JP5117555B2 - Threat analysis support device and threat analysis support program - Google Patents

Description

  Embodiments described herein relate generally to a threat analysis support apparatus and a threat analysis support program.

  In designing information processing systems and devices (hereinafter referred to as information processing systems) that require high information security, it is necessary to take safe measures against security threats. For this reason, it is necessary to comprehensively list the security threats present in the target information processing system and to execute threat analysis to formulate measures that can counter each threat.

  For example, ISO / IEC 15408, which is an evaluation standard for information security, lists the security threats mentioned above in the basic security design document called Security Target (ST), and established technical or operational measures for each threat. It is required as an element for receiving the authentication to describe the contents of the threat analysis.

  However, a user who performs threat analysis is required to have knowledge about an information processing system to be analyzed and advanced knowledge about security technology.

  Therefore, many technologies for supporting threat analysis by users have been devised. For example, there is known a technique for extracting an assumed security threat and countermeasures against a protected asset existing in an information processing system to be analyzed and an attack subject to the protected asset.

JP 2005-25523 A JP 2009-230278 A

Common Criteria for Information Technology Security Evaluation Part 1: Overview and General Model (Version 3.1 Revised 1st Edition), [online], 2007.4.18, Information-technology Promotion Agency, Security Center Information Security Certification Office, [ 2008.2.20 Search], Internet (URL: http://www.ipa.go.jp/security/jisec/evalbs.html)

  However, the technology that supports threat analysis as described above is usually not particularly problematic, but according to the study of the present inventor, measures that have already been decided to be implemented before the threat analysis is performed are also analyzed. Therefore, there is an inconvenience that extra labor and analysis cost of threat analysis are required.

  Embodiments disclosed in the present specification are intended to provide a threat analysis support apparatus and a threat analysis support program that can reduce the labor and cost of threat analysis related to measures that already exist in an information processing system to be analyzed. .

  According to the embodiment, the threat analysis support device supports threat analysis for an information processing system to be analyzed.

  Here, the threat analysis support apparatus of the embodiment includes a threat analysis information storage unit, a system information storage unit, an input unit, a threat extraction unit, and an output unit.

  The system information storage unit of the embodiment stores a participant definition table that defines participants who can access the information processing system. The system information storage unit of the embodiment stores a protected asset definition table that defines protected asset information that is a protection target among information stored in the information processing system. In addition, the system information storage unit of the embodiment stores a system element definition table that defines names and types in association with elements that constitute the information processing system.

  The threat analysis information storage unit of the embodiment relates to the security measure function implemented in the information processing system, and for each measure type information indicating the type, the type defined in the system element definition table or the protection defined in the protected asset definition table Countermeasure entity indicating the countermeasure entity variable element that is replaced within the asset information range, the participant defined in the participant definition table, or the countermeasure target variable that is replaced within the protected asset information range defined in the protected asset definition table Countermeasure content information including countermeasure operation indicating the target of the action and the operation including the countermeasure operation variable element to be replaced within the scope of the protected asset information defined in the protected asset definition table or the operation not including the countermeasure operation variable element Threats that can be countered by the security countermeasure function and threat actor variable elements that are replaced within the scope of participants defined in the participant definition table or threats that indicate third parties Threat content information including the subject, threat type indicating threat target variable element to be replaced within the scope of protected asset information defined in the type or protected asset definition table defined in the system element definition table, and threat operation indicating the operation Is stored as a countermeasure-threat correspondence table.

  When the input unit of the embodiment receives the specification of the measure type information, the input unit displays the measure content information associated with the measure type information on the output unit.

  When the input unit of the embodiment accepts selection of the countermeasure entity in the countermeasure content information while the countermeasure content information is displayed, the value of the type defined in the system element definition table in association with the countermeasure entity variable element in the countermeasure entity Or, when the value of the protected asset information defined in the protected asset definition table is displayed in the output section and the selection of the displayed type value or the value of the protected asset information is accepted, the selection is associated with the accepted type value. The countermeasure entity variable element is replaced with the value of the designated name or the value of the protected asset information that has received the selection.

  When the input unit of the embodiment receives the selection of the countermeasure target in the countermeasure content information while the countermeasure content information is displayed, the input unit of the participant defined in the participant definition table in association with the countermeasure target variable element in the countermeasure target When the value or value of protected asset information defined in the protected asset definition table is displayed in the output section and the selection of the displayed participant value or protected asset information value is accepted, the The countermeasure target variable element is replaced with the value or the value of the protected asset information.

  In the embodiment, when the countermeasure content information is displayed, the input unit receives a selection of the countermeasure operation in the countermeasure content information. When the countermeasure operation includes a countermeasure operation variable element, the input unit protects the asset in association with the countermeasure operation variable element. When the value of the protected asset information defined in the definition table is displayed in the output section and the selection of the displayed value of the protected asset information is accepted, the countermeasure operation variable element is set with the value of the protected asset information that has received this selection. Replace. Conversely, if the countermeasure operation does not include a countermeasure operation variable element, the countermeasure operation is not replaced.

  The input unit of the embodiment includes countermeasure type information for which designation has been received, and countermeasure content information associated with the countermeasure type information, the countermeasure entity indicating the value of the replaced name or the value of protected asset information, Countermeasure information indicating the target of countermeasure indicating the replaced participant value or the value of protected asset information, and the countermeasure content information indicating the value of the replaced protected asset information or including the countermeasure operation information indicating the operation Write the definition table to the system information storage unit.

  The system information storage unit of the embodiment stores the written countermeasure information definition table.

  For each measure type information in the measure information definition table, the threat extraction unit of the embodiment converts the threat content information associated with the measure type information that matches the measure type information to the measure-type information corresponding to the measure type information. When the threat subject indicated is included, this threat subject variable element is replaced with the value of the participant indicated by the measure target associated with the measure type information in the measure information definition table.

  The threat extraction unit of the embodiment indicates, for each countermeasure type information in the countermeasure information definition table, the threat target in the threat content information associated with the countermeasure type information matching the countermeasure type information in the countermeasure-threat correspondence table. The threat target variable element is replaced with the name value or the protected asset information value indicated by any of the countermeasure entity, countermeasure target, or countermeasure operation associated with the countermeasure type information in the countermeasure information definition table.

  The threat extraction unit of the embodiment is threat content information associated with countermeasure type information that matches the countermeasure type information in the countermeasure information definition table, the threat subject indicating the value of the replaced participant, The threat content indicating the name value or the protected asset information value and the threat content information including the threat operation are written in the system information storage unit as the first threat table.

  The system information storage unit of the embodiment stores the written first threat table.

It is a block diagram which shows the hardware constitutions of the threat analysis assistance apparatus common to each embodiment. It is a functional block diagram which shows an example of a structure of the threat analysis assistance apparatus which concerns on 1st Embodiment. It is a schematic diagram which shows an example of the countermeasure-threat correspondence table in the same embodiment. It is a schematic diagram which shows an example of the participant definition table | surface in the same embodiment. It is a schematic diagram which shows an example of the protected asset definition table | surface in the embodiment. It is a schematic diagram which shows an example of the system element definition table | surface in the embodiment. It is a schematic diagram which shows an example of the countermeasure information definition table | surface in the embodiment. It is a mimetic diagram showing an example of the 1st threat table in the embodiment. It is a schematic diagram which shows an example of the information displayed on the system individual information input screen in the embodiment. It is a schematic diagram which shows an example of the countermeasure requirement input screen in the embodiment. It is a schematic diagram which shows an example of the information displayed on the countermeasure requirement input screen in the embodiment. It is a schematic diagram which shows an example of the information displayed on the countermeasure requirement input screen in the embodiment. It is a flowchart for demonstrating the operation | movement in the embodiment. It is a schematic diagram for demonstrating the operation | movement in the embodiment. It is a schematic diagram for demonstrating the operation | movement in the embodiment. It is a functional block diagram which shows an example of a structure of the threat analysis assistance apparatus which concerns on 2nd Embodiment. It is a flowchart for demonstrating the operation | movement in the embodiment.

  Each embodiment will be described below with reference to the drawings.

(First embodiment)
FIG. 1 is a block diagram showing a hardware configuration of a threat analysis support apparatus common to the embodiments, FIG. 2 is a functional block diagram showing an example of the configuration of the apparatus, and FIGS. It is a schematic diagram which shows an example of each information used for. As shown in FIG. 1, the computer 10 is connected to an external storage device 20 such as a hard disk drive (HDD). The external storage device 20 stores a program 21 executed by the computer 10. The computer 10 and the external storage device 20 constitute a threat analysis support device 30. The threat analysis support device 30 supports threat analysis for an information processing system (not shown) to be analyzed. As shown in FIG. 2, for example, the threat analysis support apparatus 30 includes a threat analysis information storage unit 31, a system information storage unit 32, an input unit 33, a threat extraction unit 34, an output unit 35, and a control unit 36. Such a threat analysis support apparatus 30 can be implemented in either a hardware configuration or a combination configuration of hardware resources and software. As the software of the combined configuration, a program 21 that is installed in the computer 10 from the network or the external storage device 20 in advance and realizes each function of the threat analysis support device 30 is used.

  Here, the threat analysis information storage unit 31 stores information that does not depend on the information processing system to be analyzed among information necessary for threat analysis. Specifically, as shown in FIG. 3, the threat analysis information storage unit 31 includes information that indicates a possible countermeasure (security countermeasure function) to counter a security threat and a threat that can be countered by this countermeasure in association with each other. For example, the countermeasure-threat correspondence table 100 is stored. In each row of the countermeasure-threat correspondence table 100, a security countermeasure function as a countermeasure is shown in the left half of the table, and threats that can be countered by that are shown in the right half. That is, for each line, the countermeasure written in the left half is effective against the threat written in the right half.

  Specifically, the countermeasure-threat correspondence table 100 relates to the security countermeasure function implemented in the information processing system, and is defined by the type defined in the system element definition table 103 or the protected asset definition table 102 for each countermeasure type information indicating the type. Replaced within the scope of the protected asset information, the countermeasure entity indicating the countermeasure entity variable element to be replaced, the participant defined in the participant definition table 101 or the protected asset information defined in the protected asset definition table 102 Measures indicating countermeasure targets that are to be taken and measures that include or do not include countermeasure manipulation variable elements that are replaced within the scope of the protected asset information defined in the protected asset definition table 102 Threats to be replaced within the scope of participants defined in the participant definition table 101 regarding countermeasure content information including operations and threats that can be countered by the security countermeasure function A threat subject variable element that indicates a subject variable element or a threat subject that represents a third party, a type defined in the system element definition table 103, or a threat target variable element that is replaced within the scope of the protected asset information defined in the protected asset definition table 102 The threat target information and threat content information including the threat operation indicating the operation are shown in association with each other.

  For convenience of explanation, the “measure subject” and the “threat subject” are also simply referred to as “subjects”. Similarly, “measure target” and “threat target” are also simply referred to as “target”, and “countermeasure operation” and “threat operation” are also simply referred to as “operation”. Similarly, the “countermeasure variable element”, “measure target variable element”, “countermeasure variable element”, “threat subject variable element”, and “threat target variable element” are also simply referred to as “variable elements”.

  Supplementally, the countermeasure-threat correspondence table 100 includes, for each countermeasure type (measurement type information) such as “authentication”, the contents of the countermeasure (measurement content information) necessary for defining the contents of the countermeasure type, and the countermeasures. The details of threats (threat content information) that can be countered by the above are shown in detail for the subject, the target, and the operation.

  The countermeasure type information indicates the type of countermeasure generally assumed. For example, authentication, access control (permitted), access control (prohibited), IDS (Intrusion Detection System) / IPS (Intrusion Prevention System), firewall, log, Security countermeasure functions such as encryption, electronic signature, and message authentication are shown, but not limited thereto.

  The countermeasure content information indicates the countermeasure requirements for each countermeasure type information, and is shown in detail for the subject (who / what), the target (who / who), and the operation (how). The threat content information indicates the threat requirements that can be countered by the countermeasure indicated by the countermeasure content information, and is shown in detail by subject, target, and operation in the same manner as the countermeasure content information. For example, the countermeasure content of the countermeasure type “authentication” shown in FIG. 3 is indicated by the subject “[system]”, the target “[participant]”, and the operation “authenticate”, and the threat that can be countered by this countermeasure The contents are shown as the subject “other than [participant] to [participant]”, the object “to [system]” and the operation “spoof”. The brackets (for example, the system part of [System] described above) indicate variable elements that are replaced with information stored in the system information storage unit 32 according to the operation of the user (analyzer). .

  The system information storage unit 32 stores information (system individual information) that is input by the analyst and depends on the information processing system to be analyzed and information related to the result of the threat analysis among the information necessary for the threat analysis. The system individual information includes, for example, information on information processing systems such as a participant definition table 101, a protected asset definition table 102, and a system element definition table 103, and threat analysis such as a countermeasure information definition table 104 and a first threat table 105. There is information about the results.

  The participant definition table 101 is participant definition information that defines participants who can access the information processing system to be analyzed. For example, as shown in FIG. Defined. For identification of the participant, the role of the participant may be indicated as in this example, or an individual identifier may be indicated.

  The protected asset definition table 102 is protected asset definition information that defines the protected asset information to be protected among the information stored in the information processing system to be analyzed. For example, as shown in FIG. Protected asset information is defined by showing management information.

  The system element definition table 103 relates to elements (for example, hardware, storage medium, communication path, system, etc.) constituting the information processing system to be analyzed, and system element definition information that defines element names (names) and types in association with each other. For example, as shown in the bottom row of FIG. 6, the system support elements are defined by associating the sales support system indicating the element name with the system indicating the type.

  The countermeasure information definition table 104 includes countermeasure type information received by the threat extraction unit 34 and countermeasure content information associated with the countermeasure type information. The value of the name replaced by the threat extraction unit 34 or the protected asset Operation or protection including the countermeasure entity indicating the value of information, the value of the participant replaced by the threat extraction unit 34 or the countermeasure target indicating the value of the protected asset information, and the value of the protected asset information replaced by the threat extraction unit 34 This is countermeasure information definition information that is associated with the countermeasure content information including the countermeasure operation indicating the operation that does not include the asset information value. For example, as shown in FIG. 7, the countermeasure information definition table 104 indicates the specific contents of the countermeasure already existing in the information processing system to be analyzed for each countermeasure type, “authentication” indicating the countermeasure type, "Sales support system authenticates general users", which represents the contents of various countermeasures.

  The first threat table 105 is threat content information associated by the countermeasure-threat correspondence table 100 with the countermeasure type information matching the countermeasure type information in the countermeasure information definition table 104, and has been replaced by the threat extraction unit 34. It is first threat definition information comprising a threat subject indicating a value of a participant, a threat target indicating a value of a name replaced by the threat extraction unit 34 or a value of protected asset information, and the threat content information including a threat operation. . For example, as shown in FIG. 8, the first threat table 105 shows specific contents of threats that can be countered by countermeasures that already exist in the information processing system to be analyzed. Impersonates the sales support system other than general users. " This threat content is derived by using the countermeasure-threat correspondence table 100 from the countermeasure contents defined in the countermeasure information definition table 104 “the sales support system authenticates a general user”.

  Supplementally, in the participant definition table 101, the protected asset definition table 102, and the system element definition table 103, variable elements in square brackets of the countermeasure contents shown in the countermeasure-threat correspondence table 100 are displayed in accordance with the operation of the analyst. Used to replace. For example, the variable element in square brackets of the subject “[System] is” of the countermeasure content indicated in association with the countermeasure type “authentication” in the countermeasure-threat correspondence table 100 is defined and selected in the system element definition table 103. The variable element in square brackets for the target “[participant]” of the countermeasure content is defined in the participant definition table 101 by replacing the value “sales support system” associated with the type value “system”. The selected participant value “normal user” is replaced. In addition, the variable element in the brackets of the subject of the threat content “associated with [other than [participant]” is [participant] ”is the countermeasure The variable value in the brackets of the target “[System]” is related to the value “System” of the type selected in the countermeasure content. It is replaced with the value of the name “sales support system”.

  The threat analysis information storage unit 31 and the system information storage unit 32 may be realized as a part of the external storage device 20, for example, or may be realized as a part of a storage device (not shown) in the computer 10.

  The input unit 33 accepts input information, designation or selection of information being displayed by an operation of an input device such as a keyboard or a mouse (not shown) by an analyst (hereinafter referred to as “analyzer operation”). This is an input interface for executing write / read processing for each storage unit 31, 32, and has, for example, the following functions (f33-1) to (f33-7).

  (f33-1) A function of writing the above-described countermeasure-threat correspondence table 100 in the threat analysis information storage unit 31 by the operation of the analyst.

  (f33-2) A function of writing the above-described participant definition table 101, protected asset definition table 102, and system element definition table 103 into the system information storage unit 32 by the analyst's operation.

  This function (f33-2) may be realized by the functions (f33-2-1) to (f33-2-3), for example.

    (f33-2-1) As shown in FIG. 9, for example, display areas g41 to g43 for displaying each information in each definition table 101 to 103 so as to be writable, and each display by pressing operation (click operation) by the analyst. A system individual information input screen G40 including a countermeasure input transition button g44 indicating that each information in the areas g41 to g43 is written in the respective definition tables 101 to 103 and transition to the countermeasure requirement input screen G50 is displayed on the output unit 34. Function to let you.

  Note that the function of displaying the system individual information input screen G40 on the output unit 34 is stored in advance in a memory (not shown) as system individual information input screen data representing the system individual information input screen G40 or described in the program of the input interface. The system individual information input screen data for display obtained by inserting each information in the definition tables 101 to 103 into the display area data of the prepared system individual information input screen data is output. This can be realized by sending to 34. The function for displaying the other input screens G50 to G52 can be realized in the same manner as the function for displaying the input screen G40.

    (f33-2-2) A function for determining whether or not the countermeasure input transition button g44 is pressed.

    (f33-2-3) A function of writing each information in each display area g41 to g43 to each definition table 101 to 103 and transitioning to the countermeasure requirement input screen G50 when there is a pressing operation.

  For example, as shown in FIG. 10, the function to transition to the countermeasure requirement input screen G50 stores countermeasure requirement input screen data representing the countermeasure requirement input screen G50 in a memory (not shown) in advance or is described in an input interface program. When the pressing operation of the countermeasure input transition button g44 is detected, the information in the display areas g41 to g43 is written in the definition tables 101 to 103, and then the prepared countermeasure requirement input is performed. This can be realized by sending the screen data to the output unit 34. Here, the countermeasure requirement input screen G50 includes, for example, a countermeasure type selection area g52 having a list box display button g51.

  (f33-3) A function of causing the output unit 35 to display countermeasure content information associated with this countermeasure type information when it receives designation of the countermeasure type information.

  This function (f33-3) may be realized by, for example, each function (f33-3-1) to (f33-3-3).

    (f33-3-1) A function that causes the output unit 34 to display a list of countermeasure type information in the countermeasure-threat correspondence table 100 by clicking the list box display button g51 by the analyst while the countermeasure requirement input screen G50 is being displayed.

    (f33-3-2) A function for displaying the selected measure type information in the measure type selection area g52 when the selection of the measure type information by the operation of the analyst is accepted while the list of the measure type information is displayed.

  Instead of the functions (f33-3-1) to (f33-3-2), the analyst may write the countermeasure type information in the countermeasure type selection area g52.

    (f33-3-3) In any case, when the countermeasure type information is displayed in the countermeasure type selection area g52 and the specification of the countermeasure type information is accepted by the analyst, the countermeasure associated with the countermeasure type information is displayed. A function of reading content information from the countermeasure-threat correspondence table 100 and displaying it on the output unit 35.

  This function (f33-3-4) includes, for example, a countermeasure type selection area g52 having a list box display button g51, a countermeasure main body selection area g54 having a list box display button g53, and a list box display as shown in FIG. You may implement | achieve by the function which displays the countermeasure requirement input screen G51 containing the countermeasure object selection area | region g56 which has the button g55, and the countermeasure operation display area g57 on the output part 34. FIG.

  In the countermeasure requirement input screen G51, of the countermeasure content information, the countermeasure entity indicating the countermeasure entity variable element is displayed in the countermeasure entity selection area g54, and the countermeasure object indicating the countermeasure object variable element is displayed in the countermeasure object selection area g56. The countermeasure operation indicating the operation is displayed in the countermeasure operation display area g57. When the countermeasure subject read from the countermeasure-threat correspondence table 100 does not include a variable element, the list box display button g53 is not displayed in the countermeasure subject selection area g54. Similarly, when the countermeasure target read from the countermeasure-threat correspondence table 100 does not include a variable element, the list box display button g55 is not displayed in the countermeasure target selection area g56, and the countermeasure operation read from the countermeasure-threat correspondence table 100 is displayed. When a variable element is included in the list box, a list box display button is displayed in the countermeasure operation display area g57.

  As described above, the function for displaying the countermeasure requirement input screen G51 on the output unit 34 is to store countermeasure requirement input screen data representing the countermeasure requirement input screen G50 in a memory (not shown) in advance or program the input interface. For display obtained by inserting countermeasure type information, countermeasure main body, countermeasure target and target operation in the selection areas g52, g54, g55, and g57 of the prepared countermeasure requirement input screen data, respectively. This can be realized by sending the countermeasure requirement input screen data to the output unit 34.

  (f33-4) While the countermeasure content information is being displayed, if the selection of the countermeasure entity in the countermeasure content information is accepted, the value of the type defined in the system element definition table 103 in association with the countermeasure entity variable element in the countermeasure entity or When the value of the protected asset information defined in the protected asset definition table 102 is displayed and the selection of the value of the displayed type or the value of the protected asset information is accepted, the name of the name associated with the value of the type of accepting this selection is displayed. A function that replaces the countermeasure subject variable element with the value or the value of the protected asset information that has received the selection.

  (f33-5) If the selection of the countermeasure target in the countermeasure content information is received while the countermeasure content information is displayed, the value of the participant defined in the participant definition table 101 in association with the countermeasure target variable element in the countermeasure target Alternatively, when the value of the protected asset information defined in the protected asset definition table 102 is displayed and the selection of the displayed participant value or the value of the protected asset information is received, the value of the participant who received this selection or the protected asset A function to replace the countermeasure target variable element with the information value.

  These replacement functions (f33-4) and (f33-5) replace the countermeasure requirement input screen data on the countermeasure requirement input screen G51 shown in FIG. 11, and based on the countermeasure requirement input screen data after replacement. Then, as shown in FIG. 12, a countermeasure requirement input screen G52 is displayed. This countermeasure requirement input screen G52 has a display area g54 'of a countermeasure main body after replacement and a display area g56' of a countermeasure target after replacement in place of the selection areas g54 and g56 described above.

  In addition, the countermeasure requirement input screen G52 is input to the input unit 33 with an instruction to add each piece of information being displayed in the display areas g52, g54 ′, g56 ′, and g57 to the countermeasure definition table 104 and write the information by pressing the analyzer A countermeasure addition button g58 indicating that the threat analysis is to be performed, and an end button g59 indicating that an instruction to end the threat analysis is input to the input unit 33 by the pressing operation of the analyst.

  (f33-6) Similar to (f33-4) and (f33-5), when the countermeasure operation selection in the countermeasure content information is accepted while the countermeasure content information is displayed, the countermeasure operation variable element in this countermeasure operation is displayed. When the value of the protected asset information defined in the protected asset definition table 102 is displayed and the selection of the value of the displayed protected asset information is received, the countermeasure operation variable element is determined by the value of the protected asset information that has received the selection. The ability to replace

  (f33-7) Countermeasure type information that has received a specification, and countermeasure content information associated with this countermeasure type information, including the name of the replaced name or the value of protected asset information, the replaced involvement Measures including countermeasure operations, including countermeasure targets that indicate the value of the operator or protected asset information, and operations that include the protected asset information value replaced from the countermeasure operation variable element or operations that do not include the countermeasure operation variable element A function of writing a countermeasure information definition table 104 indicating information in association with the system information storage unit 32.

  The threat extraction unit 34 is present in the information processing system to be analyzed from the information input from the input unit 33 and recorded in the system information recording unit 32 and the information previously recorded in the threat analysis information storage unit 31 before analysis. To extract threats. Specifically, the threat extraction unit 34 has the following functions (f34-1) to (f34-3).

  (f34-1) For each countermeasure information in the countermeasure information definition table 104, when the threat subject of the threat content information associated with the countermeasure type information of the countermeasure information in the countermeasure-threat correspondence table 100 includes a variable element, A function of replacing the threat subject variable element with the value of the participant indicated by the countermeasure target associated with the countermeasure information in the countermeasure information definition table 104.

  (f34-2) For each countermeasure information in the countermeasure information definition table 104, when the threat target of the threat content information associated with the countermeasure type information of the countermeasure information in the countermeasure-threat correspondence table 100 includes a variable element, A function that replaces the threat target variable element with the value of the variable element that matches the attribute defined in one of the countermeasure subject, countermeasure target, or countermeasure operation associated with the countermeasure type information in the countermeasure information definition table 104 .

   (f34-3) The countermeasure information in the countermeasure information definition table 104 is threat content information associated with the countermeasure type information of this countermeasure information in the countermeasure-threat correspondence table 100, and (f34-1) (f34- A function of writing the threat content information including the threat subject, the threat target, and the threat operation in which the variable elements are replaced in 2) into the system information storage unit 32 as the first threat table 105.

  In addition to the functions (f33-1) to (f33-7) of the input unit 33 and the functions (f34-1) to (f34-3) of the threat extraction unit 34, the progress of the threat analysis and the analysis results The output unit 35, which is an output interface for outputting, has the following functions. Specifically, the output unit 35 displays the input screens G40 and G50 to G52 based on the input screen data sent from the input unit 33 and the threat analysis received from the input unit 33 or the threat extraction unit 34. It has a function to display the progress and analysis results.

  The control unit 36 has a function of controlling the operations of the units 33 to 35 so as to execute the operations shown in the flowchart of FIG.

  Next, the operation of the threat analysis support apparatus configured as described above will be described with reference to the flowchart of FIG. 13 and the schematic diagrams of FIGS. However, it is assumed that the countermeasure-threat correspondence table 100 shown in FIG. 3 is stored in the threat analysis information storage unit 31 in advance.

  First, in the threat analysis support apparatus 30, the input unit 33 displays the participant, the protected asset, and the system while the system individual information input screen G40 shown in FIG. Information indicating element names and types of constituent elements is input to the display areas g41 to g43, respectively (step S1).

  Subsequently, the input unit 33 determines whether or not the countermeasure input transition button g44 displayed on the system individual information input screen G40 has been pressed by the analyst (step S2).

  When the countermeasure input transition button g44 is pressed as a result of the determination in step S2 (step S2: “Yes”), the input unit 33 displays the participant, the protected asset, the element name, and the element name input in step S1. Information indicating the type is added (stored) to the participant definition table 101, the protected asset definition table 102, and the system element definition table 103 as shown in FIGS. 4 to 6 (step S3). Thereafter, the display screen of the output unit 35 is changed to a countermeasure requirement input screen G50 as shown in FIG. 10 (step S4). On the other hand, if the result of determination in step S2 is that the countermeasure input transition button g44 is not pressed (step S2: “No”), the process returns to step S1.

  Subsequently, the input unit 33 determines whether or not the end button g59 displayed on the countermeasure requirement input screen G50 has been pressed by the analyst (step S5).

  If the end button g59 is not pressed as a result of the determination in step S5 (step S5: “No”), the input unit 33 designates the countermeasure type information from the countermeasure type selection area g52 according to the operation of the analyst. Accept (step S6). On the other hand, if the end button g59 is pressed as a result of the determination in step S5 (step S5: “Yes”), the threat analysis of the information processing system to be analyzed is ended.

  When the designation of countermeasure type information is received in step S6, the input unit 33 displays the countermeasure content information stored in association with the countermeasure type information received in step S6 as shown in FIG. 11, in the countermeasure-threat correspondence table. The content of the countermeasure is read from 100, inserted into the areas g54, g56, and g57 and displayed on the output unit 34 (step S7). For example, when “authentication” is selected as the countermeasure type information, the countermeasure entity “[System” is stored as the countermeasure contents stored in association with the countermeasure type information “authentication” in the areas g54, g56, and g57 of the countermeasure contents. ], The countermeasure object “[participant]” and the countermeasure operation “authenticate” are read from the countermeasure-threat correspondence table 100 and displayed.

  Furthermore, as shown in FIG. 12, the input unit 33 operates in the participant definition table 101, the protected asset definition table 102, and the system element definition table 103 stored in the system information storage unit 32 in step S <b> 3 by the operation of the analyst. Based on this, the variable elements of the countermeasure subject, the countermeasure target, and the countermeasure operation are designated (replaced) (step S8). Here, when “authentication” is selected as the countermeasure type information, the brackets (variable elements) of the countermeasure entity “[system]” and the countermeasure object “[participant]” are designated (replaced). Here, the square bracket of the countermeasure entity “[system] is” is replaced with the name value “sales support system” associated with the type value “system” in the system definition table 103, and the countermeasure target “[participant” ] Is replaced with the value “general user” of the selected participant among the values of the participant in the participant definition table 101, but is not limited thereto. For example, as the replacement content in square brackets, replacement content such as the main “sales support system” and the target “administrator” is applicable.

  Thereafter, the input unit 33 determines whether or not the measure addition button g58 displayed on the measure requirement input screen G52 has been pressed by the analyst (step S9).

  As a result of the determination in step S9, when the countermeasure addition button g58 is pressed (step S9: “Yes”), the input unit 33 displays the countermeasure requirement input screen G52 in step S8 as shown in FIGS. Is added (stored) to the countermeasure information definition table 104 (step S10). Here, countermeasure type information “authentication” and countermeasure content “(subject) sales support system (subject) authenticates (operates) general users” are countermeasure information definitions that already exist in the information processing system to be analyzed. Added to Table 104. On the other hand, as a result of the determination in step S9, when the analyst does not press the countermeasure addition button g58 (step S9: “No”), the process returns to step S5.

  Further, the threat extraction unit 34 extracts threats that can be countered by the countermeasure added to the countermeasure information definition table 104 in step S10 based on the countermeasure-threat correspondence table 100 in the threat analysis information storage unit 31 (step S11). . In the previous example, the subject “non-general user is a general user”, the target “to sales support system” and the operation “spoof” are extracted. Here, first, the threat extraction unit 34 refers to the threat content information associated in the countermeasure-threat correspondence table 100 with the countermeasure type information that matches the countermeasure type information of the countermeasure information added to the countermeasure information definition table 104 in step S10. Are read from the countermeasure-threat correspondence table 100. Subsequently, the threat extraction unit 34 replaces the variable element included in the read threat content information with the value selected in the countermeasure information definition table 104 based on the countermeasure type information added in step S10. . In the previous example, the value of the participant indicated by the countermeasure target associated with the countermeasure type information in the countermeasure information definition table 104 in the brackets of the threat actor “other than [participant] is [participant]”. The countermeasures associated with the countermeasure type information in the countermeasure information definition table 104 are replaced with “general user” and the brackets of the threat target “for [System]” in the read threat content information are within the brackets. Replace with the value “sales support system” of the name indicated by the subject.

  As a result, the threat extraction unit 34 extracts the threat subject after replacement “other than general users to general users”, the threat target “for sales support system” and the operation “spoof” after replacement.

  Thereafter, as shown in FIGS. 14 and 15, the threat extraction unit 34 adds (stores) the threat content information extracted in step S11 to the first threat table 105 (step S12). In this example, the threat content “(subject) other than general user impersonates general user (target) (operation) for sales support system” is added to first threat table 105.

  Note that the processing in steps S5 to S12 described above is repeated until the end button g59 displayed on the countermeasure requirement input screens G50 to G52 is pressed by the analyst.

  As described above, according to the first embodiment, the threat information storage unit 31 that stores the countermeasure-threat correspondence table 100 in advance, the input unit 33 that inputs information on the countermeasure contents in the countermeasure-threat correspondence table 100, With the configuration including the countermeasure information definition table 104 obtained by this input and the threat extraction unit 34 that obtains the first threat table 105 from the countermeasure-threat correspondence table 100, a normal forward direction of obtaining countermeasures from threats is obtained. Unlike threat analysis, it is possible to perform reverse threat analysis in which a threat that can be covered by this countermeasure is derived from a countermeasure that already exists in the information processing system to be analyzed.

(Second Embodiment)
FIG. 16 is a functional block diagram showing an example of the configuration of the threat analysis support apparatus according to the second embodiment. The same reference numerals are given to substantially the same parts as those in FIG. The part is mainly described.

  That is, in the second embodiment, as described in the first embodiment, the normal forward threat analysis in which the countermeasure is obtained from the threat is performed after the threat analysis in the opposite direction to the normal direction in which the threat is obtained from the countermeasure. It is a form to execute.

  Specifically, the threat analysis support apparatus 30 further includes a forward threat analysis unit 37 and a threat analysis difference detection unit 38 in addition to the units 31 to 36 shown in FIG. I have. Accordingly, the system information storage unit 32 stores the second threat table 106 and the differential threat table 107 in addition to the information 101 to 105 shown in FIG.

  Here, the forward threat analysis unit 37 relates to a threat to the element or the protected asset information, and performs a threat actor indicating the participant or a third party, a threat target indicating the element name or the protected asset information, and a threat operation indicating the operation. When the input of the threat content information including the threat content information is received, the threat content information is written in the system information storage unit 32 as the second threat definition table 106. Note that this threat content information extraction method may be extracted by an analyst by himself / herself, or may be extracted using a technique for automatically extracting threats by a method such as that disclosed in Patent Document 2. No limitation here. For convenience of explanation, this function is represented as the forward threat analysis unit 37. However, the present invention is not limited thereto, and the forward threat analysis unit 37 may be omitted by adding this function to the input unit 33.

  The second threat table 106 is threat content information written by forward threat analysis, and is a threat subject indicating the value of a participant, a name of an element constituting the system, or a value of protected asset information. It consists of threat content information including target and threat operations. That is, the second threat table 106 has a format common to the format of the first threat table 105.

  The threat difference detection unit 38 compares the first and second threat tables 105 and 106 to compare threats that are included in the second threat table 106 but not included in the first threat table 105. It has a function of detecting content information and writing this threat content information as differential information (differential threat information) in the differential threat table 107.

  The differential threat table 107 is threat content information that is included in the second threat table 106 but not included in the first threat table 105, and constitutes a threat subject and a system that indicate the values of participants. It consists of the threat target indicating the value of the element name or the value of the protected asset information, and the threat content information including the threat operation. That is, the differential threat table 107 has a format common to the formats of the first and second threat tables 105 and 106. The differential threat table 107 is extracted in the forward threat analysis, but not extracted in the reverse threat analysis. Therefore, even though it exists as a threat in the information processing system to be analyzed, countermeasures are still being taken. Represents a threat that is not.

  Next, the operation of the threat analysis support apparatus configured as described above will be described with reference to the flowchart of FIG. However, it is assumed that the reverse threat analysis shown in the first embodiment has already been executed, and the system information storage unit 32 stores the result of the reverse threat analysis.

  In the forward threat analysis, the forward threat analysis unit 37 is a threat that indicates the content of a threat that exists on the analysis target system by the operation of the analyst while displaying the system individual information in the system information storage unit 32. The input of content information is accepted (step S21).

  Subsequently, the forward threat analysis unit 37 adds (stores) the threat content information received in step S21 to the second threat table 106 in the system information storage unit (step S22).

  Next, the threat difference detection unit 38 is included in the second threat table 106 by comparing the first threat table 105 and the second threat table 106 stored in the system information storage unit 32. However, the difference information that is not included in the first threat table 105 is detected (step S23).

  Thereafter, the differential threat detection unit 38 adds (stores) the detected differential information to the differential threat table 107 in the system information storage unit 32 (step S24).

  As described above, according to the second embodiment, a forward analysis unit 37 that inputs threat content information in forward threat analysis, and a threat that detects difference information between the first and second threat tables 105 and 106. With the configuration including the difference detection unit 38, when performing threat analysis, it is possible to detect an unmeasured differential threat by excluding threats analyzed in the reverse direction from threats obtained by forward threat analysis. Therefore, by examining the security measures against this unmeasured differential threat, it is possible to efficiently add the security measures that are lacking in the information processing system to be analyzed.

  In addition, according to at least one embodiment described above, the implementation has already been determined by performing a reverse threat analysis such as deriving a threat that can be covered by this countermeasure from a countermeasure that already exists in the analysis target system. Since it is no longer necessary to formulate countermeasures, the labor and cost of threat analysis can be reduced.

  The various functions and processing procedures described in each embodiment described above are stored as a computer program in a computer-readable storage medium (for example, a magnetic disk, an optical disk, and a semiconductor memory), and the processor and processor are used as necessary. May be read out and executed. Such a computer program can also be distributed by transmitting from one computer to another computer via a communication medium.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 10 ... Computer, 20 ... External storage device, 21 ... Program, 30 ... Threat analysis support device, 31 ... Threat analysis information storage part, 32 ... System information storage part, 33 ... Input part, 34 ... Threat extraction part, 35 ... Output , 36 ... control unit, 37 ... forward threat analysis unit, 38 ... threat difference detection unit, 100 ... countermeasure-threat correspondence table, 101 ... participant definition table, 102 ... protected asset definition table, 103 ... system element definition table 104 ... Countermeasure information definition table, 105 ... First threat table, 106 ... Second threat table, 107 ... Differential threat table.

Claims (4)

A threat analysis support device that supports threat analysis for an information processing system to be analyzed,
Participant definition information storage means for storing participant definition information that defines a participant who can access the information processing system;
Of the information stored in the information processing system, protected asset definition information storage means for storing protected asset definition information that defines protected asset information that is a protection target;
System element definition information storage means for storing system element definition information that defines a name and a type in association with elements constituting the information processing system;
Regarding the security measure function implemented in the information processing system, each measure type information indicating the type is replaced within the type defined in the system element definition information or the protected asset information defined in the protected asset definition information Countermeasure entity indicating the countermeasure entity variable element to be replaced within the scope of the countermeasure entity indicating the countermeasure entity variable element, the participant defined in the participant definition information or the protected asset information defined in the protected asset definition information And countermeasure content information including a countermeasure operation indicating an operation including a countermeasure operation variable element to be replaced within the scope of the protected asset information defined in the protected asset definition information or an operation not including the countermeasure operation variable element, and the security For threats that can be countered by the countermeasure function, it indicates a threat actor variable element that is replaced within the scope of the participant defined in the participant definition information or A threat subject indicating an attacker, a threat target indicating a threat target variable element to be replaced within the type defined in the system element definition information or the protected asset information defined in the protected asset definition information, and a threat indicating an operation Correspondence table storage means for storing a countermeasure threat correspondence table indicating the threat content information including the operation in association with each other
Upon receiving designation of the countermeasure type information, means for displaying the countermeasure content information associated with the countermeasure type information;
While the countermeasure content information is being displayed, if the selection of the countermeasure entity in the countermeasure content information is accepted, the type value defined in the system element definition information associated with the countermeasure entity variable element in the countermeasure entity or the protected asset definition When the value of the protected asset information defined in the information is displayed and the selection of the value of the displayed type or the value of the protected asset information is accepted, the value of the name associated with the value of the type that accepted the selection or the selection Means for replacing the countermeasure entity variable element with the value of the protected asset information received
When the countermeasure content information is displayed, when the selection of the countermeasure target in the countermeasure content information is accepted, the value of the participant defined in the participant definition information in association with the countermeasure target variable element in the countermeasure target or the protected asset When the value of the protected asset information defined in the definition information is displayed and the selection of the displayed participant's value or the value of the protected asset information is accepted, the value of the participant who received this selection or the value of the protected asset information is displayed. Means for replacing the countermeasure target variable element;
While the countermeasure content information is being displayed, if the countermeasure operation in the countermeasure content information includes a countermeasure operation variable element and accepts the selection of the countermeasure operation, the protected asset definition information is associated with the countermeasure operation variable element in the countermeasure operation. Means for displaying the value of the defined protected asset information and accepting a selection of the value of the displayed protected asset information, replacing the countermeasure operation variable element with the value of the protected asset information that has accepted this selection;
The countermeasure type information that has received the designation, and the countermeasure content information associated with the countermeasure type information, the countermeasure entity indicating the value of the replaced name or the value of protected asset information, and the replaced participant Countermeasure information defining countermeasure information indicating a value or value of protected asset information and countermeasure information definition information indicating the value of the replaced protected asset information or the countermeasure content information including the countermeasure operation indicating the operation Means for writing to the definition storage means;
The countermeasure information definition storage means for storing the written countermeasure information definition information;
When each countermeasure information in the countermeasure information definition information includes a threat subject variable element in the threat subject of the threat content information associated with the countermeasure type information of the countermeasure information in the countermeasure threat correspondence table, the threat subject variable element Means for replacing the value of the participant indicated by the countermeasure target associated with the countermeasure type information in the countermeasure information definition information,
For each countermeasure information in the countermeasure information definition information, a threat target variable element included in the threat target in the threat content information associated with the countermeasure type information of the countermeasure information in the countermeasure threat correspondence table is defined as the countermeasure information definition. Means for replacing with a name value or a value of protected asset information indicated by any of the countermeasure entity, countermeasure target or countermeasure operation associated with the countermeasure type information in the information;
Threat content information associated with the countermeasure type information matching the countermeasure type information in the countermeasure information definition information, the threat subject indicating the value of the replaced participant, the value of the replaced name, or the protected asset Means for writing the threat target indicating the value of the information and the threat content information including the threat operation into the threat definition storage means as first threat definition information;
The threat definition storage means for storing the written first threat definition information;
A threat analysis support apparatus comprising: The threat analysis support device according to claim 1,
Regarding threats to the element or the protected asset information, input threat content information including a threat subject indicating a participant or a third party, a threat target indicating the name of the element or the protected asset information, and a threat operation indicating an operation. If accepted, means for writing this threat content information as second threat definition information in the threat definition storage means;
Comparing the first and second threat definition information to detect threat content information that is included in the second threat definition information but not included in the first threat definition information; Means for writing this threat content information as differential threat information in the differential threat storage means;
The differential threat storage means for storing the written differential threat information;
A threat analysis support apparatus characterized by further comprising: Participant definition information storage means for storing participant definition information for defining participants who can access the information processing system to be analyzed, and protected asset information to be protected among the information stored in the information processing system. Protected asset definition information storage means for storing protected asset definition information to be defined; system element definition information storage means for storing system element definition information that is defined in association with names and types with respect to elements constituting the information processing system; Regarding the security measure function implemented in the information processing system, each measure type information indicating the type is replaced within the type defined in the system element definition information or the protected asset information defined in the protected asset definition information Countermeasure entity indicating a countermeasure entity variable element to be executed, a participant defined in the participant definition information or the protected asset definition information An operation including a countermeasure target indicating a countermeasure target variable element to be replaced within the scope of defined protected asset information and a countermeasure operation variable element to be replaced within the scope of the protected asset information defined in the protected asset definition information or Threat content that is replaced within the scope of the participant defined in the participant definition information regarding the countermeasure content information including the countermeasure operation indicating the operation not including the countermeasure operation variable element and the threat that can be countered by the security countermeasure function Indicates a threat subject indicating a variable element or a third party, a type defined in the system element definition information, or a threat target variable element to be replaced within the scope of protected asset information defined in the protected asset definition information Correspondence table storage means for storing a countermeasure threat correspondence table indicating the threat target and threat content information including threat operation indicating the operation in association with each other, countermeasure information definition storage means, and threat A threat analysis support program used for threat analysis support apparatus having a defined storage means, and
In the threat analysis support device,
Receiving the specification of the countermeasure type information, displaying the countermeasure content information associated with the countermeasure type information;
While the countermeasure content information is being displayed, if the selection of the countermeasure entity in the countermeasure content information is accepted, the type value defined in the system element definition information associated with the countermeasure entity variable element in the countermeasure entity or the protected asset definition When the value of the protected asset information defined in the information is displayed and the selection of the value of the displayed type or the value of the protected asset information is accepted, the value of the name associated with the value of the type that accepted the selection or the selection Replacing the countermeasure entity variable element with the value of the protected asset information that received
When the countermeasure content information is displayed, when the selection of the countermeasure target in the countermeasure content information is accepted, the value of the participant defined in the participant definition information in association with the countermeasure target variable element in the countermeasure target or the protected asset When the value of the protected asset information defined in the definition information is displayed and the selection of the displayed participant's value or the value of the protected asset information is accepted, the value of the participant who received this selection or the value of the protected asset information is displayed. Replacing the countermeasure target variable element;
While the countermeasure content information is being displayed, if the countermeasure operation in the countermeasure content information includes a countermeasure operation variable element and accepts the selection of the countermeasure operation, the protected asset definition information is associated with the countermeasure operation variable element in the countermeasure operation. Displaying the value of the defined protected asset information, and upon receiving a selection of the value of the displayed protected asset information, replacing the countermeasure operation variable element with the value of the protected asset information that has accepted this selection;
The countermeasure type information that has received the designation, and the countermeasure content information associated with the countermeasure type information, the countermeasure entity indicating the value of the replaced name or the value of protected asset information, and the replaced participant Countermeasure information definition information indicating the countermeasure target indicating the value or the value of the protected asset information and the countermeasure content information including the countermeasure operation indicating the value of the replaced protected asset information or the countermeasure operation indicating the operation. Writing to the definition storage means;
When each countermeasure information in the countermeasure information definition information includes a threat subject variable element in the threat subject of the threat content information associated with the countermeasure type information of the countermeasure information in the countermeasure threat correspondence table, the threat subject variable element Replacing the value of the participant indicated by the countermeasure target associated with the countermeasure type information in the countermeasure information definition information,
For each countermeasure information in the countermeasure information definition information, a threat target variable element included in the threat target in the threat content information associated with the countermeasure type information of the countermeasure information in the countermeasure threat correspondence table is defined as the countermeasure information definition. Replacing in the information with the name value or the value of the protected asset information indicated by any of the countermeasure entity, countermeasure target or countermeasure operation associated with the countermeasure type information;
Threat content information associated with the countermeasure type information that matches the countermeasure type information in the countermeasure information definition information, the threat subject indicating the value of the replaced participant, the value of the replaced name, or the protected asset Writing a threat target indicating a value of information and the threat content information including the threat operation into the threat definition storage means as first threat definition information;
Threat analysis support program to execute In the threat analysis support program according to claim 3,
The threat analysis support apparatus further includes differential threat storage means,
In the threat analysis support device,
Regarding threats to the element or the protected asset information, input threat content information including a threat subject indicating a participant or a third party, a threat target indicating the name of the element or the protected asset information, and a threat operation indicating an operation. If accepted, writing the threat content information as second threat definition information in the threat definition storage means;
Comparing the first and second threat definition information to detect threat content information that is included in the second threat definition information but not included in the first threat definition information; Writing the threat content information as differential threat information in the differential threat storage means;
Threat analysis support program to execute

Images