JP5580261B2 - Security evaluation support apparatus and security evaluation support method - Google Patents

Description

  The present invention relates to a security evaluation support technology that supports security evaluation of a Web site.

  In recent years, with the spread of networks such as the Internet, various Web sites (Web systems) exist on the networks. Since a Web site is a system that is assumed to be used by an unspecified number of users, it is necessary to take various security measures to prevent unauthorized intrusion and attacks from the outside. Even after security measures, it is necessary to check whether the security measures are flawed or have vulnerabilities.

  For example, Patent Document 1 describes a system for evaluating the presence / absence of a vulnerability in a Web application.

JP 2007-172517 A

  At present, when various services are provided on a network, the number of Web sites managed and operated by companies is increasing year by year. When there are a large number of Web sites to be managed, it is difficult to keep track of the status of each Web site because the workload of the system administrator is large.

  In addition, with the advancement of network technology and sophisticated techniques for unauthorized intrusion and external attacks, higher security is required, and security measures are becoming more complex. For this reason, it takes a lot of time and effort to check whether security measures have been taken for all of a large number of Web sites.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to easily acquire the security state of a Web site and support security evaluation.

  In order to solve the above-described problems, the present invention provides a security evaluation support apparatus for a website, which directly accesses an evaluation target website and collects direct information including port information, and external information. An external information collecting means for accessing the providing site and collecting external information as to whether or not the website is registered as a problem site; and the website based on the direct information collected by the direct information collecting means The first evaluation support information including the open port is generated, and the second evaluation support related to whether or not the Web site is registered as a problem site based on the external information collected by the external information collecting means Evaluation support means for generating information; output means for outputting the first evaluation support information and the second evaluation support information; A.

  Further, the present invention is a security evaluation support method for evaluating the security of a website performed by a computer, the direct information collecting step for accessing the evaluation target website and collecting the direct information including the port information, and the external The external information collection step of accessing the information providing site and collecting external information as to whether or not the website is registered as a problem site, and based on the direct information collected in the direct information collection step, Generating second evaluation support information including an open port of the Web site, and second relating to whether or not the Web site is registered as a problematic site based on the external information collected in the external information collecting step An evaluation support step for generating evaluation support information, the first evaluation support information and the previous And outputting the second evaluation support information, it is carried out.

  In the present invention, it is possible to easily acquire the security state of a Web site and support security evaluation.

1 is an overall configuration diagram of a security evaluation support system to which an embodiment of the present invention is applied. It is a figure which shows the hardware structural example of a security evaluation assistance apparatus. It is a flowchart which shows operation | movement of a security evaluation assistance apparatus. It is a flowchart which shows a related information collection process. It is a flowchart which shows a direct information collection process. It is a flowchart which shows an external information collection process. It is a figure which shows an example of evaluation assistance information. It is a figure which shows another example of evaluation assistance information.

  Embodiments of the present invention will be described below.

  FIG. 1 is an overall configuration diagram of a security evaluation support system to which an embodiment of the present invention is applied. The illustrated security evaluation support system includes a security evaluation support device 1, at least one Web system 2, an external site 3, and a Whois information site 4. The security evaluation support apparatus 1 can be connected to the Web system 2, the external site 3, and the Whois information site 4 via a network 9 such as the Internet.

  The security evaluation support apparatus 1 acquires the security state of each Web site 21 included in the Web system 2 for each Web system 2 (for each company) that is an evaluation target, and the security evaluation of each Web site 21 Detect deficiencies (vulnerabilities). That is, the security evaluation support apparatus 1 collectively checks how each Web site 21 is viewed from the outside (for example, an external hacker), and supports the security evaluation of each Web site 21. It is.

  The security evaluation support apparatus 1 according to the present embodiment periodically collects the status of each Web site 21 operated and managed by the company instead of the company that operates and manages the Web system 2 (Web site 21). The evaluation support information based on the acquired information is periodically provided to the company.

  The security evaluation support apparatus 1 shown in the figure includes a related information collection unit 10, a direct information collection unit 11, an external information collection unit 12, an evaluation support unit 13, an output unit 14, an information storage unit 15, and a check data storage. Part 16.

  The related information collection unit 10 collects (acquires) the Whois information of each Web site from at least one Whois information site 4. The direct information collection unit 11 directly accesses each evaluation target website 21 and collects information directly for each website 21. The external information collection unit 12 collects external information of each Web site from at least one external site 3 (information providing site).

  The evaluation support unit 13 generates first evaluation support information for each Web site 21 based on the direct information collected for each Web site 21, and the Web based on the external information collected for each Web site 21. Second evaluation support information relating to whether or not the site is registered as a problematic site is generated. Then, the evaluation support unit 13 stores the first evaluation support information and the second evaluation support information generated for each Web site 21 in the information storage unit 15. The output unit 14 outputs the first evaluation support information and the second evaluation support information for each Web site 21 stored in the information storage unit 15.

  The information storage unit 15 stores information about each Web site collected by each of the collecting units 10 to 12, evaluation support information of each Web site generated by the evaluation support unit 13, and the like. The check data storage unit 16 stores data for checking whether or not each Web site has security deficiencies (vulnerabilities).

  The Web system 2 is a system that provides a Web service to a user terminal (not shown) used by a user. The illustrated Web system 2 includes at least one Web site 21 (a group of Web pages published as a group), and provides a predetermined service to a user (user terminal) who accesses each Web site.

  The external site 3 is an external system site (information providing site) operated by various organizations or companies, and registers and holds the problematic site in the database (or list), and the website address (domain). Name, IP address, etc.) is a site that responds with a determination result as to whether or not the website is a problematic website registered in the database.

  The security evaluation support apparatus 1 according to the present embodiment accesses at least one external site 3 and obtains, as external information, a determination result as to whether or not each Web site 21 is registered as a problematic site from each external site 3. To do.

  Examples of the external site 3 include a phishing information site 31, a blacklist information site 32, a vulnerability information site 33, and a malware infection information site 34. The phishing information site 31 is a site that checks whether it has been registered in the phishing database as a phishing site by intruding into a server, falsified, or using a cross-site scripting vulnerability. The black list information site 32 is a site that checks whether or not it is registered in the black list (database) as a harmful site such as a spam mail distribution server or a malware distribution server.

  The vulnerability information site 33 is a site for checking whether or not a vulnerability exists in the Web application and is registered in the vulnerability information database. The malware infection information site 34 is a site for checking whether it is registered in the malware infection information database as a site infected with malware. Malware is malicious and harmful software such as computer viruses, worms, and spyware.

  The Whois information site 4 is a site that provides information on IP address and domain registrants.

  Each of the security evaluation support devices 1 described above includes, for example, a CPU 901, a memory 902, an external storage device 903 such as an HDD, an input device 904 such as a keyboard and a mouse, a display and a printer as shown in FIG. A general-purpose computer system including an output device 905 such as a communication control device 906 for connecting to a network can be used. In this computer system, each function of the security evaluation support apparatus 1 is realized by the CPU 901 executing the program of the security evaluation support apparatus 1 loaded on the memory 902.

  The program of the security evaluation support apparatus 1 can be stored in a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, a DVD-ROM, or can be distributed via a network.

  Next, the processing of this embodiment will be described.

  FIG. 3 is a flowchart showing an operation outline of the security evaluation support apparatus 1 of the present embodiment.

  First, the related information collection unit 10 generates a target list in which target Web sites are set (S11). Then, the processes of S13 and S14 are performed for each Web site in the generated target list (S12). That is, the direct information collection unit 11 accesses the target website and directly collects information (S13), and the external information collection unit 12 accesses each external site 3 and collects external information of the website. (S14). When the processes of S13 and S14 are completed for all websites in the target list, the evaluation support unit 13 generates evaluation information about all websites in the target list, and the output unit 14 displays the generated evaluation information. Or output to an output device such as a printer (S15).

  FIG. 4 is a flowchart showing details of the coping list generation process of S11 shown in FIG.

  The related information collection unit 10 reads a target list in which a list of Web sites to be evaluated is described and stores it in the information storage unit 15 (S21). In the target list, the domain name and IP address of each Web site managed and operated by a predetermined company are set.

  Then, the related information collection unit 10 performs the processing from S23 to S26 for each Web site in the read target list (S22). That is, the Whois information providing sites 41 and 42 are accessed, the domain name and IP address of the target Web site are input, and the Whois information of the domain of the Web site and the Whois information of the IP address are collected (S23). . Then, the related information collection unit 10 stores the collected Whois information in the information storage unit 15 in association with the target website. The domain's Whois information includes the following information, for example.

・ Registered domain name ・ Name server for registered domain name ・ Registration date of domain name ・ Expiration date of domain name ・ Name of registrant of domain name ・ Name of person in charge of technical communication, organization name / department, electronic E-mail address, telephone number ・ Name of the person in charge of registration, organization name / department, e-mail address ・ Name of e-mail address, telephone number, Web page, address IP address Similar information is also included in the Whois information.

  Then, the related information collection unit 10 extracts predetermined related information from the collected Whois information (S24). Then, the related information collection unit 10 stores the extracted related information in the information storage unit 15 in association with the target Web site. For example, it may be possible to extract the IP administrator from the Whois information of the IP address and the name and organization of the person in charge of domain registration from the Whois information of the domain.

  In addition, the related information collection unit 10 crawls the target website (S25), and performs the processing of S23 and S24 on other websites collected as a crawling result to obtain the related information of the other websites. It is good also as extracting (S26). When related information of another website is extracted, the IP address and domain name of the other website are added to the target list read in S21 and stored in the information storage unit 15, and the target list is updated (generated) )

  FIG. 5 is a flowchart showing details of the direct information collection processing of S13 shown in FIG. The direct information collection process directly accesses a target Web site and collects direct information such as open port information (open port information), banner information, and SSL information.

  Specifically, the direct information collection unit 11 accesses a target Web site and collects open port information (S31). That is, the direct information collection unit 11 performs a port scan that sequentially accesses a predetermined number of representative ports via the network 9 and checks whether there is a response. When there is a response from the port, the port is in an open state, and when there is no response from the port, the port is in a closed state.

  By this port scan, it can be detected that an unnecessary or unexpected port is in an open state. If an unnecessary or unexpected port is open, it may be subject to attacks such as unauthorized access via the port, and a security defect (vulnerability) such as patch application omission may occur. There is.

  The direct information collection unit 11 collects banner information (protocol banner information) for each open port detected in S31 (S32). Specifically, the direct information collection unit 11 executes a predetermined command for each open port, and acquires the type and version of software used from the response message (banner information). From this banner information, it is possible to detect security deficiencies such as using software on an unsupported platform.

  Further, when the HTTPS port is detected as an open port in S31, the direct information collection unit 11 accesses the HTTPS port through a normal SSL connection, and acquires SSL information from the response message. The SSL information includes, for example, a certificate issue destination, a certificate issue source, a certificate issue date, a certificate expiration date, a certificate signature algorithm, a public key length, a connectable encryption method, and the like. From this SSL information, the security level, the operation state, etc. are grasped, and for example, since a low-strength encryption method is used, it is possible to detect a security deficiency such that weak renegotiation is possible.

  The direct information collection unit 11 stores the information acquired in S31 to S33 in the information storage unit 15 in association with the target Web site.

  FIG. 6 is a flowchart showing details of the external information collection processing in S14 shown in FIG. In the external information collection process, each target external site is accessed, and external information indicating whether the target Web site is registered in the external site 3 as a problematic site is collected.

  Specifically, the external information collection unit 12 accesses the phishing information site 31, transmits the domain name or IP address of the target website, and whether the website is registered in the database as a phishing site. The check result is acquired (S41).

  Also, the external information collection unit 12 accesses the black list information site 32, transmits the domain name or IP address of the target website, and determines whether or not the website is registered in the black list (database). The check result is acquired (S42).

  In addition, the external information collection unit 12 accesses the vulnerability information site 33, transmits the domain name or IP address of the target website, and is the website registered as a vulnerable site in the database? The check result of whether or not is acquired (S43).

  Further, the external information collection unit 12 accesses the malware infection information site 34, transmits the domain name or IP address of the target website, and is registered in the database as a site where the website is infected with malware. The check result of whether or not it is acquired is acquired (S44).

  The external information collection unit 12 stores the external information, which is each check result acquired in S41 to S44, in the information storage unit 15 in association with the target Web site.

  Further, the external information collection unit 12 may access external sites (for example, search sites) other than S41 to S44, and acquire reputation information (for example, reputation information, leaked information, etc.) of the Web site.

  Next, the process of generating evaluation support information (reputation report) in S15 shown in FIG. 3 will be described. The evaluation support unit 13 reads various types of information from the information storage unit 15 and generates evaluation support information for each Web site set in the target list.

  FIG. 7 is a diagram illustrating an example of the evaluation support information. In the illustrated evaluation support information, a domain name, an IP address, a category, related information 71, direct information 72, and external information 73 are set for each Web site. That is, as the related information 71, the IP administrator extracted from the Whois information and the organization name and name of the person in charge of domain registration are set. As direct information 72, open port information, banner information, and SSL information are set. As the external information 73, phishing registration presence / absence, blacklist registration presence / absence, vulnerability registration presence / absence, and malware infection registration presence / absence are set.

  Then, the evaluation support unit 13 uses the check data storage unit 16 or the like to check whether there is a security defect for each item set in the evaluation support information. If there is a defect, a warning message or the like is displayed in the evaluation support information. For example, “Open Port” on the No. 2 Web site is a maintenance port, and a port “21 / FTP” that does not need to be opened to the outside is open. In this case, the evaluation support unit 13 sets, in the evaluation support information, a warning message 74 such as “The maintenance port is open to the outside and there is a risk of misuse by Web-infected malware”.

  In addition, NO. 2 and NO. In the “banner information” of the third website, an unsupported platform is set. In this case, the evaluation support unit 13 sets a warning message 75 such as “A platform that is not supported” is used in the evaluation support information.

  In addition, NO. In “SSL information” of one Web site, a date before the current time is set as the expiration date. In this case, the evaluation support unit 13 sets a warning message 76 such as “The server certificate has expired” in the evaluation support information.

  In addition, NO. In the “vulnerability registration” of the third website, “x” is described. In the example shown in the figure, when a response indicating that the external site 3 is not registered as a problem site is received from each external site 3, “○” is displayed, and a response indicating that the site is registered as a problem site is displayed. When received, “×” is set. Therefore, the evaluation support unit 13 sets a warning message 77 such as “Vulnerability information is disclosed on the network” in the evaluation support information.

  Further, the evaluation support information as shown in FIG. 8 may be generated by performing statistical processing / processing on the evaluation support information.

  FIG. 8A shows an example of open port result analysis by port scanning. In FIG. 8A, domains and IP addresses in which unnecessary open ports exist are totaled for the entire website, the consumer website, and the monthly page view (PV) for each predetermined website or more.

  FIG. 8B shows another example of open port result analysis by port scanning. In FIG. 8B, the domains and IP addresses where unnecessary open ports exist are tabulated for each operation organization. Also, whether the operation organization is its own company (a company that manages and operates a Web site) or an external company that consigns operations is classified and tabulated. For the operational organization, for example, it may be possible to use Whois information collected by the related information collection unit 10.

  By generating the evaluation support information as shown in FIG. 8B, when there are many outsourced companies as operation contractors of Web sites where unnecessary ports are open, the communication conditions were not confirmed at the time of consignment. It is speculated that this can be countered.

  Then, the output unit 14 outputs the evaluation support information generated by the evaluation support unit 13. The evaluation support information as shown in FIG. 7 and FIG. 8 can provide optimal security in the short term, for example, IP address-based filtering, version information concealment, server version upgrade, patch application, SSL setting change, etc. Measures can be presented. Further, in the medium term, for example, it is possible to present optimal security measures such as change of an outsourced company (hosting company), server replacement, authentication using a client certificate, and change of an SSL certificate.

  In the present embodiment described above, the security status of each website can be easily acquired by collecting related information, direct information, and external information of each website to be evaluated. As a result, it is possible to detect security deficiencies and vulnerabilities of the Web site, and support the security evaluation of the Web site.

  Further, in the present embodiment, even when there are a large number of target websites, it is possible to obtain the security status in a lump, thereby reducing the workload of the system administrator. it can.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary.

  1: security evaluation support device, 10: related information collection unit, 11: direct information collection unit, 12: external information collection unit, 13: evaluation support unit, 14: output unit, 15: information storage unit, 16: check data storage Part 2: Web system 21: Web site 3: external site 31: phishing information site 32: blacklist information site 33: vulnerability information site 34: malware infection information site 4: Whois information site 9: Network

Claims (3)

A security evaluation support device for a website,
Direct information collection means for accessing the evaluation target website and collecting direct information including port information;
An external information collection means for accessing an external information providing site and collecting external information as to whether or not the website is registered as a problematic site;
Based on the direct information collected by the direct information collecting means, first evaluation support information including an open port of the website is generated, and the website is based on the external information collected by the external information collecting means. An evaluation support means for generating second evaluation support information regarding whether or not the site is registered as a problem site;
An output means for outputting the first evaluation support information and the second evaluation support information. A security evaluation support apparatus, comprising: The security evaluation support device according to claim 1,
The direct information collecting means accesses each of a plurality of websites to be evaluated, collects the direct information for each website,
The external information collecting means collects the external information for each website,
The evaluation support means generates the first evaluation support information for each website based on the direct information collected for each website, and also for each website based on the external information collected for each website. Generating second evaluation support information;
The output means outputs the first evaluation support information and the second evaluation support information for each Web site. A security evaluation support method for evaluating the security of a website performed by a computer,
A direct information collection step of accessing a website to be evaluated and collecting direct information including port information;
An external information collecting step of accessing an external information providing site and collecting external information as to whether or not the website is registered as a problematic site;
Based on the direct information collected in the direct information collecting step, first evaluation support information including an open port of the website is generated, and the website is based on the external information collected in the external information collecting step. An evaluation support step for generating second evaluation support information regarding whether or not the site is registered as a problem site;
An output step of outputting the first evaluation support information and the second evaluation support information. A security evaluation support method comprising:

Images