Evaluation device, evaluation method, and program

Abstract

An evaluation device disclosed herein comprises: a first acquisition unit that internally scans a device to be evaluated having a plurality of pieces of software each assigned a version and a plurality of resources used for the plurality of pieces of software, and thereby acquires the name and version of at least one piece of first software among the plurality of pieces of software; a second acquisition unit that externally scans the device to be evaluated, and thereby acquires the name and version of at least one piece of second software among the plurality of pieces of software; a collation and identification unit that collates the name and version of the first software and the name and version of the second software, and thereby identifies the name and version of common software; and a determination unit that determines to preferentially restore the contents of the common software and at least one of resources or paths corresponding to the software.

Description

Evaluation device, evaluation method, and program

[0001] The present disclosure relates to an evaluation device, an evaluation method, and a program.

[0002] The vulnerability assessment system described in Patent Document 1 aims to be able to assess the impact of a vulnerability on a system. To achieve this aim, the vulnerability assessment system determines whether software affected by a vulnerability can be directly attacked from an external network (see, for example, paragraph 0009 and claim 1 of Patent Document 1).

[0003] JP 2012-208863 A

[0004] However, although the vulnerability assessment system described above determines the possibility of an attack from an external network, as described above, it has the problem of being unable to determine, for example, which software should be repaired first among multiple pieces of software that contain different vulnerabilities.

[0005] An object of the present disclosure is to provide an evaluation device, an evaluation method, and a program that can determine which software among a plurality of pieces of software should be repaired with priority.

[0006] In order to solve the above-mentioned problems, the evaluation device according to the present disclosure includes: a first acquisition unit that acquires the name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation device having a plurality of pieces of software, each piece of software having a version number, and a plurality of resources used for the plurality of pieces of software, each resource being identified by a path indicating the location of the resource; a second acquisition unit that acquires the name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation device; a matching / discrimination unit that matches the name and version of the first software with the name and version of the second software to determine common software names and versions and non-common software names and versions between the name and version of the first software and the name and version of the second software; an evaluation unit that evaluates that the risk of vulnerabilities in the common software names and versions is greater than the risk of vulnerabilities in the non-common software names and versions; and a determination unit that determines to prioritize repair of at least one of the content of the common software and the resources and paths corresponding to the common software.

[0007] According to the evaluation device of the present disclosure, it is possible to determine which of the plurality of pieces of software should be repaired with priority.

[0008] 1 shows the configuration of a vulnerability risk assessment system ZRH of an embodiment. 2 shows the configuration of an assessment device HY of an embodiment. 3 shows the configuration of an assessed device HI of an embodiment. 4 shows the functions of an assessed device HI of an embodiment. 5 shows the functions of a vulnerability database DB (ZE) of an embodiment. 6 shows a flowchart illustrating the operation of a vulnerability risk assessment system ZRH of an embodiment. 7 shows the results of executing an internal scan NS of step ST11 of an embodiment. 8 shows the results of executing an external scan GS of step ST12 of an embodiment. 9 shows the acquisition ST of vulnerability ZE of step ST13 of an embodiment. 10 shows the matching TG of step ST14 of an embodiment. 11 shows an assessment HK of step ST15 of an embodiment. 12 shows the decision KT1 of step ST16 of an embodiment. 13 shows the decision KT2 of step ST18 of an embodiment. 14 shows the concept (one example) of an internal scan NS and an external scan GS. 15 shows the concept (another example) of an internal scan NS and an external scan GS. 16 shows the hardware configuration of an assessment device HY and an assessed device HI of an embodiment. 17 shows the hardware configuration based on software realization of an assessment device HY and an assessed device HI of an embodiment.

[0009] An embodiment of a vulnerability risk assessment system ZRH according to the present disclosure will be described.

[0010] <Embodiment> A vulnerability risk assessment system ZRH according to an embodiment will be described.

[0011] <Configuration of the embodiment> FIG. 1 shows the configuration of a vulnerability risk assessment system ZRH according to the embodiment.

[0012] The vulnerability risk assessment system ZRH of the embodiment includes an assessment device HY, assessed devices HI1 to HIm (m is an integer of 2 or more), and a vulnerability database DB(ZE), as shown in Fig. 1. The assessment device HY, the assessed devices HI1 to HIm, and the vulnerability database DB(ZE) are connected to each other via a network NW (e.g., the Internet), as shown in Fig. 1.

[0013] The evaluation device HY is used by a user US to evaluate vulnerabilities ZE (for example, as shown in FIG. 9) of the evaluation target devices HI1 to HIm, which are, for example, a server and a client. Details of the vulnerabilities ZE will be described later.

[0014] In the following, for ease of explanation and understanding, for example, a plurality of names may be collectively referred to as a single name, and for example, the evaluated devices HI1, HI2, . . . , HIm may be collectively referred to as the evaluated device HI.

[0015] <Configuration of Evaluation Device HY> FIG. 2 shows the configuration of the evaluation device HY according to the embodiment.

[0016] As shown in FIG. 2, the evaluation device HY of the first embodiment includes an input / output unit NY(HY), a processing unit SY(HY), a storage unit KI(HY), and a communication unit TU(HY).

[0017] The input / output unit NY (HY) is used by the user US to input commands to the device under evaluation HI (shown in FIG. 1) to execute an internal scan NS (e.g., shown in FIG. 4) and an external scan GS (e.g., shown in FIG. 4), and to output the results of executing the internal scan NS and the external scan GS. The input / output unit NY (HY) is, for example, a keyboard, a mouse, an LCD monitor, or a printer.

[0018] Here, "internal scanning" refers to, for example, scanning each component (e.g., file, data, software) included in the evaluated device HI from within the evaluated device HI to obtain the attributes (e.g., name, version, etc.) of each component (e.g., the tool "trivy" can be used for this internal scanning). "External scanning" refers to, for example, scanning each component (same as above) included in the evaluated device HI from outside the evaluated device HI to obtain the attributes (same as above) of each component (e.g., the tools "nmap" and "nucle" can be used for this external scanning).

[0019] The processing unit SY (HY) performs, for example, the above-mentioned internal scan NS and external scan GS.

[0020] The storage unit KI (HY) stores, for example, data necessary for processing by the processing unit SY (HY).

[0021] The communication unit TU (HY) communicates via the network NW. For example, the communication unit TU (HY) transmits commands to the evaluated device HI to perform the internal scan NS and external scan GS, and receives the results of the internal scan NS and external scan GS from the evaluated device HI.

[0022] <Configuration of the evaluated device HI> FIG. 3 shows the configuration of the evaluated device HI according to the embodiment.

[0023] As shown in FIG. 3, the evaluation target device HI of the embodiment includes an input / output unit NY(HI), a processing unit SY(HI), a storage unit KI(HI), and a communication unit TU(HI).

[0024] The input / output unit NY (HI) is used by an administrator (not shown) of the evaluated device HI to monitor and control the normal operation of the evaluated device HI. The input / output unit NY (HI) is, for example, a keyboard, a mouse, an LCD monitor, and a printer.

[0025] The processing unit SY (HI) performs, for example, processing related to monitoring and controlling the normal operation of the above-mentioned evaluated device HI, and processing related to the above-mentioned internal scan NS and external scan GS upon request from the above-mentioned evaluation device HY.

[0026] The storage unit KI (HI) stores, for example, data necessary for processing by the processing unit SY (HI).

[0027] The communication unit TU (HI) communicates via the network NW. For example, the communication unit TU (HI) receives commands to perform the internal scan NS and external scan GS from the evaluated device HI, and also transmits the results of the internal scan NS and external scan GS to the evaluated device HI.

[0028] <Functions of the evaluated device HI> <Software SW, version VE, resource RE, path PA, interface IF> FIG. 4 shows functions of the evaluated device HI of the embodiment.

[0029] As shown in Fig. 4, the evaluated device HI has a plurality of software SW1, SW2, .... Each of the plurality of software SW1, SW2, ... is assigned a version (version number of creation, repair, etc.). As shown in Fig. 4, for example, "software SW1" owned by the evaluated device HI is assigned to be "version VE2", and "software SW2" owned by the evaluated device HI is assigned to be "version VE3".

[0030] The device to be evaluated HI also has a plurality of resources RE1, RE2, etc., used for a plurality of pieces of software SW1, SW2, etc., as shown in Fig. 4. More specifically, the plurality of pieces of software SW1, SW2, etc., are stored in a plurality of resources RE1, RE2, etc., as shown in Fig. 4, for example, "software SW1" is stored in "resource RE1," and "software SW3, SW4" are stored in "resource RE3."

[0031] As shown in Figure 4, multiple resources RE1, RE2, ... are identified by multiple paths PA1, PA2, ... which are routes indicating the locations of the multiple resources RE1, RE2, ... (where the resources RE are located). Here, the "location of resource RE" broadly means the "location of software SW." As shown in Figure 4, for example, the location of "resource RE1," in other words, the location of "software SW1," is identified by "path PA1," and the location of "resource RE2," in other words, the location of "software SW2," is identified by "path PA2."

[0032] The evaluated device HI further has a plurality of interfaces IF1, IF2, etc., which are used for external scanning GS by the evaluation device HY, as shown in FIG.

[0033] <Internal Scan NS, External Scan GS> The evaluated device HI has an internal scan unit NS (HI) as shown in Fig. 4. In response to a request from the evaluation device HY, the internal scan unit NS (HI) executes a conventionally known internal scan NS on a plurality of pieces of software SW1, SW2, ..., and returns the results to the evaluation device HY.

[0034] As shown in Fig. 4, the evaluated device HI receives an external scan GS from the evaluation device HY via multiple interfaces IF1, IF2, etc. The evaluation device HY executes the external scan GS nonspecifically on multiple software SW1, SW2, etc. via the interface IF1, and obtains, as the execution results, for example, "software SW1" and "version VE2" (shown in Fig. 8). The evaluation device HY also executes the external scan GS nonspecifically on multiple software SW1, SW2, etc. via the interface IF5, and obtains, as the execution results, for example, "software SW3" and "version VE1" (shown in Fig. 8).

[0035] The reason for the "indefinite" is that the evaluating device HY cannot know in advance what kind of software SW the evaluated device HI has.

[0036] <Vulnerability Database DB(ZE)> FIG. 5 shows the function of the vulnerability database DB(ZE) of the embodiment.

[0037] 5, the vulnerability database DB(ZE) indicates the correspondence between a plurality of software SW, versions VE, and vulnerabilities ZE, regardless of whether the software SW is included in the evaluated device HI. For example, when "software SW1" is version "version VE2," the vulnerability database DB(ZE) indicates that it has a vulnerability ZE "ZE1b," and when "software SW2" is version VE3, the vulnerability database DB(ZE) indicates that it has a vulnerability ZE "ZE3c."

[0038] <Correspondence> The processing unit SY(HY) and processing unit SY(HI) correspond to the "first acquisition unit," "second acquisition unit," "matching and discrimination unit," "evaluation unit," and "determination unit," and the internal scanning unit NS(HI) corresponds to the "first acquisition unit." The vulnerability database DB(ZE) indicates the "correspondence."

[0039] <Operation of the embodiment> The operation of the vulnerability risk assessment system ZRH of the embodiment will be described.

[0040] FIG. 6 is a flowchart showing the operation of the vulnerability risk assessment system ZRH according to the embodiment.

[0041] The operation of the vulnerability risk assessment system ZRH according to the embodiment will be described with reference to the flowchart of FIG.

[0042] In the following, for ease of explanation and understanding, it is assumed that the vulnerability ZE of the evaluation target device HI1 among a plurality of evaluation target devices HI1, HI2, . . . HIm is to be evaluated.

[0043] Step ST11: The user US (e.g., as shown in FIG. 1) inputs a command to the evaluation device HY (e.g., as shown in FIG. 1) to execute an internal scan NS (e.g., as shown in FIG. 4) to the evaluated device HI1 (e.g., as shown in FIG. 1). The evaluation device HY then notifies the evaluated device HI1 that it will execute the internal scan NS. Upon receiving the notification, the evaluated device HI1's internal scanning unit NS (HI) (e.g., as shown in FIG. 4) executes the internal scan NS.

[0044] FIG. 7 shows the results of the execution of the internal scan NS in step ST11 of the embodiment.

[0045] As a result of the internal scanning unit NS (HI) of the evaluated device HI1 performing an internal scan NS on the evaluated device HI1, the evaluation device HY obtains from the internal scanning unit NS (HI) information about the software SW possessed by the evaluated device HI1, as shown in Figure 7, such as that "software SW1" is "version VE2," "resource RE1" is used, and is identified by "path PA1," and that "software SW2" is "version VE3," "resource RE2" is used, and is identified by "path PA2."

[0046] Returning to FIG. 6, the description will continue.

[0047] Step ST12: The user US executes an external scan GS from the evaluation device HY to the evaluated device HI1 via the multiple interfaces IF1, IF2, . . . of the evaluated device HI1.

[0048] More specifically, first, the evaluation device HY inputs signals (solid arrows, dotted arrows) for performing an external scan GS to the evaluated device HI1 via the interface IF1 of the evaluated device HI1, and as a result, receives an output of a signal (not shown) for estimating what software SW the evaluated device HI1 has and what version VE of that software SW is.

[0049] Next, the evaluation device HY inputs signals (solid arrows, dotted arrows) for performing an external scan GS to the evaluated device HI1 via the interface IF2 of the evaluated device HI1, and as a result, receives an output of a signal (not shown) for estimating what software SW the evaluated device HI1 has and what version VE of that software SW it has.

[0050] Thereafter, the evaluating device HY performs an external scan GS on the interfaces IF3, IF4, . . . of the evaluated device HI1 in this order.

[0051] FIG. 8 shows the results of the execution of the external scan GS in step ST12 of this embodiment.

[0052] As a result of the evaluation device HY performing an external scan GS on the evaluated device HI1, the evaluation device HY estimates and acquires, for example, that "software SW1" is "version VE2" through the external scan GS from "interface IF1," and estimates and acquires that "software SW3" is "version VE1" through the external scan GS from "interface IF5," as shown in FIG. 8.

[0053] Returning to FIG. 6, the description will continue.

[0054] Step ST13: The evaluation device HY acquires vulnerabilities ZE for the results of the internal scan NS and the external scan GS by referring to the vulnerability database DB (ZE) (shown in Figures 1 and 5) (acquisition ST).

[0055] FIG. 9 shows the step ST of acquiring the vulnerability ZE in step ST13 of the embodiment.

[0056] As shown in FIG. 9, the evaluation device HY acquires the following vulnerabilities ZE by referring to the vulnerability database DB(ZE).

[0057] (1) Results of the internal scan NS: "Software SW1", "Version VE2", "Resource RE1", and "Path PA1" have vulnerability ZE "ZE1b". "Software SW2", "Version VE3", "Resource RE2", and "Path PA2" have vulnerability ZE "ZE2c". (2) Results of the external scan GS: "Software SW1", "Version VE2" have vulnerability ZE "ZE1b". "Software SW3", "Version VE1" have vulnerability ZE "ZE3a".

[0058] Returning to FIG. 6, the description will continue.

[0059] Step ST14: The evaluation device HY compares the results of the internal scan NS (shown in FIGS. 7 and 9) with the results of the external scan GS (shown in FIGS. 8 and 9) (matching TG).

[0060] FIG. 10 shows the butting TG in step ST14 of the embodiment.

[0061] The evaluation device HY compares the results of the internal scan NS with the results of the external scan GS as shown in Fig. 10. The evaluation device HY determines the following through this comparison.

[0062] (1) "Software SW1" and "Version VE2" are common to the results of the internal scan NS and the results of the external scan GS (shown by solid lines). (2) "Software SW2" and "Version VE3" are not common to the results of the internal scan NS and the results of the external scan GS (in other words, "Software SW2" and "Version VE3" exist only in the results of the internal scan NS) (shown by dotted lines). (3) "Software SW3" and "Version VE1" are not common to the results of the internal scan NS and the results of the external scan GS (in other words, "Software SW3" and "Version VE1" exist only in the results of the external scan GS) (shown by dotted lines).

[0063] Returning to FIG. 6, the description will continue.

[0064] Step ST15: The evaluation device HY evaluates the magnitude of risk of vulnerability ZE based on the results of the internal scan NS and the external scan GS cross-checked with each other (evaluation HK).

[0065] FIG. 11 shows the evaluation HK in step ST15 of the embodiment.

[0066] As shown in Figures 10 and 11, the evaluation device HY evaluates that the risk of vulnerability ZE "ZE1b" in "software SW1" and "version VE2", which is common between the results of the internal scan NS and the results of the external scan GS, is greater than the risk of vulnerability ZE "ZE2c" in "software SW2" and "version VE3", and vulnerability ZE "ZE3a" in "software SW3" and "version VE1", which are not common between the results of the internal scan NS and the results of the external scan GS.

[0067] Returning to FIG. 6, the description will continue.

[0068] Step ST16: The evaluation device HY determines the "software SW" to be repaired (decision KT1).

[0069] FIG. 12 shows the determination KT1 in step ST16 of the embodiment.

[0070] As shown in FIG. 12, the evaluation device HY determines to repair with priority "software SW1", "version VE2" corresponding to vulnerability ZE "ZE1b" (shown in FIG. 11) which poses the greatest risk.

[0071] Returning to FIG. 6, the description will continue.

[0072] Step ST17: The evaluation device HY determines the "resource RE," "path PA," and "interface IF" to be repaired (decision KT2).

[0073] FIG. 13 shows the determination KT2 in step ST18 of the embodiment.

[0074] 10 and 13, the evaluation device HY determines that at least one of the "resource RE1" and the "path PA1" corresponding to the "software SW1" to be repaired with priority should be repaired with priority over other resources RE2, RE3, ... and other paths PA2, PA3, .... The evaluation device HY also determines that the "interface IF1" corresponding to the "software SW1" to be repaired with priority over other interfaces IF2, IF3, ....

[0075] <Effects of the embodiment> As described above, in the vulnerability risk assessment system ZRH of the embodiment, the assessment device HY can determine that, among the multiple "software SW1, SW2, ..." possessed by the assessed device HI, "software SW1" which has the greatest risk of vulnerability ZE should be repaired as a priority (decision KT1).

[0076] In the vulnerability risk assessment system ZRH of the embodiment, in addition to the above effect (decision KT1), it can be determined that, among the "plurality of resources RE1, RE2, ...," "plurality of paths PA1, PA2, ...," and "plurality of interfaces IF1, IF2, ...," the "resource RE1," "path PA1," and "interface IF1" corresponding to the "software SW1" that should be repaired with priority should be repaired with priority (decision KT2).

[0077] <Concept of Internal Scan NS and External Scan GS> FIG. 14 shows the concept (one example) of internal scan NS and external scan GS.

[0078] FIG. 14 conceptually shows the operations of the internal scan NS and external scan GS in FIG.

[0079] As shown in Figure 14, the internal scan NS is realized by an internal scanning unit NS (HI) included in the evaluated device HI transmitting the results of the internal scan NS of the evaluated device HI to the evaluation device HY via the network NW.

[0080] On the other hand, as shown in FIG. 14, the external scan GS is realized by an external scan unit GS (HY) present inside the evaluation device HY receiving the results of the external scan GS of the evaluation target device HI via the network NW.

[0081] FIG. 15 shows the concept (another example) of the internal scan NS and external scan GS.

[0082] FIG. 15 is a modification of the inner scan NS and outer scan GS shown in FIG.

[0083] As shown in Figure 15, the internal scan NS is realized by the internal scanning unit NS (HI) included in the evaluated device HI transmitting the results of the internal scan NS of the evaluated device HI to the evaluation device HY via the network NW, as shown in Figure 14.

[0084] On the other hand, as shown in FIG. 15, the external scan GS differs from that shown in FIG. 14 in that an external scan unit GS (HY) located outside the evaluation device HY receives the results of the external scan GS of the evaluation device HY via the network NW, and transmits the received results to the evaluation device HY.

[0085] <Hardware Configuration of the Embodiment> FIG. 16 shows the hardware configuration of the evaluation device HY and the evaluated device HI of the embodiment.

[0086] In order to perform the above-described functions, the evaluation device HY and the evaluated device HI of the embodiment include a processing circuit SYO as shown in FIG. 16, and further include an input circuit NYU and an output circuit SYU as necessary.

[0087] The processing circuit SYO is dedicated hardware that mainly realizes the functions of the processing unit SY(HY) of the evaluation device HY (shown in FIG. 2) and the processing unit SY(HI) of the evaluated device HI (shown in FIG. 3).

[0088] The processing circuit SYO is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0089] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processing circuit SYO with, for example, the outside of the evaluation device HY and the evaluated device HI.

[0090] <Hardware Configuration Based on Software Realization of the Embodiment> FIG. 17 shows a hardware configuration based on software realization of the evaluation device HY and the evaluated device HI of the embodiment.

[0091] As shown in FIG. 17, the evaluation device HY and the evaluated device HI of the embodiment include a processor PRO and a memory circuit KIO, and may further include an input circuit NYU and an output circuit SYU as necessary.

[0092] The processor PRO is a CPU (also called a central processing unit, processing device, arithmetic unit, microprocessor, microcomputer, or DSP (Digital Signal Processing)) that executes a program. The processor PRO mainly realizes the functions of the processing unit SY (HY) of the evaluation device HY (shown in FIG. 2) and the processing unit SY (HI) of the evaluated device HI (shown in FIG. 3).

[0093] The processor PRO realizes the above-mentioned functions by software, firmware, or a combination of software and firmware. The software and firmware are written as programs and stored in the memory circuit KIO.

[0094] The processor PRO realizes the above-mentioned functions by reading and executing the above-mentioned programs from the memory circuit KIO. The above-mentioned programs can be said to mainly cause a computer to execute the procedures and methods of the processing unit SY(HY) of the evaluation device HY and the processing unit SY(HI) of the evaluated device HI.

[0095] Here, the memory circuit KIO is, for example, a non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), etc., as well as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), etc.

[0096] Of the functions of the processing unit SY (HY) of the evaluation device HY and the processing unit SY (HI) of the evaluated device HI, some of the functions may be realized by a processing circuit SYO (shown in FIG. 16), while other functions may be realized by a processor PRO (shown in FIG. 17).

[0097] As described above, the functions of the processing unit SY(HY) of the evaluation device HY and the processing unit SY(HI) of the evaluated device HI can be realized by hardware, software, firmware, or a combination of these.

[0098] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processor PRO with, for example, the outside of the evaluation device HY and the evaluated device HI.

[0099] <Configuration Example> The evaluation device, evaluation method, and program according to the present disclosure have, for example, the following configuration.

[0100] [Item 1] An evaluation device including: a first acquisition unit that acquires a name and version of at least one first piece of software among the plurality of pieces of software, by internally scanning an evaluation target device having a plurality of pieces of software, each piece of software having a version assigned, and a plurality of resources used for the plurality of pieces of software, each resource being specified by a path indicating the location of the resource; a second acquisition unit that acquires a name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation target device; a matching / discrimination unit that determines common software names and versions and non-common software names and versions between the first software name and version and the second software name and version by matching the first software name and version with the second software name and version; an evaluation unit that evaluates that the risk of vulnerabilities in the common software name and version is greater than the risk of vulnerabilities in the non-common software name and version; and a determination unit that determines to preferentially repair at least one of the content of the common software and the resources and paths corresponding to the common software.

[0101] [Item 2] The evaluation device according to Item 1, wherein the evaluation unit performs the evaluation by referring to a correspondence relationship between the names and versions of the plurality of pieces of software and a plurality of vulnerabilities.

[0102] [Item 3] The evaluation device according to Item 1, wherein the device to be evaluated has a plurality of interfaces used for the external scan, and the determination unit determines to preferentially repair an interface, among the plurality of interfaces, that was used by the second acquisition unit when acquiring the name and version of the common software among the names and versions of the second software.

[0103] [Item 4] An evaluation method including: a first acquisition step of acquiring a name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation target device having a plurality of pieces of software, each piece of software having a version assigned, and a plurality of resources used for the plurality of pieces of software, each resource being identified by a path indicating the location of the resource; a second acquisition step of acquiring a name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation target device; a matching / discrimination step of determining common software names and versions and non-common software names and versions between the first software name and version and the second software name and version by matching the first software name and version with the second software name and version; an evaluation step of evaluating that the risk of vulnerabilities in the common software name and version is greater than the risk of vulnerabilities in the non-common software name and version; and a determination step of determining that at least one of the common software content and the resources and paths corresponding to the common software be repaired with priority.

[0104] [Item 5] A program for causing a computer to execute the following steps: a first acquisition step of acquiring the name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation target device having a plurality of pieces of software, each piece of software having a version assigned, and a plurality of resources used for the plurality of pieces of software, each resource being specified by a path indicating the location of the resource; a second acquisition step of acquiring the name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation target device; a matching / discrimination step of comparing the name and version of the first piece of software with the name and version of the second piece of software to determine common software names and versions and non-common software names and versions between the name and version of the first piece of software and the name and version of the second piece of software; an evaluation step of evaluating that the risk of vulnerabilities in the common software names and versions is greater than the risk of vulnerabilities in the non-common software names and versions; and a determination step of determining that at least one of the content of the common software and the resources and paths corresponding to the common software be repaired with priority.

[0105] ZRH vulnerability risk assessment system, HY assessment device, HI1 to HIm assessed device, DB (ZE) vulnerability database, NW network, US user.

Claims

1. An evaluation device comprising: a first acquisition unit that acquires the name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation device having a plurality of pieces of software, each piece of software having a version number, and a plurality of resources used for the plurality of pieces of software, each resource being identified by a path indicating the location of the resource; a second acquisition unit that acquires the name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation device; a matching / discrimination unit that determines common software names and versions and non-common software names and versions between the first software name and version and the second software name and version by matching the first software name and version with the second software name and version; an evaluation unit that evaluates that the risk of vulnerabilities in the common software name and version is greater than the risk of vulnerabilities in the non-common software name and version; and a determination unit that determines to prioritize repair of at least one of the content of the common software and the resources and paths corresponding to the software.

2. The evaluation device according to claim 1, wherein the evaluation unit performs the evaluation by referring to a correspondence relationship between the names and versions of the plurality of software programs and the plurality of vulnerabilities.

3. The evaluation device described in claim 1, wherein the device to be evaluated has a plurality of interfaces used for the external scan, and the determination unit determines that, among the plurality of interfaces, the interface used by the second acquisition unit when acquiring the name and version of the common software among the names and versions of the second software should be repaired preferentially.

4. An evaluation method comprising: a first acquisition step of acquiring the name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation device having a plurality of pieces of software, each piece of software having a version number, and a plurality of resources used for the plurality of pieces of software, each resource being identified by a path indicating the location of the resource; a second acquisition step of acquiring the name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation device; a matching and determination step of determining common software names and versions and non-common software names and versions between the first software name and version and the second software name and version by matching the first software name and version with the second software name and version; an evaluation step of evaluating that the risk of vulnerabilities in the common software name and version is greater than the risk of vulnerabilities in the non-common software name and version; and a determination step of determining that at least one of the common software content and the resources and paths corresponding to the common software be repaired with priority.

5. A program for causing a computer to execute the following steps: a first acquisition step of acquiring the name and version of at least one first piece of software among the plurality of pieces of software by internally scanning an evaluation device having a plurality of pieces of software, each piece of software having a version number, and a plurality of resources used for the plurality of pieces of software, each resource being identified by a path indicating the location of the resource; a second acquisition step of acquiring the name and version of at least one second piece of software among the plurality of pieces of software by externally scanning the evaluation device; a matching and determination step of determining common software names and versions and non-common software names and versions between the first software name and version and the second software name and version by matching the first software name and version with the second software name and version; an evaluation step of evaluating whether the risk of vulnerabilities in the common software name and version is greater than the risk of vulnerabilities in the non-common software name and version; and a determination step of determining to prioritize repair of at least one of the content of the common software and the resources and paths corresponding to that software.

Images