an information receiving unit 111 , a zone model generating unit 112 , a zone analyzing unit 113 , and a result output unit 114 . The processing circuitry 109 may be dedicated hardware, or may be a processor 101 that executes a program stored in memory 102 .

[0123] When processing circuitry 109 is dedicated hardware, processing circuitry 109 may be, for example, a single circuit, a multiple circuit, a programmed processor, parallel programmed processors, an ASIC, an FPGA, or a combination thereof. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field Programmable Gate Array.

[0124] The security quality evaluation device 100 may include a plurality of processing circuits that replace the processing circuit 109 .

[0125] In the processing circuit 109, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0126] In this way, the functions of the security quality evaluation device 100 can be realized by hardware, software, firmware, or a combination of these.

[0127] Like the security quality evaluation device 100, each of the security analysis system 210 and the pipeline system 220 includes a processing circuit.

[0128] Each embodiment is an example of a preferred embodiment and is not intended to limit the technical scope of the present disclosure. Each embodiment may be implemented in part or in combination with other embodiments. Procedures described using flowcharts, etc. may be modified as appropriate.

[0129] The "part" of each element of the security quality evaluation device 100 may be read as a "process," a "step," a "circuit," or a "circuitry." [Explanation of symbols]

[0130] 100 Security quality evaluation device, 101 Processor, 102 Memory, 103 Auxiliary storage device, 104 Communication device, 105 Input / output interface, 109 Processing circuit, 111 Information reception unit, 112 Zone model generation unit, 113 Zone analysis unit, 114 Result output unit, 120 Memory unit, 121 Zone setting information, 122 Zone model, 123 Countermeasure threat information, 124 Quality evaluation result, 125 Zone model diagram, 126 Security level information, 200 Security quality evaluation system, 201 Analyst, 202 Developer, 210 Security analysis system, 211 Information reception unit, 212 Security analysis unit, 219 Threat knowledge, 220 Pipeline system, 221 Code commit unit, 222 Automatic test unit, 223 Security analysis unit, 224 Result judgment unit, 229 Configuration management DB, 301 Security Area, 302 Conduit.

Claims

1. A zone model generation unit generates one or more zone models having a first axis for the countermeasure value, which is an indicator of the number of countermeasures applied to security threats, and a second axis for the threat value, which is an indicator of the number of threats to be countered, wherein the space formed by the first axis and the second axis is divided into multiple sections, and a security perspective is set for each section. A zone analysis unit identifies the target countermeasure value, which is the countermeasure value of the target being evaluated, and the target threat value, which is the threat value of the target being evaluated, based on countermeasure threat information, which includes countermeasure value information for identifying the countermeasure value of countermeasures applied to one or more targets being evaluated, and threat value information for identifying the threat value of the threats that have been countered in the target being evaluated, and obtains an opinion from the zone model corresponding to the pair of the target countermeasure value and the target threat value as a quality opinion regarding the security quality of the target being evaluated, A security quality evaluation device equipped with the following features.

2. The zone model generation unit divides the space of the zone model into a grid by dividing the range of the countermeasure value on the first axis and the range of the threat value on the second axis into multiple ranges, and divides the space of the zone model into the multiple sections by drawing boundary lines connecting lower limit points corresponding to the pair of the lower limit of the countermeasure value on the first axis and the lower limit of the threat value on the second axis, and upper limit points corresponding to the pair of the upper limit of the countermeasure value on the first axis and the upper limit of the threat value on the second axis, and dividing each section through which the boundary lines pass. The security quality evaluation apparatus according to claim 1.

3. The zone model generation unit divides the space of the zone model into the plurality of sections by drawing one or more dividing lines to demarcate the range of values ​​of the reference axis, which is one of the first and second axes, drawing a boundary line passing through the origin of the first and second axes, and drawing dividing lines to demarcate the range of values ​​of the other axis, which is the other axis of the first and second axes that is not the reference axis, passing through the intersection of the dividing line and the boundary line for each of the dividing lines of the reference axis. The security quality evaluation apparatus according to claim 1.

4. The zone model generation unit plots evaluation points corresponding to the pair of target countermeasure value and target threat value on the zone model, and obtains the opinion set for the section where the evaluation points are plotted as the quality opinion. The security quality evaluation apparatus according to claim 1.

5. The system includes a result output unit that outputs a zone model diagram representing the zone model on which the evaluation points are plotted, along with the quality assessment. The security quality evaluation apparatus according to claim 4.

6. The zone analysis unit obtains a quality assessment by plotting evaluation points based on the target threat information for each of the multiple target threat information pieces on the zone model. The result output unit outputs the zone model diagram, in which multiple evaluation points corresponding to the multiple target threat information are plotted, along with multiple quality opinions corresponding to the multiple target threat information. The security quality evaluation apparatus according to claim 5.

7. The aforementioned evaluation target has multiple security areas, each with a set security level. The zone model generation unit generates the zone model for each security level based on the security level, The zone analysis unit selects a zone model corresponding to the security level set for each security area under evaluation, and obtains the quality opinion from the selected zone model. The security quality evaluation apparatus according to claim 1.

8. A security quality evaluation device according to any one of claims 1 to 7, A pipeline system that implements a pipeline for continuous integration and continuous deployment to output the aforementioned threat information, A security quality evaluation system equipped with the following features.

9. The aforementioned pipeline system is A code commit section for committing the program code of the test target to be evaluated, An automated testing unit that automatically performs security tests and outputs the aforementioned threat information when the aforementioned program code is committed, A result determination unit receives the quality evaluation result indicating the aforementioned quality opinion from the security quality evaluation device and determines the completion of the security-related test by referring to the quality evaluation result, Equipped with The security quality evaluation system according to claim 8.

10. A first axis for the countermeasure value, which is an indicator of the number of countermeasures applied to security threats, and a second axis for the threat value, which is an indicator of the number of threats to be countered, are generated, and the space formed by the first axis and the second axis is divided into multiple sections, and a security perspective is set for each section, thereby generating one or more zone models. Based on counter-threat information, which includes counter-value information for identifying the counter-values ​​of countermeasures applied to one or more targets for evaluation, and threat value information for identifying the threat values ​​of threats addressed in the targets for evaluation, the target counter-values, which are the counter-values ​​of the targets for evaluation, and the target threat values, which are the threat values ​​of the targets for evaluation, are identified, and an opinion corresponding to the pair of the target counter-values ​​and the target threat values ​​is obtained from the zone model as a quality opinion regarding the security quality of the targets for evaluation. Security quality evaluation methods.

11. A zone model generation process generates one or more zone models having a first axis for the countermeasure value, which is an indicator of the number of countermeasures applied to security threats, and a second axis for the threat value, which is an indicator of the number of threats to be countered, wherein the space formed by the first axis and the second axis is divided into multiple sections, and a security perspective is set for each section. A zone analysis process that identifies the target countermeasure value, which is the countermeasure value of the target being evaluated, and the target threat value, which is the threat value of the target being evaluated, based on countermeasure threat information including countermeasure value information for identifying the countermeasure value of countermeasures applied to one or more targets being evaluated, and countermeasure threat information for identifying the threat value of the threats that have been countered in the target being evaluated, and obtains an opinion from the zone model corresponding to the pair of the target countermeasure value and the target threat value as a quality opinion regarding the security quality of the target being evaluated, A security quality assessment program to run on a computer.

Images