JP7078562B2 - Computer system, analysis method of impact of incident on business system, and analysis equipment - Google Patents

Description

The present invention relates to a technique for formulating security measures for preventing an incident from affecting a business system.

In recent years, cyber attacks targeting private companies, defense-related companies, public institutions, etc. have become apparent, and the risk of damaging the interests and security of individuals, companies, and the nation is increasing. In addition, the attack methods are becoming more sophisticated, and targeted attacks that infiltrate the networks of specific government offices, companies, and organizations by skillfully utilizing advanced malware to steal confidential information and destroy systems are security-related. It is a big threat. Against this background, it is important to quickly analyze threats and formulate countermeasures based on the analysis results.

For example, in Patent Document 1, a malware candidate sample is received from a FW (FireWall), a malware candidate sample is analyzed using a virtual machine to determine whether or not the malware candidate sample is malware, and the malware candidate sample is analyzed. A system has been disclosed that automatically generates a signature when it is determined to be malware.

Japanese Patent Publication No. 2014-511113

By using the technique of Patent Document 1, it is possible to prevent attacks by unknown malware that cannot be prevented by general antivirus software.

However, the technique of Patent Document 1 is not a technique for evaluating the influence on a plurality of business systems. Therefore, by utilizing the information about the incident that occurred in another business system (for example, the business system operated by a certain company), the influence of the incident on the business system to be evaluated (for example, the business system operated by the company). It is not possible to determine the presence or absence and formulate measures to prevent the impact. For example, malware detected in another business system may generate a signature even though it does not affect the business system to be evaluated, and the generated signature may adversely affect the business system.

An object of the present invention is to analyze the impact of an incident on a business system to be evaluated by utilizing information on an incident that has occurred in another business system.

A typical example of the present invention is as follows. That is, it is a computer system including a plurality of computers, and each of the plurality of computers has a processor, a storage device connected to the processor, and an interface connected to the processor, and the computer system is a business. The business system management information that defines the judgment criteria for determining the configuration of each of the plurality of business systems and the presence or absence of influence is managed by connecting to a plurality of business systems that execute A first process for acquiring incident data including information on an incident, information on a method for detecting an impact on the first business system, and information on measures taken to eliminate the impact on the first business system. A second process for constructing an evaluation business system that is a business system connected to the computer system based on the business system management information and that simulates a business system different from the first business system, and the above. Based on the incident data, the incident that occurred in the first business system is reproduced on the evaluation business system, the third process for analyzing the influence of the incident on the evaluation business system, and the result of the analysis are output. In the third process, it is determined whether or not the determination criteria of the evaluation business system are satisfied based on the method of detecting the influence in the first business system. When it is determined that the determination criteria of the evaluation business system are satisfied, it is determined that the incident generated in the first business system has an influence on the evaluation business system, and the evaluation business system is described as described above. The process of applying the measures corresponding to the measures taken to eliminate the impact on the first business system and the incident that occurred in the first business system on the evaluation business system to which the measures are applied are reproduced. , The process of analyzing the influence of the evaluation business system on the incident is executed .

According to one embodiment of the present invention, it is possible to analyze the influence of an incident on the business system to be evaluated by utilizing the information on the incident generated in another business system. Issues, configurations and effects other than those mentioned above will be clarified by the description of the following examples.

It is a figure which shows the configuration example of the computer system which concerns on Example 1. FIG. It is a figure which shows an example of the data structure of the incident data management information of Example 1. FIG. It is a figure which shows an example of the data structure of the business system management information of Example 1. FIG. It is a figure which shows an example of the data structure of the incident reproduction result management information of Example 1. FIG. It is a flowchart explaining an example of the process executed by the incident reproduction apparatus of Example 1. FIG. It is a flowchart explaining an example of the incident reproduction processing executed by the incident reproduction apparatus of Example 1. FIG. It is a figure which shows an example of the display screen which displays the incident reproduction result of Example 1. FIG. It is a figure which shows the configuration example of the incident reproduction apparatus of Example 2. It is a figure which shows an example of the data structure of the attack method management information of Example 2. It is a flowchart explaining an example of the process executed by the incident reproduction apparatus of Example 2. FIG. It is a flowchart explaining an example of the incident reproduction processing executed by the incident reproduction apparatus of Example 2. FIG.

First, the outline of the actual invention will be described.

In this specification, when an individual, a company, a country, etc. that operates a business system is not distinguished, it is described as an organization.

In an organization that operates a business system in which an incident (security incident) has occurred, the threat that is the cause of the incident is identified and threats are identified by SOC (Security Operation Center) and CSIRT (Computer Security Incident Response Team) that exist in the organization. Detection methods will be established and countermeasures against threats will be taken.

In the present invention, the incident reproduction device 110 (see FIG. 1) acquires incident data including information on threats identified in an organization, threat detection methods, and actions taken to eliminate the effects of the threats. Then, the incident is reproduced on the business system operated by the organization to be evaluated. When the incident reproduction device 110 has an influence on the business system due to the incident, the incident reproduction device 110 devises a measure for preventing the influence.

By executing the above processing, it is possible to formulate measures to prevent the impact of an incident occurring in a certain business system on the business system to be evaluated. This makes it possible to prevent the occurrence of similar incidents in a plurality of business systems.

Hereinafter, examples of the present invention will be described with reference to the drawings. However, the present invention is not limited to the description of the examples shown below. It is easily understood by those skilled in the art that a specific configuration thereof can be changed without departing from the idea or purpose of the present invention.

In the configuration of the invention described below, the same or similar configurations or functions are designated by the same reference numerals, and duplicate description will be omitted.

The notations such as "first", "second", and "third" in the present specification and the like are attached to identify the components, and are not necessarily limited in number or order.

The position, size, shape, range, etc. of each configuration shown in the drawings and the like may not represent the actual position, size, shape, range, etc., in order to facilitate understanding of the invention. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings and the like.

FIG. 1 is a diagram showing a configuration example of a computer system according to the first embodiment.

The computer system is composed of systems 100 operated by different organizations. In FIG. 1, it is composed of systems 100A, 100B, 100C, and 100D operated by organizations A, B, C, and D. The present invention is not limited to the number of systems 100 constituting the computer system.

The systems 100A, 100B, 100C and 100D are connected to each other via the network 101. The network 101 is, for example, a WAN (Wide Area Network) or the like. The connection method of the network 101 may be either wired or wireless.

The system 100A includes an incident reproduction device 110, an evaluation environment 140, and a production environment 150. The incident reproduction device 110 may be present in only one system 100.

The production environment 150 is an environment for constructing a business system (not shown) that actually performs business. For example, a file server, a WEB server, a DNS (Domain Name System) server, and the like can be mentioned as business systems. The production environment 150 includes a plurality of computers and network devices, as well as various software.

The evaluation environment 140 is an environment for constructing an evaluation business system 141 that simulates a business system that analyzes the impact of an incident. In the evaluation environment 140 of FIG. 1, an evaluation business system A141A, an evaluation business system B141B, and an evaluation business system C141C are constructed. Each evaluation business system 141 is connected to the incident reproduction device 110 via the network 142. The network 142 is, for example, a LAN (Local Area Network) or the like. The connection method of the network 142 may be either wired or wireless.

In the first embodiment, the evaluation business system 141 simulating the business system operating in the own system 100A is constructed in the evaluation environment 140. An evaluation business system 141 simulating a business system operating on other systems 100B, 100C, and 100D may be constructed.

The incident reproduction device 110 constructs the evaluation business system 141 in the evaluation environment 140, reproduces the incident on the evaluation business system 141, and analyzes the influence of the incident on the evaluation business system 141.

The incident reproduction device 110 is a computer having a CPU (Central Processing Unit) 113, a main memory 114, a storage device 115, an interface 112, and an input / output device 116. The hardware is connected to each other via the communication path 117. The communication path 117 is an information transmission medium such as a bus and a cable.

The CPU 113 executes a program stored in the main memory 114. When the CPU 113 executes processing according to a program, it operates as a functional unit (module) that realizes a specific function.

The main memory 114 stores a program executed by the CPU 113 and data used when the program is executed. Further, the main memory 114 includes a work area temporarily used by the program. Details of the program stored in the main memory 114 will be described later.

The storage device 115 permanently stores a large amount of data. The storage device 115 is, for example, an HDD (Hard Disk Drive), a flash memory, or the like. Details of the data stored in the storage device 115 will be described later.

The interface 112 is an interface for communicating with other devices. The interface 112 is, for example, a NIC (Network Interface Card). In FIG. 1, the incident reproduction device 110 communicates with other systems 100B, 100C, 100D via the interface 112A, and communicates with the evaluation environment 140 and the production environment 150 via the interface 112B.

The input / output device 116 is a device for inputting data to the incident reproduction device 110 and outputting the data from the incident reproduction device 110. The input / output device 116 is composed of, for example, a keyboard, a mouse, a touch panel, a display, and the like.

Here, a program stored in the main memory 114 will be described. The main memory 114 stores an incident data reception program 121, a business system construction program 122, an incident reproduction program 123, an impact analysis program 124, a countermeasure application program 125, and a presentation program 126.

The program stored in the main memory 114 may be stored in the storage device 115 or may be stored in an external device. When the program is stored in the storage device 115, the CPU 113 reads the program from the storage device 115 and loads it into the main memory 114. When the program is stored in the external device, the CPU 113 acquires the program from the external device via the input / output device 116 or the interface 112, and installs (loads) the program in the main memory 114.

The incident data receiving program 121 is a program executed to receive incident data including information related to an incident generated in a business system operating on a system 100 of another organization.

The business system construction program 122 is a program executed for constructing the evaluation business system 141 in the evaluation environment 140.

The incident reproduction program 123 is a program executed to reproduce an incident on the evaluation business system 141.

The impact analysis program 124 is a program executed to analyze the impact of the reproduced incident on the evaluation business system 141.

The countermeasure application program 125 is a program executed to apply countermeasures to the evaluation business system 141.

The presentation program 126 is a program executed to present the analysis result to the user as an incident reproduction result. For example, by executing the presentation program 126, information visualization (screen display), audio reproduction, and the like are performed.

As the program stored in the main memory 114, a plurality of programs may be combined into one program, or one program may be divided into a plurality of programs. For example, the incident reproduction program 123 and the impact analysis program 124 may be combined into one program.

Next, the data stored in the storage device 115 will be described. The storage device 115 stores the incident data management information 131, the business system management information 132, and the incident reproduction result management information 133.

The incident data management information 131 is information for managing incident data. The details of the data structure of the incident data management information 131 will be described with reference to FIG.

The business system management information 132 is information for managing the configuration of the business system, the method of confirming the influence, and the like. The details of the data structure of the business system management information 132 will be described with reference to FIG.

The incident reproduction result management information 133 is information for managing the incident reproduction result. The details of the data structure of the incident reproduction result management information 133 will be described with reference to FIG.

FIG. 2 is a diagram showing an example of the data structure of the incident data management information 131 of the first embodiment.

Incident data management information 131 stores an entry composed of ID 201, date and time 202, organization 203, threat 204, detection method 205, and countermeasure 206. One entry corresponds to one incident data.

ID201 is a field for storing identification information for uniquely identifying incident data (entry).

The date and time 202 is a field for storing the date and time when the incident occurred. It is assumed that the times managed by each system 100 are synchronized.

The organization 203 is a field for storing identification information for identifying the system 100 in which the incident occurred, that is, the organization from which the incident data is transmitted.

Threat 204 is a field that stores information indicating the threat that is the cause of the incident. In this specification, the entity (program) that attacks the business system and the act that triggers the attack on the business system are defined as "threat".

The detection method 205 is a field that stores a method for detecting a threat. When a plurality of detection methods exist, the detection method 205 stores the plurality of detection methods. If the detection method is unknown, the detection method 205 is left blank.

The countermeasure 206 is a field for storing information regarding the countermeasures such as the actions and actions taken for the detected threat. When a plurality of actions are taken for an incident, the action means 206 stores information indicating the plurality of actions. If the countermeasure is unknown, the countermeasure 206 is blank.

The incident data corresponding to ID 201 "1" is the site of the organization B (system 100B) due to the fact that malware A was detected as a threat at 00:00 on 1/1/2018 and the infection of malware A. Communication to A and a. It indicates that the generation of the exe was observed, the communication to the site A was blocked, and the patch A was applied as a countermeasure.

The incident data corresponding to ID 201 "4" is that the malware C was identified as a threat at 00:00:30 on 1/1/2018 in the organization D (system 100D), and the detection method and countermeasures are unknown. Indicates that there is.

For convenience of explanation, the incident data is described as including information related to the incident that actually occurred in the organization (system 100), but the incident does not necessarily have to occur. Incident data management information 131 may store incident data containing information about known threats.

The incident data management information 131 is generated by the CPU 113 that executes the incident data receiving program 121. In addition, the incident data management information 131 is used when reproducing an incident on a business system, analyzing the impact of an incident on a business system, applying countermeasures to the business system, and presenting an incident reproduction result. Used.

FIG. 3 is a diagram showing an example of the data structure of the business system management information 132 of the first embodiment.

The business system management information 132 stores an entry composed of an ID 301, a system name 302, an OS 303, an application 304, and a determination criterion 305. One entry corresponds to one business system.

ID301 is a field for storing identification information for uniquely identifying a business system (entry).

The system name 302 is a field for storing the name of the business system. The OS 303 is a field for storing information indicating an OS (Operating System) used in a business system. The application 304 is a field for storing information indicating an application used in a business system.

The determination criterion 305 is a field for storing information regarding the criterion for determining whether or not the incident has an influence on the business system. Information indicating a plurality of determination criteria may be stored in the determination criterion 305. In this case, the incident reproduction device 110 determines that the incident has an influence on the business system if any of the determination criteria is satisfied.

The judgment criteria for the business system whose ID 301 corresponds to "1" are that OSA is used, business application A and database A are installed on OSA, business application A is stopped, data is falsified, or malware infection is performed. Indicates that it is set as.

It is assumed that the business system management information 132 is set in advance. However, the administrator of the computer system or the like may add, delete, and update entries as necessary. The business system management information 132 is used when the evaluation business system 141 is constructed in the evaluation environment 140.

FIG. 4 is a diagram showing an example of the data structure of the incident reproduction result management information 133 of the first embodiment.

The incident reproduction result management information 133 stores an entry composed of ID 401, incident ID 402, business system ID 403, impact 404, countermeasure 405, and post-application impact 406. One entry corresponds to one incident reproduction result.

ID 401 is a field for storing identification information for uniquely identifying the incident reproduction result.

The incident ID 402 is a field for storing the identification information of the reproduced incident. Incident ID 402 corresponds to ID 201.

The business system ID 403 is a field for storing the identification information of the evaluation business system 141 in which the incident has been reproduced. The business system ID 403 corresponds to the ID 301.

Impact 404 stores information indicating whether or not the reproduced incident has an impact on the evaluation business system 141. The effect 404 stores either "yes" or "no". "Yes" indicates that there is an effect, and "None" indicates that there is no effect.

The countermeasure 405 stores information indicating the countermeasure applied to the business system.

Post-application impact 406 stores information indicating whether or not the reproduced incident has an impact on the business system after the countermeasure is applied. Post-application impact 406 stores either "yes" or "no".

The incident reproduction result in which ID 401 corresponds to "1" is that the business system A is affected by the incident whose ID 201 is "1", and the business system A to which the measures of "site A blocking" are applied is also affected by the incident. Represents receiving.

The incident reproduction result management information 133 is generated by the CPU 113 that executes the impact analysis program 124. The incident reproduction result management information 133 is used when presenting the incident reproduction result.

Next, the details of the processing executed by the incident reproduction device 110 will be described.

FIG. 5 is a flowchart illustrating an example of processing executed by the incident reproduction device 110 of the first embodiment.

When the incident reproduction device 110 receives incident data from an arbitrary system 100 via the interface 112A (step S501), the incident reproduction device 110 determines whether or not the incident corresponding to the incident data is an incident caused by an unknown threat. (Step S502).

Specifically, the CPU 113 that executes the incident data receiving program 121 acquires information about the threat from the received incident. The CPU 113 refers to the incident data management information 131, and determines whether or not there is an entry that matches the information about the threat acquired by the threat 204. If there is no entry satisfying the above conditions, the CPU 113 determines that the incident corresponding to the received incident data is an incident caused by an unknown threat.

If it is determined that the incident corresponding to the received incident data is not an incident caused by an unknown threat, the incident reproduction device 110 ends the process. In this case, the CPU 113 that executes the incident data receiving program 121 ends the process without registering the received incident data in the incident data management information 131.

When it is determined that the incident corresponding to the received incident data is an incident caused by an unknown threat, the incident reproduction device 110 starts the loop processing of the business system (step S503).

Specifically, the CPU 113 that executes the incident data receiving program 121 registers the received incident data in the incident data management information 131, and starts the business system construction program 122. The CPU 113 that executes the business system construction program 122 selects one entry from the entries stored in the business system management information 132. In the following, the business system corresponding to the selected entry is described as the target business system.

Next, the incident reproduction device 110 constructs the evaluation business system 141 corresponding to the target business system in the evaluation environment 140 (step S504).

Specifically, the CPU 113 that executes the business system construction program 122 constructs the evaluation business system 141 in the evaluation environment 140 based on the OS 303 and the application 304 of the entries selected from the business system management information 132. After that, the CPU 113 starts the incident reproduction program 123.

Next, the incident reproduction device 110 executes an incident reproduction process for the constructed evaluation business system 141 (step S505). The details of the incident reproduction process will be described with reference to FIG.

Next, the incident reproduction device 110 determines whether or not the processing has been completed for all the business systems (step S506).

If it is determined that the processing has not been completed for all the business systems, the incident reproduction device 110 returns to step S503 and executes the same processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the business system construction program 122.

When it is determined that the processing is completed for all the business systems, the incident reproduction device 110 presents the incident reproduction result (step S507), and then ends the processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the presentation program 126. The CPU 113 that executes the presentation program 126 generates and outputs information (display information, audio information, etc.) for presenting the incident reproduction result. The screen displayed based on the display information will be described with reference to FIG. 7.

FIG. 6 is a flowchart illustrating an example of the incident reproduction process executed by the incident reproduction device 110 of the first embodiment.

The incident reproduction device 110 reproduces an incident corresponding to the received incident data on the constructed evaluation business system 141, and analyzes the influence of the incident (step S601). Specifically, the following processing is executed.

The CPU 113 that executes the incident reproduction program 123 reproduces an incident on the evaluation business system 141 based on the incident data. For example, the program (malware) corresponding to the threat 204 is executed, or the action against the threat 204 (access to the site) is executed. The CPU 113 that executes the incident reproduction program 123 activates the impact analysis program 124.

The CPU 113 that executes the impact analysis program 124 monitors the behavior of the evaluation business system 141 in which the incident is reproduced, and determines whether or not the criterion set in the criterion 305 of the entry selected in step S503 is satisfied. .. At this time, the CPU 113 monitors the behavior of the evaluation business system 141 by using the preset policy or the incident data detection method 205. To monitor the behavior of the evaluation business system 141 based on the preset policy, install and use a program for checking the operating process, the usage rate of the CPU 113, the presence or absence of data tampering, etc. in the evaluation business system 141. May be good.

The above is the description of the process of step S601.

Next, the incident reproduction device 110 determines whether or not the reproduced incident has an influence on the evaluation business system 141 (step S602).

Specifically, the CPU 113 that executes the impact analysis program 124 determines whether or not the determination criteria set in the determination criterion 305 are satisfied. When the determination criteria set in the determination criterion 305 are satisfied, the CPU 113 determines that the reproduced incident has an influence on the evaluation business system 141.

When it is determined that the reproduced incident does not affect the evaluation business system 141, the incident reproduction device 110 updates the incident reproduction result management information 133 (step S603), and then ends the incident reproduction process.

Specifically, the CPU 113 that executes the impact analysis program 124 adds an entry to the incident reproduction result management information 133, and sets the identification information in the ID 401 of the added entry. The CPU 113 stores the reproduced incident identification information in the incident ID 402 of the added entry, stores the identification information of the target business system in the business system ID 403, and stores "none" in the influence 404. In this case, the countermeasure 405 and the post-application impact 406 are blank.

When it is determined that the reproduced incident has an influence on the evaluation business system 141, the incident reproduction device 110 starts the coping loop processing (step S604). Specifically, the following processing is executed.

The CPU 113 that executes the impact analysis program 124 activates the countermeasure application program 125.

The CPU 113 that executes the countermeasure application program 125 refers to the incident data management information 131 and searches for an entry corresponding to the received incident data. The CPU 113 selects one of the countermeasures set in the countermeasure 206 of the searched entry.

The above is the description of the process of step S604.

Next, the incident reproduction device 110 applies the selected countermeasure to the evaluation business system 141 as a countermeasure (step S605).

Specifically, the CPU 113 that executes the countermeasure application program 125 applies the selected countermeasure to the evaluation business system 141 as a countermeasure. The CPU 113 activates the incident reproduction program 123.

Next, the incident reproduction device 110 reproduces the incident corresponding to the received incident data on the evaluation business system 141 to which the countermeasure is applied, and analyzes the influence of the incident (step S606). The process of step S606 is the same as the process of step S601.

Next, the incident reproduction device 110 updates the incident reproduction result management information 133 (step S607).

Specifically, the CPU 113 that executes the impact analysis program 124 adds an entry to the incident reproduction result management information 133, and sets the identification information in the ID 401 of the added entry. The CPU 113 stores the reproduced incident identification information in the incident ID 402 of the added entry, stores the identification information of the target business system in the business system ID 403, and stores "Yes" in the influence 404. The CPU 113 stores the information indicating the countermeasure selected in step S604 in the countermeasure 405 of the added entry, and stores the analysis result in the post-application effect 406. The analysis result is either "yes" or "no".

Next, the incident reproduction device 110 determines whether or not the processing has been completed for all the countermeasures (step S608).

If it is determined that the processing has not been completed for all the measures, the incident reproduction device 110 returns to step S604 and executes the same processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the countermeasure application program 125.

When it is determined that the processing has been completed for all the measures, the incident reproduction device 110 ends the incident reproduction processing.

By verifying multiple countermeasures, it is possible to broaden the range of choices for applicable countermeasures, such as extracting measures that are easy to apply or countermeasures that are low in cost.

FIG. 7 is a diagram showing an example of a display screen displaying the incident reproduction result of the first embodiment.

The display screen 700 is, for example, a screen displayed on the input / output device 116, and includes a path column 701, an incident information column 702, a countermeasure column 703, and an incident reproduction result column 704. The display screen 700 shown in FIG. 7 is an example, and the present invention is not limited to this. A column (not shown) may be included, or any column may not be included.

The path column 701 is a column for displaying the path in which the incident reproduction result management information 133 is stored.

The incident information column 702 is a column for displaying information regarding an incident that has occurred in another organization. In the incident information column 702, the information included in the received incident data is displayed. For example, in the incident information column 702, the date and time when the incident occurred, the organization in which the incident occurred, the identified threat, and the like are displayed.

The countermeasure column 703 is a column for displaying recommended countermeasures for each business system. In the countermeasure column 703, the countermeasure 405 of the entry in which the impact 404 is “yes” and the post-application impact 406 is “none” is displayed.

If there are a plurality of entries satisfying the above conditions for one business system, the countermeasure 405 for all the entries may be displayed, or the countermeasure 405 for some entries may be displayed.

If there is only an entry for which the impact 404 is "Yes" and the post-application impact 406 is "Yes" for one business system, "Unknown" is displayed in order to alert the administrator.

The incident reproduction result column 704 is a column for displaying the incident reproduction result of each business system.

In the incident reproduction result column 704, the information set in the incident reproduction result management information 133 is displayed.

Here, a process executed by the incident reproduction device 110 will be described with reference to a specific example. For convenience of explanation, it is assumed that there is no entry in the incident data management information 131 and the incident reproduction result management information 133. Further, it is assumed that only the entries of the business system A and the business system B exist in the business system management information 132.

In this example, the following incidents are assumed. In the system 100B of the organization B, an incident occurred at 00:00:00 on 1/1/2018. The SOC team of organization B identifies malware A as a threat, and the terminal infected with malware A communicates with site A, and a. Identified to generate an exe. On the other hand, the SOC team of the organization B took measures to block the site A and apply the patch A to the infected terminal.

The incident reproduction device 110 receives incident data including information on the above-mentioned incident (step S501).

In step S502, the CPU 113 that executes the incident data receiving program 121 determines that the incident is caused by an unknown threat because the incident data management information 131 is empty. At this time, the CPU 113 adds an entry to the incident data management information 131, stores "1" in the ID 201 of the added entry, and stores "2018/1/1 00: 00: 00" in the date and time 202. "Organization B" is stored in the organization 203, "malware A" is stored in the threat 204, "communication to the site A" and "generation of a.exe" are stored in the detection method 205, and "a.exe generation" is stored in the countermeasure 206. Stores "Site A block" and "Patch A application".

The processes of steps S504 and S505 are executed for each of the business system A and the business system B.

First, the CPU 113 that executes the business system construction program 122 selects the entry whose ID 301 is "1" (step S503), and constructs the evaluation business system A141A corresponding to the business system A in the evaluation environment 140 (step S504).

The CPU 113 that executes the incident reproduction program 123 executes the malware A on the evaluation business system A141A (step S601).

The CPU 113 that executes the impact analysis program 124 acquires the determination criterion 305 of the entry selected from the business system management information 132, and monitors the stoppage of the business application A, data falsification, and the occurrence of malware infection. Malware infection is monitored based on the incident data detection method 205. When at least one of "communication to the site A" and "generation of a.exe" is detected, the CPU 113 determines that the malware A is infected.

In this example, it is assumed that both "communication to site A" and "generation of a.exe" are detected. That is, it is assumed that the infection of malware A is detected. In this case, the CPU 113 that executes the impact analysis program 124 determines that the reproduced incident has an impact on the evaluation business system A141A (step S602 is Yes), and activates the countermeasure application program 125.

The CPU 113 that executes the countermeasure application program 125 selects either "site A blocking" or "patch A application" stored in the countermeasure 206 (step S604). Here, it is assumed that "Site A block" is selected.

The CPU 113 that executes the countermeasure application program 125 applies the settings and changes for realizing the "site A cutoff" to the evaluation business system A141A (step S605). For example, the setting is changed so as to block the communication to the site A on the evaluation business system A141A, or the Firewall for blocking the communication to the site A is installed in the network 142.

The CPU 113 that executes the incident reproduction program 123 executes the malware A on the evaluation business system A141A to which the countermeasure of "site A blocking" is applied (step S606). Here, a. It is assumed that the generation of exe is detected.

The CPU 113 that executes the impact analysis program 124 updates the incident reproduction result management information 133 (step S607). Specifically, the CPU 113 adds an entry to the incident reproduction result management information 133, stores "1" in the ID 401, stores "1" in the incident ID 402, and stores "1" in the business system ID 403. "Yes" is stored in the effect 404, "Site A block" is stored in the countermeasure 405, and "Yes" is set in the effect 406 after application.

In step S608, since there is an unprocessed countermeasure, the CPU 113 that executes the impact analysis program 124 returns to step S604 and starts the countermeasure application program 125. The CPU 113 that executes the countermeasure application program 125 selects "patch A application".

The CPU 113 that executes the countermeasure application program 125 applies the patch A to the evaluation business system A141A (step S605).

The CPU 113 that executes the incident reproduction program 123 executes the malware A on the evaluation business system A141A to which the countermeasure of "patch A application" is applied (step S606). Here, it is assumed that none of the suspension of the business application A, the data falsification, and the malware infection is detected.

The CPU 113 that executes the impact analysis program 124 updates the incident reproduction result management information 133 (step S607). Specifically, the CPU 113 adds an entry to the incident reproduction result management information 133, stores "2" in the ID 401, stores "1" in the incident ID 402, and stores "1" in the business system ID 403. "Yes" is stored in the effect 404, "Patch A application" is stored in the countermeasure 405, and "None" is set in the effect 406 after application.

In step S608, since all the handling processes have been completed, the incident reproduction device 110 ends the incident reproduction process.

Since there is an unprocessed business system in step S506, the CPU 113 that executes the impact analysis program 124 returns to step S503 and starts the business system construction program 122. The CPU 113 that executes the business system construction program 122 selects the entry whose ID 301 is "2" (step S503), and constructs the evaluation business system B141B corresponding to the business system B in the evaluation environment 140 (step S504).

The CPU 113 that executes the incident reproduction program 123 executes the malware A on the evaluation business system B141B (step S601).

The CPU 113 that executes the impact analysis program 124 acquires the determination criterion 305 of the entry selected from the business system management information 132, and monitors the stoppage of the business application B and the occurrence of data leakage.

In this example, it is assumed that a data leak has been detected. In this case, the CPU 113 that executes the impact analysis program 124 determines that the reproduced incident has an impact on the evaluation business system B141B (step S602 is Yes), and activates the countermeasure application program 125.

The CPU 113 that executes the countermeasure application program 125 selects either "site A blocking" or "patch A application" stored in the countermeasure 206 (step S604). Here, it is assumed that "Site A block" is selected.

The CPU 113 that executes the countermeasure application program 125 applies the settings and changes for realizing "site A cutoff" to the evaluation business system B141B (step S605). For example, the setting is changed so as to block the communication to the site A on the evaluation business system B141B, or the Firewall for blocking the communication to the site A is installed in the network 142.

The CPU 113 that executes the incident reproduction program 123 executes the malware A on the evaluation business system B141B to which the countermeasure of "site A blocking" is applied (step S606). Here, it is assumed that a data leak has been detected.

The CPU 113 that executes the impact analysis program 124 updates the incident reproduction result management information 133 (step S607). Specifically, the CPU 113 adds an entry to the incident reproduction result management information 133, stores "3" in the ID 401, stores "1" in the incident ID 402, and stores "2" in the business system ID 403. "Yes" is stored in the effect 404, "Site A block" is stored in the countermeasure 405, and "Yes" is set in the effect 406 after application.

In step S608, since there is an unprocessed countermeasure, the CPU 113 that executes the impact analysis program 124 returns to step S604 and starts the countermeasure application program 125. The CPU 113 that executes the countermeasure application program 125 selects "patch A application".

The CPU 113 that executes the countermeasure application program 125 applies the patch A to the evaluation business system B141B (step S605).

The CPU 113 that executes the incident reproduction program 123 executes the malware A on the evaluation business system B141B to which the countermeasure of "patch A application" is applied (step S606). Here, it is assumed that the stoppage of the business application B is detected.

The CPU 113 that executes the impact analysis program 124 updates the incident reproduction result management information 133 (step S607). Specifically, the CPU 113 adds an entry to the incident reproduction result management information 133, stores "4" in the ID 401, stores "1" in the incident ID 402, and stores "2" in the business system ID 403. "Yes" is stored in the effect 404, "Patch A application" is stored in the countermeasure 405, and "Yes" is set in the effect 406 after application.

In step S608, since all the handling processes have been completed, the incident reproduction device 110 ends the incident reproduction process.

Since the processing of all the business systems is completed in step S506, the CPU 113 that executes the impact analysis program 124 activates the presentation program 126. The CPU 113 that executes the presentation program 126 generates and outputs information for presenting the incident reproduction result (step S507). As a result, the display screen 700 as shown in FIG. 7 is presented to the user.

In addition, the following modified examples can be considered in Example 1.

(Modification 1) Even if the incident reproduction device 110 updates the business system management information 132 due to a change in the configuration of the business system and then executes processing using the incident data stored in the incident data management information 131. good. This makes it possible to analyze the impact of an incident on the latest business system.

(Modification 2) The incident reproduction device 110 may automatically apply the recommended countermeasures to the business system. For example, when it is determined that there is no influence of an incident by the measures applied to a certain business system, the incident reproduction device 110 automatically applies the measures to all or a specific business system. As a result, countermeasures can be quickly applied to the business system.

(Modification 3) Add the level of influence to the judgment criterion 305. For example, the criteria for each of small, medium, and large impacts are defined, and the impact level, countermeasures, and analysis results are presented. As a result, flexible countermeasure application processing can be realized, such as applying countermeasures when the impact of application of countermeasures is small.

(Modification 4) The CPU 113 that executes the countermeasure application program 125 may select a countermeasure different from the countermeasure included in the received incident data. For example, the CPU 113 may select a countermeasure included in the incident data stored in the incident data management information 131. This makes it possible to take countermeasures against threats for which countermeasures have not been clarified, such as the emergence of subspecies viruses.

(Modification 5) The CPU 113 that executes the business system construction program 122 may construct the evaluation business system 141 in the evaluation environment 140 in advance. This can reduce the time required for incident reproduction and analysis.

(Variation Example 6) The CPU 113 that executes the impact analysis program 124 may end the loop processing from step S604 to step S608 when a countermeasure that is not affected by the incident on the business system is specified. As a result, countermeasures can be applied quickly.

(Modification 7) The CPU 113 that executes the countermeasure application program 125 may apply a countermeasure that combines a plurality of countermeasures. This makes it possible to broaden the selection of applicable measures such as extraction of measures that are easy to apply or measures that are low in cost.

As described above, according to the first embodiment, it is possible to analyze the influence of the incident on the business system of the own organization by utilizing the information on the incident that occurred in another organization. In addition, it is possible to formulate effective countermeasures using the analysis results and prevent the occurrence of similar incidents in advance.

In Example 2, the incident reproduction device 110 reproduces an incident caused by an unknown attack. In Example 1, an incident that actually occurred in another organization was reproduced on a business system, and its influence was analyzed. However, attack methods are evolving day by day, and it is desirable to prevent the occurrence of incidents caused by unknown threats.

Hereinafter, Example 2 will be described with a focus on the differences from Example 1.

The configuration of the computer system of the second embodiment is the same as that of the first embodiment. In the second embodiment, the configuration of the incident reproduction device 110 is partially different.

FIG. 8 is a diagram showing a configuration example of the incident reproduction device 110 of the second embodiment.

The hardware configuration of the incident reproduction device 110 of the second embodiment is the same as that of the first embodiment. Further, the program stored in the main memory 114 of the second embodiment is also the same as that of the first embodiment.

In the second embodiment, the information stored in the storage device 115 is partially different. Specifically, the storage device 115 of the second embodiment stores the attack method management information 800 in addition to the incident data management information 131, the business system management information 132, and the incident reproduction result management information 133. The details of the data structure of the attack method management information 800 will be described with reference to FIG.

In Example 2, the incident data includes an attack scenario as a threat. Here, the attack scenario is a group of attack methods for achieving a specific purpose, and is a scenario composed of a plurality of attack methods.

For example, in a targeted attack, malware that has invaded an organization using an attached email or a watering hole attack downloads new malware and attack tools by communicating with a C & C (Command & Control) server operated by the attacker, and the organization. Achieve the ultimate objectives such as reconnaissance, establishment of attack base, destruction and information theft.

Here, an attacker investigates the OS using the OS investigation program A, invades the organization using the malware A, steals the authentication information using the authentication theft program A, and uses the remote execution program A. We assume an attack that spreads the infection and steals information using the information theft program A. In this case, the attack scenarios are "OS investigation (OS investigation program A), malware execution (malware A), authentication theft (authentication theft program A), remote execution (remote execution program A), information theft (information theft program A)". ". The order of attack methods represents the order of execution.

In the second embodiment, the incident data includes the attack scenario and the attack code used for the attack corresponding to the attack scenario (OS investigation program A, malware A, authentication theft program A, remote execution program A, information theft program A, etc.). Is also included.

FIG. 9 is a diagram showing an example of the data structure of the attack method management information 800 of the second embodiment.

The attack method management information 800 includes an entry composed of an ID 901, an attack classification 902, an attack method 903, a prerequisite 904, and an attack code 905. One entry corresponds to one attack method.

ID901 is a field for storing identification information for uniquely identifying an attack method (entry).

The attack classification 902 is a field for storing information indicating a rough classification of the attack method.

The attack method 903 is a field for storing information indicating the attack method.

The precondition 904 is a field for storing information indicating a precondition for executing the attack method corresponding to the attack method 903.

The attack code 905 is a field for storing an attack code for realizing an attack method corresponding to the attack method 903.

The attack method in which the ID 901 corresponds to "1" indicates that the OS investigation program A is used to perform a reconnaissance action for the purpose of investigating the OS.

In the second embodiment, it is assumed that the attack method management information 800 is set in advance. The administrator or the like may add, delete, and update the entry of the attack method management information 800 as necessary.

The attack method management information 800 is used when reproducing an incident.

FIG. 10 is a flowchart illustrating an example of processing executed by the incident reproduction device 110 of the second embodiment.

When the incident reproduction device 110 receives the incident data via the interface 112A (step S1001), the incident reproduction device 110 starts the loop processing of the business system (step S1002).

Specifically, the CPU 113 that executes the incident data receiving program 121 registers the received incident data in the incident data management information 131, and starts the business system construction program 122. The CPU 113 that executes the business system construction program 122 selects one entry from the entries stored in the business system management information 132. In the following, the business system corresponding to the selected entry is described as the target business system.

Next, the incident reproduction device 110 constructs the evaluation business system 141 corresponding to the target business system (step S1003).

Specifically, the CPU 113 that executes the business system construction program 122 constructs the evaluation business system 141 in the evaluation environment 140 based on the OS 303 and the application 304 of the entries selected from the business system management information 132. After that, the CPU 113 starts the incident reproduction program 123.

Next, the incident reproduction device 110 executes an incident reproduction process on the constructed evaluation business system 141 (step S1004). The details of the incident reproduction process will be described with reference to FIG.

Next, the incident reproduction device 110 determines whether or not the processing has been completed for all the business systems (step S1005).

If it is determined that the processing has not been completed for all the business systems, the incident reproduction device 110 returns to step S1002 and executes the same processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the business system construction program 122.

When it is determined that the processing is completed for all the business systems, the incident reproduction device 110 presents the incident reproduction result (step S1006), and then ends the processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the presentation program 126. The CPU 113 that executes the presentation program 126 generates and outputs information for presenting the incident reproduction result.

FIG. 11 is a flowchart illustrating an example of an incident reproduction process executed by the incident reproduction device 110 of the second embodiment.

The incident reproduction device 110 starts a loop of the attack scenario (step S1101). Specifically, the following processing is executed.

The CPU 113 that executes the incident reproduction program 123 generates a new attack scenario (verification attack scenario) by referring to the attack method management information 800 and changing the attack method that constitutes the attack scenario included in the incident data. ..

The CPU 113 that executes the incident reproduction program 123 selects one attack scenario from the generated attack scenarios.

For example, the attack scenarios included in the incident data are "OS investigation (OS investigation program A), malware execution (malware A), authentication theft (authentication theft program A), remote execution (remote execution program A), information theft (information theft). In the case of "program A)", the following processing is executed.

When "OS investigation (OS investigation program A)" is selected as the attack method to be changed, the CPU 113 that executes the incident reproduction program 123 searches for an entry whose attack classification 902 is "reconnaissance". The CPU 113 replaces the attack scenario "OS investigation (OS investigation program A)" with "vulnerable investigation (vulnerable investigation program A)" into an attack scenario and "vulnerable investigation (vulnerable investigation program B)". Generate a replaced attack scenario.

When "malware execution (malware A)" is selected as the attack method to be changed, the CPU 113 that executes the incident reproduction program 123 searches for an entry whose attack classification 902 is "initial intrusion". The CPU 113 generates an attack scenario in which the attack scenario "malware execution (malware A)" is replaced with "malware execution (malware B)" and an attack scenario in which "vulnerability utilization (exploit A)" is replaced.

By performing similar processing, multiple attack scenarios are generated. If the precondition 904 is set, the attack method is replaced when the precondition is satisfied.

The attack scenario included in the received incident data may also be output as a verification attack scenario. The above is the description of the process of step S1101.

Next, the incident reproduction device 110 reproduces the incident corresponding to the selected attack scenario on the constructed evaluation business system 141, and analyzes the influence of the incident (step S1102). Specifically, the following processing is executed.

The CPU 113 that executes the incident reproduction program 123 reproduces an incident on the evaluation business system 141 based on the selected attack scenario. The CPU 113 that executes the incident reproduction program 123 activates the impact analysis program 124.

The CPU 113 that executes the impact analysis program 124 monitors the behavior of the evaluation business system 141 in which the incident is reproduced, and determines whether or not the determination criteria set in the determination criteria 305 of the entry selected in step S1002 are satisfied. .. At this time, the CPU 113 monitors the behavior of the evaluation business system 141 by using the preset policy or the incident data detection method 205. To monitor the behavior of the evaluation business system 141 based on the preset policy, a program for confirming the operating process, the usage rate of the CPU 113, the presence or absence of data falsification, etc. may be used.

The above is the description of the process of step S1102.

Next, the incident reproduction device 110 determines whether or not the reproduced incident has an influence on the evaluation business system 141 (step S1103).

Specifically, the CPU 113 that executes the impact analysis program 124 determines whether or not the determination criteria set in the determination criterion 305 are satisfied. When the determination criteria set in the determination criterion 305 are satisfied, the CPU 113 determines that the reproduced incident has an influence on the evaluation business system 141.

When it is determined that the reproduced incident does not affect the evaluation business system 141, the incident reproduction device 110 updates the incident reproduction result management information 133 (step S1104), and then ends the incident reproduction process.

Specifically, the CPU 113 that executes the impact analysis program 124 adds an entry to the incident reproduction result management information 133, and sets the identification information in the ID 401 of the added entry. The CPU 113 stores the reproduced incident identification information in the incident ID 402 of the added entry, stores the identification information of the target business system in the business system ID 403, and stores "none" in the influence 404. In this case, the countermeasure 405 and the post-application impact 406 are blank.

When it is determined that the reproduced incident has an influence on the evaluation business system 141, the incident reproduction device 110 starts the coping loop processing (step S1105). Specifically, the following processing is executed.

The CPU 113 that executes the impact analysis program 124 activates the countermeasure application program 125.

The CPU 113 that executes the countermeasure application program 125 refers to the incident data management information 131 and searches for an entry corresponding to the received incident data. The CPU 113 selects one of the countermeasures set in the countermeasure 206 of the searched entry.

The above is the description of the process of step S1105.

Next, the incident reproduction device 110 applies the selected countermeasure to the evaluation business system 141 as a countermeasure (step S1106).

Specifically, the CPU 113 that executes the countermeasure application program 125 applies the selected countermeasure to the evaluation business system 141 as a countermeasure. The CPU 113 activates the incident reproduction program 123.

Next, the incident reproduction device 110 reproduces the incident corresponding to the received incident data on the evaluation business system 141 to which the countermeasure is applied, and analyzes the influence of the incident (step S1107). The process of step S1107 is the same as the process of step S1102.

Next, the incident reproduction device 110 updates the incident reproduction result management information 133 (step S1108).

Specifically, the CPU 113 that executes the impact analysis program 124 adds an entry to the incident reproduction result management information 133, and sets the identification information in the ID 401 of the added entry. The CPU 113 stores the reproduced incident identification information in the incident ID 402 of the added entry, stores the identification information of the target business system in the business system ID 403, and stores "Yes" in the influence 404. The CPU 113 stores the information indicating the countermeasure selected in step S604 in the countermeasure 405 of the added entry, and stores the analysis result in the post-application effect 406. The analysis result is either "yes" or "no".

Next, the incident reproduction device 110 determines whether or not the processing has been completed for all the countermeasures (step S1109).

If it is determined that the processing has not been completed for all the measures, the incident reproduction device 110 returns to step S1105 and executes the same processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the countermeasure application program 125.

When it is determined that the processing is completed for all the countermeasures, the incident reproduction device 110 determines whether or not the processing is completed for all the attack scenarios (step S1110).

If it is determined that the processing has not been completed for all the attack scenarios, the incident reproduction device 110 returns to step S1101 and executes the same processing.

Specifically, the CPU 113 that executes the impact analysis program 124 activates the incident reproduction program 123. The CPU 113 that executes the incident reproduction program 123 selects an unprocessed attack scenario from the generated attack scenarios.

When it is determined that the processing is completed for all the attack scenarios, the incident reproduction device 110 ends the incident reproduction processing.

In addition, the following modified examples can be considered in Example 2.

(Modification 1) The incident reproduction device 110 may collect attack codes published on the Internet or the like and generate or update attack method management information 800. This makes it possible to generate an attack scenario that includes the latest attack methods.

(Modification 2) The incident reproduction device 110 uses an attack scenario published on the Internet or the like instead of generating a new attack scenario from the attack scenario included in the incident data. As a result, incidents caused by various attack scenarios can be reproduced, and the range of choices for applicable countermeasures can be expanded.

As described above, according to the second embodiment, it is possible to reproduce an incident caused by an attack scenario that has not occurred in any of the organizations and analyze its influence. This makes it possible to take countermeasures against possible attacks in the future.

The present invention is not limited to the above-described embodiment, and includes various modifications. Further, for example, the above-described embodiment describes the configuration in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations. Further, it is possible to add, delete, or replace a part of the configuration of each embodiment with other configurations.

Further, each of the above configurations, functions, processing units, processing means and the like may be realized by hardware by designing a part or all of them by, for example, an integrated circuit. The present invention can also be realized by a software program code that realizes the functions of the examples. In this case, a storage medium in which the program code is recorded is provided to the computer, and the processor included in the computer reads out the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the function of the above-described embodiment, and the program code itself and the storage medium storing it constitute the present invention. Examples of the storage medium for supplying such a program code include a flexible disk, a CD-ROM, a DVD-ROM, a hard disk, an SSD (Solid State Drive), an optical disk, a magneto-optical disk, a CD-R, and a magnetic tape. Non-volatile memory cards, ROMs, etc. are used.

In addition, the program code that realizes the functions described in this embodiment can be implemented in a wide range of programs or script languages such as assembler, C / C ++, perl, Shell, PHP, Python, and Java (registered trademark).

Further, by distributing the program code of the software that realizes the functions of the embodiment via the network, the program code is stored in a storage means such as a hard disk or a memory of a computer or a storage medium such as a CD-RW or a CD-R. The processor included in the computer may read and execute the program code stored in the storage means or the storage medium.

In the above-described embodiment, the control lines and information lines show what is considered necessary for explanation, and do not necessarily indicate all the control lines and information lines in the product. All configurations may be interconnected.

100 System 101, 142 Network 110 Incident Reproduction Device 112 Interface 113 CPU
114 Main memory 115 Storage device 116 Input / output device 117 Communication path 121 Incident data reception program 122 Business system construction program 123 Incident reproduction program 124 Impact analysis program 125 Countermeasure application program 126 Presentation program 131 Incident data management information 132 Business system management information 133 Incident Reproduction result management information 140 Evaluation environment 141 Evaluation business system 150 Production environment 700 Display screen 800 Attack method management information

Claims (6)

It is a computer system equipped with multiple computers.
Each of the plurality of computers has a processor, a storage device connected to the processor, and an interface connected to the processor.
The computer system is
Connect to multiple business systems that execute business,
It manages business system management information that defines the configuration of each of the plurality of business systems and the judgment criteria for determining the presence or absence of influence.
Incident data including information on incidents that occurred in the first business system, information on how to detect the impact on the first business system, and information on actions taken to eliminate the impact on the first business system. The first process to get
A second process for constructing an evaluation business system that is a business system connected to the computer system based on the business system management information and that simulates a business system different from the first business system.
Based on the incident data, a third process of reproducing the incident that occurred in the first business system on the evaluation business system and analyzing the influence of the incident on the evaluation business system, and
The fourth process of outputting the result of the analysis is executed.
In the third process,
A process of determining whether or not the determination criteria of the evaluation business system are satisfied based on the method of detecting the influence in the first business system, and a process of determining whether or not the determination criteria are satisfied.
When it is determined that the determination criteria of the evaluation business system are satisfied, it is determined that the incident generated in the first business system has an influence on the evaluation business system, and the evaluation business system is compared with the first. Processing to apply measures corresponding to the measures taken to eliminate the impact on the business system of
A computer characterized in that a process of reproducing an incident that occurred in the first business system on an evaluation business system to which the countermeasures are applied and analyzing the influence of the incident on the evaluation business system is executed. system. It is a computer system equipped with multiple computers.
Each of the plurality of computers has a processor, a storage device connected to the processor, and an interface connected to the processor.
The computer system is
Connect to multiple business systems that execute business,
Acquires incident data including information on incidents that occurred in the first business system and attack scenarios defined as a combination of multiple attacks on the first business system.
An evaluation business system that is a business system connected to the computer system and that simulates a business system different from the first business system is constructed.
By modifying at least one of the plurality of attacks constituting the attack scenario included in the incident data, a verification attack scenario is generated.
Based on the verification attack scenario, the incident that occurred in the first business system is reproduced on the evaluation business system, and the influence of the incident on the evaluation business system is analyzed.
A computer system characterized by outputting the result of the analysis. It is a method of analyzing the impact of an incident executed by a computer system on a business system.
The computer system is
A processor, a storage device connected to the processor, and a plurality of computers having an interface connected to the processor.
Connect to multiple business systems that execute business,
It manages business system management information that defines the configuration of each of the plurality of business systems and the judgment criteria for determining the presence or absence of influence.
The analysis method is
At least one computer has information on the incident that occurred in the first business system, information on how to detect the impact on the first business system, and the measures taken to eliminate the impact on the first business system. The first step to get incident data, including information about
The first is to construct an evaluation business system in which the at least one computer is a business system connected to the computer system based on the business system management information and which simulates a business system different from the first business system. 2 steps and
A third step in which the at least one computer reproduces an incident that occurred in the first business system on the evaluation business system based on the incident data, and analyzes the influence of the incident on the evaluation business system. When,
The at least one computer comprises a fourth step of outputting the result of the analysis.
The third step is
A step of determining whether or not the at least one computer satisfies the determination criteria of the evaluation business system based on the method of detecting the influence in the first business system.
When it is determined that the determination criteria of the evaluation business system are satisfied, the at least one computer determines that the incident generated in the first business system has an influence on the evaluation business system, and the evaluation business system In response to the above, the step of applying the measures corresponding to the measures taken to eliminate the influence on the first business system, and
The at least one computer includes a step of reproducing an incident that occurred in the first business system on the evaluation business system to which the countermeasure is applied, and analyzing the influence of the incident on the evaluation business system. An analysis method characterized by. It is a method of analyzing the impact of an incident executed by a computer system on a business system.
The computer system is
A processor, a storage device connected to the processor, and a plurality of computers having an interface connected to the processor.
Connect to multiple business systems that execute business,
The analysis method is
A first step in which at least one computer acquires incident data including information on an incident that occurred in the first business system and an attack scenario defined as a combination of a plurality of attacks on the first business system.
The second step of constructing an evaluation business system in which the at least one computer is a business system connected to the computer system and which simulates a business system different from the first business system.
A third step in which the at least one computer reproduces an incident that occurred in the first business system on the evaluation business system based on the incident data, and analyzes the influence of the incident on the evaluation business system. When,
The at least one computer comprises a fourth step of outputting the result of the analysis.
The third step is
A step in which the at least one computer generates a verification attack scenario by modifying at least one of the plurality of attacks constituting the attack scenario.
An analysis method comprising: that at least one computer reproduces an incident that occurred in the first business system on the evaluation business system based on the verification attack scenario. An analyzer having a processor, a storage device connected to the processor, and an interface connected to the processor.
Connect to multiple business systems that execute business,
Holds business system management information that defines the configuration of each of the multiple business systems and the criteria for determining the presence or absence of impact.
Incident data including information on incidents that occurred in the first business system, information on how to detect the impact on the first business system, and information on actions taken to eliminate the impact on the first business system. And the receiver to get
A construction unit that builds an evaluation business system that is a business system connected to the analyzer and that simulates a business system different from the first business system.
Based on the incident data, an analysis unit that reproduces the incident that occurred in the first business system on the evaluation business system and analyzes the influence of the incident on the evaluation business system.
When the analysis unit determines that an incident that occurs in the first business system has an impact on the evaluation business system, measures are applied to the evaluation business system to prevent the impact of the incident. Measures application department and
A presentation unit that outputs the result of the analysis is provided.
The construction unit constructs the evaluation business system based on the business system management information.
The analysis unit
Based on the influence detection method in the first business system, it is determined whether or not the determination criteria of the evaluation business system are satisfied.
When it is determined that the determination criteria of the evaluation business system are satisfied, it is determined that the incident generated in the first business system has an influence on the evaluation business system.
The countermeasure application unit applies the countermeasures corresponding to the countermeasures taken to eliminate the influence on the first business system to the evaluation business system.
The analysis unit is an analysis device that reproduces an incident that occurred in the first business system on an evaluation business system to which the countermeasures are applied, and analyzes the influence of the incident on the evaluation business system. An analyzer having a processor, a storage device connected to the processor, and an interface connected to the processor.
Connect to multiple business systems that execute business,
A receiver that acquires incident data including information on an incident that occurred in the first business system and an attack scenario defined as a combination of a plurality of attacks on the first business system.
A construction unit that builds an evaluation business system that is a business system connected to the analyzer and that simulates a business system different from the first business system.
Based on the incident data, an analysis unit that reproduces the incident that occurred in the first business system on the evaluation business system and analyzes the influence of the incident on the evaluation business system.
A presentation unit that outputs the result of the analysis is provided.
The analysis unit
By modifying at least one of the plurality of attacks constituting the attack scenario, a verification attack scenario is generated.
An analysis device characterized by reproducing an incident that occurred in the first business system on the evaluation business system based on the verification attack scenario.

Images