Security quality evaluation device, security quality evaluation system, security quality evaluation method, and security quality evaluation program

Abstract

A zone model generation unit (112) has a first axis for a countermeasure value serving as an index of the number of countermeasures to be applied to security threats, and a second axis for a threat value serving as an index of the number of threats to be dealt with, and generates one or more zone models in which a space formed by the first axis and the second axis is divided into a plurality of zones and a security opinion is set for each zone. A zone analysis unit (113) identifies a target countermeasure value and a target threat value on the basis of countermeasure threat information of one or more evaluation targets, and acquires an opinion corresponding to a set of the target countermeasure value and the target threat value from the zone model as a quality opinion for the quality of security of the evaluation target.

Description

Security quality evaluation device, security quality evaluation system, security quality evaluation method, and security quality evaluation program

[0001] The present disclosure relates to a technique for evaluating security quality.

[0002] Non-Patent Document 1 discloses "quality prediction" in software development. One quality prediction model in software development is the "zone model." The zone model is a model that classifies a space consisting of a set of multiple measurement quantities (scales) into multiple zones. For a given theme, the space is divided into multiple zones based on a viewpoint that focuses on certain characteristics. Analyzing each zone is called "zone analysis." To predict remaining defects in software testing, zone analysis is commonly used, with defect density on the vertical axis and test density on the horizontal axis.

[0003] Information-technology Promotion Agency, Japan, Software Engineering Center, "Quantitative Quality Prediction: A Practical Approach to Quality Prediction in IT System Development," IPA SEC BOOKS, Ohmsha, October 1, 2008

[0004] The present disclosure aims to enable the quality of security to be evaluated.

[0005] The security quality evaluation device of the present disclosure has a first axis for a countermeasure value that is an index of the number of countermeasures applied against a security threat, and a second axis for a threat value that is an index of the number of threats against which countermeasures are applied, and comprises: a zone model generation unit that divides a space formed by the first axis and the second axis into a plurality of sections and generates one or more zone models in which a security opinion is set for each section; and a zone analysis unit that identifies a target countermeasure value that is the countermeasure value of the evaluation target and a target threat value that is the threat value of the evaluation target based on countermeasure threat information including countermeasure value information for identifying countermeasure values ​​of measures applied to one or more evaluation targets and threat value information for identifying threat values ​​of threats against which countermeasures are applied to the evaluation target, and obtains from the zone model an opinion corresponding to the pair of the target countermeasure value and the target threat value as a quality opinion on the security quality of the evaluation target.

[0006] According to the present disclosure, a quality opinion can be obtained as an evaluation of the quality of security.

[0007] FIG. 1 is a configuration diagram of a security quality evaluation device 100 according to the first embodiment. FIG. 2 is a functional configuration diagram of the security quality evaluation device 100 according to the first embodiment. FIG. 3 is a flowchart of a security quality evaluation method according to the first embodiment. FIG. 4 is a diagram showing an example of a zone model 122 according to the first embodiment. FIG. 5 is a flowchart of step S120A according to the first embodiment. FIG. 6 is a diagram showing an overview of step S121A according to the first embodiment. FIG. 7 is a diagram showing an example of the configuration of a reference system according to the first embodiment. FIG. 8 is a diagram showing an overview of step S122A according to the first embodiment. FIG. 9 is a diagram showing an overview of steps S123A and S124A according to the first embodiment. FIG. 10 is a flowchart of step S120B according to the first embodiment. FIG. 11 is a diagram showing an overview of steps S122B and S123B according to the first embodiment. FIG. 12 is a diagram showing an overview of step S124B according to the first embodiment. FIG. 12 is a diagram showing an example of the configuration of a target system according to the first embodiment. FIG. 13 is a diagram showing an example of a quality evaluation result 124 according to the first embodiment. FIG. 14 is a configuration diagram of a security quality evaluation system 200A according to the first embodiment. FIG. 15 is a configuration diagram of a security quality evaluation system 200B according to the first embodiment. FIG. 16 is a functional configuration diagram of a security quality evaluation device 100 according to the second embodiment. FIG. 1 is a configuration diagram of a security quality evaluation system 200A according to embodiment 2. FIG. 2 is a configuration diagram of a security quality evaluation system 200B according to embodiment 2. FIG. 3 is a flowchart of a security quality evaluation method according to embodiment 2. FIG. 4 is a functional configuration diagram of a security quality evaluation device 100 according to embodiment 3. FIG. 5 is a diagram showing an example of the configuration of a target system according to embodiment 3. FIG. 6 is a flowchart of a security quality evaluation method according to embodiment 3. FIG. 7 is a hardware configuration diagram of the security quality evaluation device 100 according to the embodiment.

[0008] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numerals. The description of elements denoted by the same reference numerals as those already described will be omitted or simplified as appropriate. Arrows in the drawings primarily indicate the flow of data or the flow of processing.

[0009] First Embodiment A security quality evaluation device 100 will be described with reference to FIGS.

[0010] ***Description of Configuration*** The configuration of the security quality evaluation device 100 will be described with reference to Fig. 1. The security quality evaluation device 100 is a computer equipped with hardware such as a processor 101, a memory 102, an auxiliary storage device 103, a communication device 104, and an input / output interface 105. These pieces of hardware are connected to one another via signal lines.

[0011] The processor 101 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 101 is a CPU, a DSP, or a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0012] The memory 102 is a volatile or non-volatile storage device. The memory 102 is also called a primary storage device or a main memory. For example, the memory 102 is a RAM. Data stored in the memory 102 is saved in the secondary storage device 103 as needed. RAM is an abbreviation for Random Access Memory.

[0013] The auxiliary storage device 103 is a non-volatile storage device. For example, the auxiliary storage device 103 is a ROM, a HDD, a flash memory, or a combination of these. Data stored in the auxiliary storage device 103 is loaded into the memory 102 as needed. ROM is an abbreviation for Read Only Memory. HDD is an abbreviation for Hard Disk Drive.

[0014] The communication device 104 is a receiver and a transmitter. For example, the communication device 104 is a communication chip or a NIC. The security quality evaluation device 100 communicates using the communication device 104. NIC is an abbreviation for Network Interface Card.

[0015] The input / output interface 105 is a port to which an input device and an output device are connected. For example, the input / output interface 105 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. Input and output to and from the security quality evaluation device 100 are performed via the input / output interface 105. USB is an abbreviation for Universal Serial Bus.

[0016] The security quality evaluation device 100 comprises elements such as an information receiving unit 111, a zone model generating unit 112, a zone analyzing unit 113, and a result output unit 114. These elements are realized by software.

[0017] The auxiliary storage device 103 stores a security quality evaluation program for causing the computer to function as an information receiving unit 111, a zone model generating unit 112, a zone analyzing unit 113, and a result output unit 114. The security quality evaluation program is loaded into the memory 102 and executed by the processor 101. The auxiliary storage device 103 also stores an OS. At least a portion of the OS is loaded into the memory 102 and executed by the processor 101. The processor 101 executes the security quality evaluation program while running the OS. OS is an abbreviation for Operating System.

[0018] Data (input data, output data, etc.) of the security quality evaluation program is stored in the storage unit 120. The memory 102 functions as the storage unit 120. However, a storage unit such as the auxiliary storage unit 103, a register in the processor 101, or a cache memory in the processor 101 may function as the storage unit 120 instead of or together with the memory 102.

[0019] The security quality evaluation program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0020] 2 shows the functional configuration of the security quality evaluation device 100. The operation of each element of the security quality evaluation device 100 will be described later.

[0021] ***Explanation of Operation*** The operational procedure of the security quality evaluation device 100 corresponds to a security quality evaluation method. Also, the operational procedure of the security quality evaluation device 100 corresponds to a processing procedure by a security quality evaluation program.

[0022] The security quality evaluation method will be described with reference to Fig. 3. In step S110, the information receiving unit 111 receives the zone setting information 121.

[0023] The zone setting information 121 is received, for example, as follows: A user inputs the zone setting information 121 into the security quality evaluation device 100. The information receiving unit 111 receives the input zone setting information 121.

[0024] The zone setting information 121 is data indicating the configuration of the zone model 122 .

[0025] The configuration of the zone model 122 will be described with reference to Fig. 4. The zone model 122 is graph data having an x-axis and a y-axis. The x-axis is the axis (first axis) for the countermeasure value. The countermeasure value is a value that indicates the number of countermeasures applied to a security threat. The y-axis is the axis (second axis) for the threat value. The threat value is a value that indicates the number of threats that are countered.

[0026] In the zone model 122, the space formed by the x-axis and y-axis is divided into a plurality of sections. In Fig. 4, the space of the zone model 122 is divided into 12 sections. However, the space of the zone model 122 may be divided into fewer than 12 sections or into more than 12 sections. Furthermore, each line dividing the space of the zone model 122 may be a line that is not a straight line (for example, a curved line).

[0027] A security perspective is set for each partition of the zone model 122. In FIG. 4, the following perspectives are set for each partition of the zone model 122. A cross represents the perspective of "poor quality." For example, "poor quality" means that there are many vulnerabilities and the product cannot be shipped. A black triangle represents the perspective of "many remaining threats." For example, "many remaining threats" means that there is a high possibility of an attack. A white triangle represents the perspective of "there are remaining threats." For example, "there are remaining threats" means that there is a possibility of an attack. A circle represents the perspective of "good quality." For example, "good quality" means that most attacks have been addressed. A double circle represents the perspective of "excellent quality." For example, "excellent quality" means that there are few possible attacks. However, perspectives of different types from those in FIG. 4 may be set for each partition of the zone model 122.

[0028] 3, the description will continue from step S 120. In step S 120, the zone model generating unit 112 generates a zone model 122.

[0029] The procedure of step S120A will be described with reference to Fig. 5. Step S120A is an example of step S120.

[0030] In step S121A, the zone model generating unit 112 generates a template of the zone model 122 based on the zone setting information 121 .

[0031] Step S121A will be described in detail with reference to Fig. 6. The zone setting information 121 indicates domain information and value range information. The domain information is information for specifying the x-axis domain. The x-axis domain is the range of countermeasure values. The value range information is information for specifying the y-axis range. The y-axis range is the range of threat values.

[0032] For example, the zone setting information 121 indicates the lower limit and upper limit of the countermeasure value as domain information, and indicates the lower limit and upper limit of the countermeasure value as range information. The zone setting information 121 is obtained, for example, from an analysis guideline. The upper limit of the countermeasure value is a theoretical maximum value. The upper limit of the countermeasure value is obtained, for example, from a knowledge base such as MITRE ATT&CK. MITRE ATT&CK and ATT&CK are registered trademarks. ATT&CK is an abbreviation for Adversarial Tactics, Techniques, and Common Knowledge. The zone model generation unit 112 generates a template for a graph having an x-axis domain ranging from the lower limit of the countermeasure value to the upper limit of the countermeasure value and a y-axis range ranging from the lower limit of the threat value to the upper limit of the threat value. The generated template becomes the template for the zone model 122.

[0033] For example, the zone setting information 121 indicates the configuration of a reference system, a list of countermeasures applied to the reference system, and a list of threats countered by the reference system. The reference system is a system that has already been analyzed. The scale of the reference system is the same as the expected scale of the system (target system) whose security quality is to be evaluated. The zone setting information 121 is obtained, for example, from the analysis results of the reference system.

[0034] The target system is an example of the form of an evaluation target. The evaluation target is a target whose security quality is evaluated by a security quality evaluation method. For example, the evaluation target may be a system, a product, or software.

[0035] Figure 7 shows an example of the configuration of a reference system. The ovals represent components of the reference system, such as servers, the Internet, and devices. The diamonds represent countermeasures applied to each component of the reference system, such as (A) authentication, (B) encryption, and (C) input restrictions. The squares represent threats countered by each component of the reference system, such as (a) unauthorized access, (b) eavesdropping, (c) tampering, (d) unauthorized operation, and (e) malfunction.

[0036] A template for the zone model 122 is generated as follows. First, the zone model generation unit 112 divides the number of countermeasures applied to the reference system by the number of components of the reference system. The calculated quotient is the number of countermeasures (average) assumed to be applied per element of the target system, which becomes the upper limit of the countermeasure value. The zone model generation unit 112 also divides the number of threats countered in the reference system by the number of components of the reference system. The calculated quotient is the number of threats (average) that can be countered per element of the target system, which becomes the upper limit of the threat value. The zone model generation unit 112 then generates a template for a graph whose x-axis domain ranges from the lower limit (zero) of the countermeasure value to the upper limit of the countermeasure value and whose y-axis range ranges from the lower limit (zero) of the threat value to the upper limit of the threat value. The generated template becomes the template for the zone model 122.

[0037] 5, the description will continue from step S122A. In step S122A, the zone model generating unit 112 divides the space of the zone model 122 into a lattice pattern.

[0038] Details of step S122A will be described with reference to FIG. 8. Zone setting information 121 indicates domain range information and value range range information. Domain range information indicates multiple ranges that make up the x-axis domain. Value range range information indicates multiple ranges that make up the y-axis range. Zone model generation unit 112 divides the x-axis domain into multiple ranges according to the domain range information. Furthermore, zone model generation unit 112 divides the y-axis domain into multiple ranges according to the value range range information. As a result, the space of zone model 122 is divided into a grid pattern. In FIG. 8, the space of zone model 122 is divided into nine grid-like sections.

[0039] 5, the description will continue from step S123A. In step S123A, the zone model generating unit 112 draws a boundary line in the space of the zone model 122.

[0040] The boundary line of the space of the zone model 122 will be described with reference to Fig. 9. The boundary line is a line connecting the lower limit point and the upper limit point. The lower limit point is a point corresponding to the set of the lower limit of the x-axis domain range and the lower limit of the y-axis range range. The upper limit point is a point corresponding to the set of the upper limit of the x-axis domain range and the upper limit of the y-axis range range. In Fig. 9, the boundary line is a diagonal line passing through the origin (zero), the lower limit point, and the upper limit point. However, the boundary line may be a line other than a straight line (for example, a curved line).

[0041] By drawing the boundary lines, each of the sections through which the boundary lines pass is divided into two sections. In Figure 9, each of the three sections through which the boundary lines pass is divided into two sections. As a result, the space of the zone model 122 is divided into 12 sections.

[0042] 5, step S124A will be described. In step S124A, the zone model generation unit 112 sets a security view for each partition of the zone model 122 based on the zone setting information 121.

[0043] Details of step S124A will be described with reference to Fig. 9. The zone setting information 121 indicates partition opinion information. The partition opinion information is information that specifies the opinion set for each partition of the zone model 122. The zone model generation unit 112 sets a security opinion for each partition of the zone model 122 in accordance with the partition opinion information. In this way, the zone model 122 is generated.

[0044] The procedure of step S120B will be described with reference to Fig. 10. Step S120B is an example of step S120.

[0045] In step S121B, the zone model generating unit 112 generates a template of the zone model 122 based on the zone setting information 121. Step S121B is the same as step S121A.

[0046] In step S122B, the zone model generating unit 112 draws one or more division lines on the reference axis of the zone model 122.

[0047] The reference axis of the zone model 122 will be described with reference to Fig. 11. The reference axis is one of the x-axis and y-axis. A dividing line is a line that divides the range of values ​​of the reference axis. In Fig. 11, the reference axis is the x-axis. Two dividing lines are drawn on the x-axis, which is the reference axis. As a result, the x-axis domain is divided into three ranges.

[0048] 10, the description will continue from step S123B. In step S123B, the zone model generation unit 112 draws a boundary line in the space of the zone model 122 based on the zone setting information 121. The boundary line is as described in step S123A.

[0049] Details of step S123B will be described with reference to Fig. 11. The zone setting information 121 indicates the gradient of the boundary line. The zone model generation unit 112 draws a boundary line in the space of the zone model 122, the boundary line having the gradient indicated in the zone setting information 121 and passing through the origin (zero) of the x-axis and y-axis. In Fig. 11, the diagonal line drawn with a gradient from the origin (zero) is the boundary line.

[0050] Returning to Fig. 10, step S124B will be described. In step S124B, the zone model generating unit 112 draws a delimiter line for each delimiter line of the reference axis with respect to the mating axis of the zone model 122.

[0051] The counter axis and the delimiter lines will be explained based on FIG. 12. The counter axis is the axis of the x-axis or y-axis that is not the reference axis. The delimiter line for the counter axis is a line that passes through the intersection of the delimiter line for the reference axis and the boundary line and separates the range of values ​​for the counter axis. In FIG. 12, the reference axis is the x-axis and the counter axis is the y-axis. For each delimiter line for the x-axis, a delimiter line is drawn for the y-axis that passes through the intersection of the delimiter line for the x-axis and the boundary line. As a result, the y-axis domain is separated into three ranges. The space of the zone model 122 is then divided into 12 sections.

[0052] Returning to Fig. 10, step S125B will be described. In step S125B, the zone model generation unit 112 sets a security view for each partition of the zone model 122 based on the zone setting information 121. Step S125B is the same as step S124A. As a result, the zone model 122 is generated.

[0053] 3, the description will continue from step S 130. In step S 130, the zone model generating unit 112 stores the zone model 122 in the storage unit 120.

[0054] Steps S140 to S160 are executed after measures against security threats are applied to the evaluation target.

[0055] In step S140 , the information receiving unit 111 receives the countermeasure threat information 123 .

[0056] The countermeasured threat information 123 is received, for example, as follows: The target system transmits the countermeasured threat information 123 to the security quality evaluation device 100. The information receiving unit 111 receives the transmitted countermeasured threat information 123.

[0057] The countermeasure threat information 123 includes countermeasure value information and threat value information. The target value information is information for specifying the countermeasure value of the countermeasure applied to the evaluation target. The threat value information is information for specifying the threat value of the threat that has been countered in the evaluation target.

[0058] In step S150, the zone analysis unit 113 performs a zone analysis using the zone model 122 and the countermeasure threat information 123.

[0059] The zone analysis is performed as follows: First, the zone analysis unit 113 identifies a target countermeasure value and a target threat value based on the countermeasure threat information 123. The target countermeasure value is the countermeasure value of the evaluation target. The target threat value is the threat value of the evaluation target.

[0060] Figure 13 shows an example of the configuration of a target system. The ovals represent components of the target system, the diamonds represent countermeasures applied to each component of the target system, and the squares represent threats that occur in each component of the target system. Also, the squares marked with a cross represent threats that have been countered.

[0061] An example of specifying the target countermeasure value and the target threat value will be described with reference to FIG. 13 . The countermeasure threat information 123 indicates the configuration of the target system, a list of countermeasures applied to the target system, and a list of threats countered in each component of the target system. The zone analysis unit 113 divides the number of countermeasures applied to the target system by the number of components of the target system. The calculated quotient is the target countermeasure value. In FIG. 13 , countermeasure C is applied to each of three devices, so the number of applied countermeasures C is "3," and the number of applied countermeasures (A to C) is "5." The number of components is also "5." Therefore, the target countermeasure value is "1 (=5 / 5)." The zone analysis unit 113 divides the number of threats countered in the target system by the number of components of the target system. The calculated quotient is the target threat value. In FIG. 13 , countermeasures are applied to each of three devices, so the number of countermeasured threats d is "3," and the number of countermeasured threats (a to d) is "6." The number of components is also "5." Therefore, the target threat value is "1.2 (=6 / 5)".

[0062] Continuing with the explanation of the zone analysis, the zone analysis unit 113 then obtains from the zone model 122 an opinion corresponding to the pair of the target countermeasure value and the target threat value.

[0063] The view obtained from the zone model 122 is called a quality view. The quality view is information that indicates a view on the quality of the security of the evaluation target.

[0064] An example of obtaining a quality opinion will be described with reference to Fig. 14. First, the zone analysis unit 113 plots points (evaluation points) corresponding to pairs of target countermeasure values ​​and target threat values ​​in the space of the zone model 122. Then, the zone analysis unit 113 obtains, from the zone model 122, the opinions set in the sections where the evaluation points are plotted. The obtained opinions become quality opinions.

[0065] A diagram showing the zone model 122 on which the evaluation points are plotted is called a zone model diagram 125 .

[0066] In FIG. 14 , the target countermeasure value is "1", the target threat value is "1.2", and the coordinate value of the evaluation point is (1, 1.2). The stars in the zone model diagram 125 represent the plot of the evaluation point. The view (circle) set in the section where the evaluation point is plotted is the view of "good quality". Therefore, the quality view of "good quality" is acquired.

[0067] 3, step S160 will be described. In step S160, the result output unit 114 outputs the quality evaluation result 124.

[0068] The quality evaluation result 124 shows a quality opinion and a zone model diagram 125 .

[0069] For example, the result output unit 114 displays the quality evaluation result 124 on a display.

[0070] *** Supplementary Explanation *** Supplementary explanation of step S110. For example, the zone setting information specifies the domain and range of the two-axis range. For example, the zone setting information specifies the slope of the boundary line and either the domain or range of the two axes.

[0071] The explanation of step S120A will be supplemented. Based on a knowledge base such as MITRE ATT&CK, the "countermeasure density" is defined on the x-axis, and the "density of mitigated threats" is defined on the y-axis. From the ranges of the two axes specified by the zone setting information, lines are drawn connecting the intersections of the lower limits and the upper limits to generate 12 zones. Quality opinions are set for the 12 zones.

[0072] The explanation of step S121A is supplemented as follows: The x-axis is defined by calculating the theoretical maximum value from the total number of countermeasure types that can be applied to the system components. The y-axis is defined by defining the maximum number of threats that can be countered from an attack knowledge base such as MITRE ATT&CK.

[0073] The explanation of steps S122A and S123A will be supplemented. For the system to be evaluated, the lower and upper limits of the x-axis and y-axis are specified as zone setting information. The range of the x-axis is calculated, for example, from the total number of countermeasure types that can be applied to the system components or the minimum countermeasure functions that the evaluation target should have. The range of the y-axis is determined, for example, from the range of the number of attack techniques that are very difficult to counter and are likely to remain no matter how many countermeasures are taken. Straight lines are drawn connecting the lower limits of the ranges of the x-axis and y-axis and the upper limits of the ranges of the x-axis and y-axis, and 12 zones are created.

[0074] Further explanation of step S124A: Quality views are assigned to the 12 sections. A two-axis model with 12 sections and quality views is used as the zone model.

[0075] A supplementary explanation of step S120B follows. A boundary line is defined first, and then either the range of countermeasure density or the range of mitigated threat density is specified, creating a zone model with 12 compartments. The boundary line is a straight line obtained from the origin and the slope. Two lines indicating the range of the x-axis or y-axis specified in the zone setting information are determined from the intersection of the boundary line and two lines (ranges) on the unspecified axis, generating the 12 compartments. A quality opinion is set for the 12 compartments.

[0076] The explanation of step S121B is supplemented as follows: The x-axis is defined by calculating the theoretical maximum value from the total number of countermeasure types that can be applied to the system components. The y-axis is defined by defining the maximum number of threats that can be countered from an attack knowledge base such as MITRE ATT&CK.

[0077] The following is a supplementary explanation of steps S122B to S124B. For the system to be evaluated, the slope of the boundary line and either the lower or upper limit of the x-axis or y-axis are specified as zone setting information. The ranges of the x-axis and y-axis are as described above. For example, for the condition "the expected reduction in threats with one mitigation measure is 2," the slope of the boundary line is "2." The unspecified range is determined from the intersection of the boundary line and the x-axis or y-axis range. When the x-axis range is specified, two lines are generated that pass through the intersection of the boundary line and two lines indicating the x-axis range with respect to the y-axis range. This creates 12 zones.

[0078] Supplementary explanation of step S125B: Quality views are assigned to the 12 sections. A two-axis model with 12 sections and quality views is used as a zone model.

[0079] The explanation of step S130 will be supplemented. Evaluation points are plotted in the zone model based on the threat countermeasure information. The quality opinion assigned to the section to which the plotted point belongs becomes the evaluation of the security quality.

[0080] The explanation of steps S140 to S160 will be supplemented. Information linking threats and countermeasures for the system components to be evaluated is input. Points are plotted in the zone model, with the total number of countermeasures divided by the number of system components as the x-axis coordinate and the total number of threats that have been eliminated by the countermeasures divided by the number of system components as the y-axis coordinate. Note that the method of counting countermeasures may be changed depending on the range of effectiveness of the countermeasures. A quality opinion assigned to the section to which the plotted point belongs is output as the evaluation of security quality.

[0081] The explanation of step S160 will be supplemented below. The quality evaluation result indicates the result of judging whether the measures to be evaluated are sufficient or not from the quality opinions of the 12 sections.

[0082] ***Effects of First Embodiment*** The main purpose of the first embodiment is to evaluate whether the security functions that digital products that may be subject to cyber-attacks should have are sufficient against anticipated cybersecurity risks. The first embodiment makes it possible to perform zone analysis by creating a zone model for predicting security quality.

[0083] The security quality evaluation device 100 predicts remaining threats through zone analysis based on the "number of mitigation measures applied" and the "number of threats mitigated," and quantifies the security quality.

[0084] The first embodiment provides the following effects: (1) Conventional zone analysis for software quality cannot predict security quality. On the other hand, in the first embodiment, security quality can be determined by zone analysis in which the vertical axis represents defect density and the horizontal axis represents test density. (2) Conventional zone analysis cannot predict security quality, which leads to excessive security measures. On the other hand, in the first embodiment, security quality can be predicted, which makes it possible to implement measures neither excessive nor insufficient. As a result, software production costs are reduced.

[0085] Step S120B provides the following advantages: (3) Specifying the ranges of the x and y axes for a zone model requires advanced knowledge of security and is difficult. On the other hand, by specifying a trend for the x and y axes, such as "the expected reduction in threats with one mitigation measure is 2," it is possible to specify the ranges of either the x or y axes, which simplifies the creation of a zone model.

[0086] ***Example of First Embodiment*** As an example of the first embodiment, a security quality evaluation system 200 will be described. The security quality evaluation system 200 is a system in which the security quality evaluation device 100 is used.

[0087] ***Description of First Embodiment*** A security quality evaluation system 200A will be described with reference to FIG. 15 . The security quality evaluation system 200A is the security quality evaluation system 200 in the first embodiment. The security quality evaluation system 200A includes a security quality evaluation device 100 and a security analysis system 210. The security analysis system 210 is a computer system that analyzes the security of an evaluation target. The security analysis system 210 includes elements such as an information receiving unit 211 and a security analysis unit 212. An analyst 201 inputs target configuration information to the security analysis system 210. The target configuration information is information about the configuration of the analysis target, and indicates information such as the system configuration, OS, communication protocol, and information handled. Analysis targets include software, digital products, and systems. The information receiving unit 211 receives the target configuration information. The information receiving unit 211 also acquires threat countermeasure information from threat knowledge 219. The threat countermeasure information includes information about threats posed by cyber-attacks and information about countermeasures against the threats. The security analysis unit 212 performs security analysis using the target configuration information and threat countermeasure information, and outputs the analysis result by summarizing the threats and countermeasures against the analysis target. The analysis result is input to the security quality evaluation device 100 as countermeasure threat information 123. An analyst 201 inputs zone setting information 121 to the security quality evaluation device 100. The security quality evaluation device 100 generates a zone model using the zone setting information 121, performs zone analysis using the zone model and countermeasure threat information 123, and outputs a quality evaluation result 124. A developer 202 refers to the quality evaluation result 124 and improves the security of the analysis target.

[0088] The security quality evaluation device 100 calculates the degree of threat reduction due to security measures based on the threats expected in the security analysis target and the measures derived by the security analysis system 210, and outputs a quality opinion based on a prediction of remaining threats.

[0089] The security quality evaluation device 100 includes an information receiving unit 111, a zone model generating unit 112, a zone analysis unit 113, and a result output unit 114. The zone setting information 121 specifies the upper and lower limits of the number of applicable countermeasures per component of the target system (the x-axis of the zone model). The zone setting information 121 also specifies the upper and lower limits of the number of countermeasureable threats expected per component of the target system. The zone setting information 121 may also specify the slope of a line passing through the origin and either the upper or lower limit of the x-axis or y-axis. The information receiving unit 111 receives the zone setting information 121 from the analyst 201. The information may be received via a UI such as a web screen, or by specifying parameters via an API. UI is an abbreviation for user interface. API is an abbreviation for application programming interface. First, the zone model generating unit 112 generates a template for the zone model. The zone model has the number of countermeasures for each component of the target system on the x-axis and the number of threats countered per component of the target system on the y-axis. The zone model generation unit 112 generates 12 areas based on the zone setting information 121 and sets a quality assessment for each area. The quality assessment may be fixed or provided externally. The zone analysis unit 113 uses the countermeasure threat information 123 to calculate coordinates to be plotted on the zone model. The countermeasure threat information 123 indicates the configuration of the analysis target (information representing the components and connections between them), the applied countermeasures, and the threats addressed by the countermeasures. The x-axis and y-axis coordinates are expressed as follows: x-axis coordinate = [number of countermeasures for the entire analysis target] ÷ [number of components of the analysis target] y-axis coordinate = [number of threats countered for the entire analysis target] ÷ [number of components of the analysis target] The zone analysis unit 113 sets the quality assessment set in the plotted area as the security quality of the analysis target. The result output unit 114 outputs a quality evaluation result 124 indicating the quality assessment of the analysis target. The quality evaluation result 124 may be information in the form of a report including a plot of the zone model, or may be text data or binary data that can be read by other software.

[0090] ***Description of Second Example*** A security quality evaluation system 200B will be described with reference to FIG. 16. The security quality evaluation system 200B is the security quality evaluation system 200 in the second example. The first embodiment may be incorporated into a system for automating testing, such as a CI / CD pipeline. CI is an abbreviation for continuous integration. CD is an abbreviation for continuous deployment. The security quality evaluation system 200B includes a security quality evaluation device 100 and a pipeline system 220. The pipeline system 220 is a computer system that implements the CI / CD pipeline. The pipeline system 220 includes a code commit unit 221, an automatic test unit 222, a result determination unit 224, and a configuration management DB 229. The automatic test unit 222 includes a security analysis unit 223. DB is an abbreviation for database. The configuration management DB 229 manages configuration information of a product composed of multiple program codes. The code commit unit 221 commits the program code to be tested. The automatic testing unit 222 automatically performs testing when program code is committed. The security analysis unit 223 performs security-related testing. The result determination unit 224 determines the completion of testing. The countermeasure threat information 123 is output from the security analysis unit 223 and input to the security quality evaluation device 100. For example, the countermeasure threat information 123 is structured data expressed in a format such as JSON or XML. The zone setting information 121 is input to the security quality evaluation device 100 by the analyst 201. The security quality evaluation device 100 generates a zone model using the zone setting information 121, performs zone analysis using the zone model and the countermeasure threat information 123, and outputs a quality evaluation result 124. The quality evaluation result 124 is input to the result determination unit 224. The result determination unit 224 receives the quality evaluation result 124 and determines the completion of security-related testing by referring to the quality evaluation result 124. This automates the determination of the completion of security testing.

[0091] Second Embodiment A form for evaluating the security quality of an evaluation target in time series will be described below, focusing mainly on the differences from the first embodiment, with reference to Figs.

[0092] ***Description of Configuration*** The configuration of the security quality evaluation device 100 is the same as that in the first embodiment.

[0093] 17 shows the functional configuration of the security quality evaluation device 100. A plurality of countermeasure threat information 123 is input to the security quality evaluation device 100.

[0094] 18 shows the functional configuration of the security quality evaluation system 200 A. In the security quality evaluation system 200 A, a plurality of countermeasure threat information 123 is input to the security quality evaluation device 100 .

[0095] 19 shows the functional configuration of a security quality evaluation system 200 B. In the security quality evaluation system 200 B, a plurality of countermeasure threat information 123 are input to the security quality evaluation device 100 .

[0096] ***Description of Operation*** The security quality evaluation method will be described with reference to Fig. 20. Steps S210 to S230 are the same as steps S110 to S130 in the first embodiment.

[0097] Steps S240 to S260 are executed each time a new security measure against a security threat is applied to the evaluation target, and the countermeasure threat information 123 is generated each time a new security measure against a security threat is applied to the evaluation target.

[0098] In step S240, the information receiving unit 111 receives the current countermeasure threat information 123. Step S240 is the same as step S140 in the first embodiment.

[0099] In step S250, the zone analysis unit 113 performs a zone analysis using the zone model 122 and the current countermeasure threat information 123. Step S250 is similar to step S150 in embodiment 1. However, step S250 from the second time onwards differs from step S150 in the following respects.

[0100] In step S250 from the second time onwards, the zone analysis unit 113 plots the current evaluation score on the previous zone model diagram 125. Each evaluation score from the previous time onwards is plotted on the previous zone model diagram 125. In this way, a zone model diagram 125 is generated on which multiple evaluation points, including the current evaluation point, are plotted.

[0101] In step S260, the result output unit 114 outputs the quality evaluation result 124. Step S260 is the same as step S160 in embodiment 1. However, step S260 from the second time onwards differs from step S160 in the following respects.

[0102] In step S260 from the second time onwards, the quality evaluation result 124 indicates a plurality of quality opinions corresponding to a plurality of countermeasure threat information 123. In addition, the zone model diagram 125 plots a plurality of evaluation points corresponding to a plurality of countermeasure threat information 123.

[0103] *** Supplementary Explanation *** The countermeasure threat information 123 input to the security quality evaluation device 100 may be divided into multiple pieces. In product development, the countermeasures implemented may change as the development progresses. In such cases, points equal to the number of countermeasure threat information 123 are plotted for a single zone model 122. The zone model diagram 125 of the quality evaluation result 124 includes multiple plot points related to post-countermeasure information. Software version information (e.g., name and time) may be added to each plot point. This allows a time series of changes in security quality accompanying software version updates, etc. to be represented.

[0104] ***Effects of Second Embodiment*** According to the second embodiment, it is possible to visualize changes in security quality that accompany repeated measures being taken.

[0105] Embodiment 3. In the first embodiment, the security quality evaluation of the target system is performed using one zone model. The security quality evaluation device of the present disclosure can also evaluate the security quality of the target system using multiple zone models. For example, a target system to which multiple zone models are applied is composed of multiple security areas with different quality requirements for security measures.

[0106] The third embodiment will be described with reference to FIGS. 21 to 23, focusing mainly on the differences from the first and second embodiments.

[0107] ***Description of Configuration*** Fig. 21 shows the functional configuration of the security quality evaluation device 100. The configuration of the security quality evaluation device 100 is the same as that in the first embodiment. Security level information 126 is input to the security quality evaluation device 100. The security level information 126 will be described later.

[0108] FIG. 22 shows an example of the configuration of a target system. The target system is composed of multiple security areas 301. In other words, the target system has multiple security areas 301. In FIG. 22, the target system is composed of four security areas (301A-301D). The number of security areas 301 may be three or less, or five or more. Each security area (301A-301D) is individually assigned a security level. The security area 301 is a network section that requires a set security level. The security area 301 is also called a security zone. The security level is the level of security quality that devices in the security area 301 must achieve in accordance with a system-level risk assessment. The security level is determined based on the strength of the security measures taken by the victim of the attack, depending on the severity of the attack. If advanced security measures are taken against attacks, the security measures are robust. Specifically, the security level of a security area 301 with few security measures in place is low. Furthermore, the security level of a security area 301 increases as more advanced security measures are taken. The security level information 126 indicates the security level set for each of the multiple security areas 301 .

[0109] The number, scope, and security level of the security areas 301 are determined appropriately according to the security quality required for the target system. The number, scope, and security level of the security areas 301 may be determined in advance, or may be determined dynamically according to changes in threats to the target system.

[0110] Multiple security areas 301 are connected to one another via conduits (302A to 302C). Devices in each security area 301 communicate with devices in other security areas 301 via conduits 302. Conduits 302 are network boundaries that connect security areas 301 to one another.

[0111] ***Description of Operation*** The security quality evaluation method will be described with reference to Figure 23. In step S310, the information receiving unit 111 receives the zone setting information 121 and the security level information 126. The security level information 126 is information indicating the quality requirements for security measures according to the security level. For example, the security level information 126 indicates information described in IEC 62443.

[0112] The zone setting information 121 and the security level information 126 are received, for example, as follows: A user inputs the zone setting information 121 and the security level information 126 to the security quality evaluation device 100. The information receiving unit 111 receives the input zone setting information 121 and security level information 126. The security level information 126 may be included in the zone setting information 121.

[0113] In step S320, the zone model generation unit 112 generates a zone model 122 for each security level using the security level information 126. The zone model 122 differs for each security level. The method for generating the zone model 122 for each security level is the same as the method in step S120 in the first embodiment.

[0114] In step S330, the zone model generating unit 112 stores the zone model 122 for each security level together with the security level information 126 in the storage unit 120.

[0115] In step S340, the information receiving unit 111 receives the countermeasure threat information 123. Step S340 is the same as step S140 in the first embodiment.

[0116] In step S350, the zone analysis unit 113 performs a zone analysis for each security area 301.

[0117] Zone analysis is performed for each security area 301 as follows. First, the zone analysis unit 113 selects a zone model 122 corresponding to the security level set for the security area 301. Then, the zone analysis unit 113 performs zone analysis using the selected zone model 122, security level information 126, and countermeasure threat information 123. The method of zone analysis is the same as the method in step S150 of the first embodiment. This results in a quality evaluation according to the security level. Furthermore, for each security area 301, the quality opinion set for the section in the zone model 122 where the evaluation score is plotted is set as the security quality to be analyzed.

[0118] In step S360, the result output unit 114 outputs the quality evaluation result 124 for each security area 301.

[0119] Note that, if there are items common to the zone models in different security areas 301, the quality evaluation results 124 may be output together for the different security areas 301. For example, the quality evaluation results 124 may be displayed by overlapping a plurality of zone model diagrams 125.

[0120] ***Effects of Embodiment 3*** According to Embodiment 3, it is also possible to evaluate the security quality of a target system using multiple zone models. In other words, security quality evaluation can be performed even if the target system has multiple security areas (i.e., network partitions) with different security levels. Furthermore, by outputting (displaying) the quality evaluation results for different security areas together, users can easily compare the security quality between security areas.

[0121] The configuration using multiple zone models described in the third embodiment can also be applied to the security quality evaluation device 100 of the second embodiment. That is, the security quality evaluation device 100 may output a zone model diagram 125 in which multiple evaluation points corresponding to multiple countermeasure threat information 123 are plotted, together with multiple quality opinions corresponding to the multiple countermeasure threat information 123.

[0122] *** Supplementary Information about the Embodiment *** The hardware configuration of the security quality evaluation device 100 will be described with reference to Fig. 24. The security quality evaluation device 100 includes a processing circuit 109. The processing circuit 109 is hardware that realizes an information receiving unit 111, a zone model generating unit 112, a zone analyzing unit 113, and a result output unit 114. The processing circuit 109 may be dedicated hardware, or may be a processor 101 that executes a program stored in a memory 102.

[0123] When the processing circuit 109 is dedicated hardware, the processing circuit 109 may be, for example, a single circuit, a multiple circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field Programmable Gate Array.

[0124] The security quality evaluation device 100 may include a plurality of processing circuits that replace the processing circuit 109 .

[0125] In the processing circuit 109, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0126] In this way, the functions of the security quality evaluation device 100 can be realized by hardware, software, firmware, or a combination of these.

[0127] Like the security quality assessment device 100, each of the security analysis system 210 and the pipeline system 220 includes a processing circuit.

[0128] Each embodiment is an example of a preferred embodiment and is not intended to limit the technical scope of the present disclosure. Each embodiment may be implemented in part or in combination with other embodiments. Procedures described using flowcharts, etc. may be modified as appropriate.

[0129] The "part" of each element of the security quality evaluation device 100 may be read as a "process," a "step," a "circuit," or a "circuitry."

[0130] 100 Security quality evaluation device, 101 Processor, 102 Memory, 103 Auxiliary storage device, 104 Communication device, 105 Input / output interface, 109 Processing circuit, 111 Information reception unit, 112 Zone model generation unit, 113 Zone analysis unit, 114 Result output unit, 120 Storage unit, 121 Zone setting information, 122 Zone model, 123 Countermeasure threat information, 124 Quality evaluation result, 125 Zone model diagram, 126 Security level information, 200 Security quality evaluation system, 201 Analyst, 202 Developer, 210 Security analysis system, 211 Information reception unit, 212 Security analysis unit, 219 Threat knowledge, 220 Pipeline system, 221 Code commit unit, 222 Automatic test unit, 223 Security analysis unit, 224 Result determination unit, 229 Configuration management DB, 301 Security area, 302 Conduit.

Claims

1. A security quality evaluation device comprising: a zone model generation unit having a first axis for a countermeasure value which is an index of the number of countermeasures applied to a security threat, and a second axis for a threat value which is an index of the number of threats against which countermeasures are applied, the zone model generation unit dividing a space formed by the first axis and the second axis into a plurality of sections and generating one or more zone models in which a security opinion is set for each section; and a zone analysis unit which identifies a target countermeasure value which is the countermeasure value of the evaluation target and a target threat value which is the threat value of the evaluation target based on countermeasure threat information including countermeasure value information for identifying the countermeasure values ​​of measures applied to one or more evaluation targets and threat value information for identifying the threat values ​​of threats against which countermeasures are applied to the evaluation target, and obtains an opinion corresponding to the pair of the target countermeasure value and the target threat value from the zone model as a quality opinion for the security quality of the evaluation target.

2. The security quality evaluation device of claim 1, wherein the zone model generation unit divides the space of the zone model into a grid by dividing each of the range of the countermeasure value on the first axis and the range of the threat value on the second axis into a plurality of ranges, and divides the space of the zone model into the plurality of sections by drawing boundary lines connecting a lower limit point corresponding to the pair of the lower limit of the countermeasure value on the first axis and the lower limit of the threat value on the second axis, and an upper limit point corresponding to the pair of the upper limit of the countermeasure value on the first axis and the upper limit of the threat value on the second axis, and dividing each of the sections through which the boundary lines pass.

3. The security quality evaluation device described in claim 1, wherein the zone model generation unit divides the space of the zone model into the plurality of sections by drawing one or more dividing lines on a reference axis, which is one of the first axis and the second axis, that divide the range of values ​​of the reference axis, drawing a boundary line passing through the origin between the first axis and the second axis, and drawing a dividing line on a counterpart axis, which is the axis other than the reference axis, that divides the range of values ​​of the counterpart axis through the intersection of the dividing line and the boundary line for each dividing line on the reference axis.

4. A security quality evaluation device described in any one of claims 1 to 3, wherein the zone model generation unit plots an evaluation score corresponding to a pair of the target countermeasure value and the target threat value on the zone model, and obtains an opinion set in the section where the evaluation score is plotted as the quality opinion.

5. The security quality evaluation device according to claim 4, further comprising a result output unit that outputs a zone model diagram representing the zone model on which the evaluation points are plotted, together with the quality opinion.

6. The security quality evaluation device described in claim 5, wherein the zone analysis unit plots evaluation scores based on the target threat information for each of a plurality of pieces of target threat information on the zone model to obtain a quality opinion, and the result output unit outputs the zone model diagram on which a plurality of evaluation scores corresponding to the plurality of pieces of target threat information are plotted, together with a plurality of quality opinions corresponding to the plurality of pieces of target threat information.

7. A security quality evaluation device as described in any one of claims 1 to 6, wherein the evaluation target has a plurality of security areas, each having a security level set for it; the zone model generation unit generates the zone model for each security level based on the security level; and the zone analysis unit selects, for each security area of ​​the evaluation target, the zone model corresponding to the security level set for the security area, and obtains the quality opinion from the selected zone model.

8. A security quality evaluation system comprising: the security quality evaluation device according to any one of claims 1 to 7; and a pipeline system that implements a pipeline for continuous integration and continuous deployment to output the countermeasure threat information.

9. The security quality evaluation system according to claim 8, wherein the pipeline system comprises: a code commit unit that commits the program code to be tested and that is the subject of evaluation; an automatic test unit that automatically performs security testing when the program code is committed and outputs the countermeasure threat information; and a result determination unit that receives a quality evaluation result indicating the quality opinion from the security quality evaluation device and determines the completion of the security testing by referring to the quality evaluation result.

10. A security quality evaluation method having a first axis for countermeasure values ​​that are an indicator of the number of countermeasures applied to security threats and a second axis for threat values ​​that are an indicator of the number of threats against which countermeasures are applied, wherein the space formed by the first and second axes is divided into a plurality of sections, and one or more zone models are generated in which a security outlook is set for each section; identifying target countermeasure values ​​that are the countermeasure values ​​for the evaluation target and target threat values ​​that are the threat values ​​for the evaluation target based on countermeasure threat information including countermeasure value information for identifying the countermeasure values ​​of measures applied to one or more evaluation targets and threat value information for identifying the threat values ​​of threats against which countermeasures are applied to the evaluation target; and obtaining from the zone model an opinion corresponding to the pair of the target countermeasure value and the target threat value as a quality opinion for the security quality of the evaluation target.

11. A security quality evaluation program for causing a computer to execute the following steps: a zone model generation process having a first axis for countermeasure values ​​that are an index of the number of countermeasures applied to security threats, and a second axis for threat values ​​that are an index of the number of threats against which countermeasures are applied, wherein the space formed by the first and second axes is divided into multiple sections and one or more zone models are generated in which a security opinion is set for each section; and a zone analysis process for identifying target countermeasure values ​​that are the countermeasure values ​​of the evaluation target and target threat values ​​that are the threat values ​​of the evaluation target based on countermeasure threat information including countermeasure value information for identifying countermeasure values ​​of measures applied to one or more evaluation targets and threat value information for identifying threat values ​​of threats against which countermeasures are applied to the evaluation target, and obtaining from the zone model an opinion corresponding to the pair of the target countermeasure value and the target threat value as a quality opinion for the security quality of the evaluation target.

Images