JP7576535B2 - Security management system and security management method - Google Patents

Description

The present invention relates to a security management system and a security management method.

As a mechanism for supporting the planning of countermeasures against threats such as cyber attacks, for example, Patent Literature 1 describes a risk assessment countermeasure planning system configured for the purpose of determining countermeasures and security tests for reducing vulnerabilities. The risk assessment countermeasure planning system has a threat analysis processing unit that analyzes threats to the system based on the analysis results of the vulnerability analysis unit and outputs the threat analysis results, a countermeasure planning unit that plans countermeasures to reduce the impact of vulnerabilities based on the threat analysis results and vulnerability information, a security test planning unit that plans security tests based on the countermeasure plans, an evaluation calculation unit that performs evaluation based on the security tests and outputs the evaluation results, and a result processing unit that processes the evaluation results and generates security countermeasures.

International Publication No. 2020/202934

In recent years, the configurations of systems subject to security management have become increasingly complex, making it difficult to select appropriate measures against a variety of threats and to reduce the effort and time required to ensure that all measures are implemented. In addition, in order to implement measures appropriately while keeping costs down, it is also necessary to determine the effectiveness and priority of measures against threats when formulating them.

The present invention was made in light of this background, and aims to provide a security management system and a security management method that can support the work of planning effective and appropriate measures against a variety of threats.

One of the present inventions for achieving the above object is a security management system configured using an information processing device having a processor and a memory, which stores threat/countermeasure information including information on attacks against each of assets constituting an information processing system and information on countermeasures against the attacks, an evaluation target model including information specifying a configuration of an evaluation target system which is an information processing system to be evaluated for security measures, and attack path information which is information indicating an attack path of a threat assumed in the evaluation target model, generates information indicating an attack procedure for each of the assets in the attack path based on the threat/countermeasure information, generates one or more pieces of information indicating the attack procedures in the attack path based on the generated information indicating the attack procedures in each of the assets, and logically connects the generated information indicating the attack procedures in the attack path to generate an FT (Fault Tolerance) which treats the threat as an event. The information relating to the attack in the threat/countermeasure information includes information indicating the attack strategy and information indicating the attack technique, and the information indicating the attack procedure in the attack path is generated based on the information indicating the attack strategy and the information indicating the attack technique, and the FT (Fault Tree) is generated by connecting the generated information indicating the attack procedures in the attack path with a logical relationship of sum (OR), and connecting each piece of information indicating the attack technique to a lower level of each piece of the connected information indicating the attack procedure with a logical relationship of product (AND) .

Other problems and solutions disclosed in this application will be made clear in the detailed description of the invention and the drawings.

The present invention can assist in the task of developing effective and appropriate countermeasures against a variety of threats.

FIG. 1 illustrates an example of a security management system. FIG. 1 is a diagram illustrating an example of a threat analysis method. FIG. 2 is a diagram illustrating a threat analysis method according to the present embodiment. FIG. 2 illustrates an example of functions of the security design support device. FIG. 2 is a diagram illustrating an example of functions of a user terminal. FIG. 1 illustrates an example of an information processing device used in a configuration of a security management system. 13 is a flowchart illustrating a countermeasure planning process. 1 is an example of evaluation target information. 1 is an example of a model to be evaluated. 1 is an example of attack path information. 1 is an example of threat list information. 13 is a flowchart illustrating an example of an FT generation and analysis process. 13 is a flowchart illustrating an example of an FT generation and analysis process. This is an example of threat/countermeasure information. This is an example of a permutation combination. 1 is an example of a model to be evaluated. 13 is an example of a constraint condition for generating an attack path. This is an example of an attack procedure (strategic level). This is an example of an attack procedure (technical level). This is an example of FT. 1 is an example of an FT analysis result. This is an example of the results of countermeasures. 13 is an example of a countermeasure planning result display screen.

The following describes an embodiment of the present invention with reference to the drawings. The following description and drawings are examples for explaining the present invention, and some parts have been omitted or simplified as appropriate for clarity of explanation. The present invention can also be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

In the following explanation, when describing identification information, expressions such as "identifier," "name," "ID," and "number" are used, but these are interchangeable. In addition, in the following explanation, various types of information may be described using expressions such as "table" and "information," but the various types of information may be expressed in data structures other than these. Furthermore, an "XX table" etc. may be referred to as "XX information" to indicate independence from the data structure.

In the following explanation, the "communication network" may be written as "communication NW." Also, in the following explanation, the "communication interface" may be written as "communication IF." Also, in the following explanation, duplicated explanations of identical or similar configurations may be omitted. Also, in the following explanation, the letter "S" before a symbol indicates a processing step.

Figure 1 shows a schematic configuration of an information processing system (hereinafter referred to as "security management system 1") described as one embodiment. As shown in the figure, the security management system 1 includes a security design support device (hereinafter referred to as "support device 100") and one or more user terminals 200 operated by a user who uses the support device 100.

The support device 100 is communicatively connected to a user terminal 200 via a first communication network 51. The support device 100 is also communicatively connected to an external server 300 that provides field-specific security knowledge (hereinafter referred to as "field-specific security knowledge") via a second communication network 52.

The first communication NW 51 and the second communication NW 52 are wired or wireless communication networks, such as a local area network (LAN), a wide area network (WAN), the Internet, various public wireless communication networks, dedicated lines, etc. The first communication NW 51 and the second communication NW 52 may be connected to each other or may be a common network.

The support device 100 is, for example, an information processing device managed by a business providing SOC services (SOC: Security Operation Center), and uses security-related information to generate information on threats and countermeasures against threats, etc., and provides the generated information to the user via the user terminal 200.

The user terminal 200 is an information processing device used by a user who uses the above information provided by the support device 100. The user is, for example, an analyst who identifies (examines) anticipated threats to the information processing system that is the subject of security management and plans countermeasures against the threats. The user is, for example, a security advisor who provides consulting services for security management of customers' information processing systems.

The external server 300 is an information processing device that provides security-related information to the support device 100 via the second communication NW 52. The external server 300 provides the support device 100 with, for example, information (hereinafter referred to as "threat/countermeasure information") that organizes/systematizes, as a matrix, the strategies (Tactics), techniques (Techniques), and procedures (Procedures) that an attacker uses to reach a target objective in an information processing system, and information such as a framework related to countermeasures (mitigation measures, detection methods) associated with specific attack techniques that an attacker may perform. Examples of the threat/countermeasure information provided by the external server 300 include information provided via the Internet, such as "ATT&CK for Enterprise" (registered trademark) provided by "MITRE (registered trademark)" and "Cyber Kill Chain" (registered trademark) developed by "Lockheed Martin (registered trademark)". In this embodiment, the threat/countermeasure information provided by the external server 300 is information provided by "MITRE (registered trademark)" and is provided via the Internet, such as "ATT&CK for Enterprise" (registered trademark) provided by "MITRE (registered trademark)".
(registered trademark) provided by “ATT&CK for Enterprise” (registered trademark) will be used as an example.

Figure 2 is a diagram explaining an example of a method (hereinafter referred to as "threat analysis method S20") that an analyst uses when analyzing threats (hereinafter referred to as "threat analysis") for an information processing system that is the subject of security management (hereinafter referred to as "evaluation target system"). The threat analysis method S20 includes processes such as identifying threats in the evaluation target system, risk assessment, and planning countermeasures.

As shown in the figure, first, the analyst defines the system to be evaluated (TOE: Target of Evaluation). Specifically, the analyst creates an evaluation target model, which is information (data) that models the system to be evaluated (S21).

Next, the analyst identifies potential threats to the model being evaluated using the 5W method or the like (S22), and determines a risk value for each identified threat by performing a risk assessment for each threat (S23). The analyst determines the risk value using, for example, the Common Vulnerability Scoring System (CVSS).

Next, the analyst selects threats for which countermeasures will be developed (S24). For example, the analyst selects a predetermined number of threats in descending order of risk value as targets for countermeasures.

Next, the analyst uses the knowledge of experts in the field (domain) to which the system being evaluated belongs (hereafter referred to as "domain knowledge") to develop countermeasures against the threats selected in S24 using a best practice approach (S25).

The tasks and processes in the threat analysis method S20 described above are performed, for example, manually or using various support tools (application software, etc.) as appropriate.

However, to carry out the above processing, it is necessary to create rules for formulating countermeasures and to prepare and manage the information required for the planning. Furthermore, with the best practices method, it is not always possible to clearly grasp the relationship between threats and countermeasures, so it takes a lot of time and effort to select countermeasures for each threat and to check that no countermeasures are missing. It is also difficult to judge the effectiveness and priority of countermeasures against threats, and there is a risk that more countermeasures than necessary will be taken.

Therefore, the security management system 1 of this embodiment formulates countermeasures by logically analyzing, using a Fault Tree (FT) analysis method, what specific procedures and conditions may cause a threat (attack) to occur against the threat selected in S24 of Fig. 2. In addition, by using threat/countermeasure information (TTPs (Tactics, Techniques and Procedures) and the like) provided by the external server 300, it is possible to formulate appropriate and effective countermeasures based on the latest information, and to reduce the load of collecting/managing information required for formulating countermeasures.

Figure 3 shows an overview of the threat analysis method (hereinafter referred to as "threat analysis method S30") by the security management system 1 of this embodiment. Note that in the figure, the steps S31 to S34 are the same as the steps S21 to S24 of the threat analysis method S20 in Figure 2, so a description will be omitted.

When a threat for which countermeasures are to be developed is selected in S34, the support device 100 generates an FT for the selected threat by expanding (logically connecting) the specific methods (tactics and techniques) for causing the threat, which are obtained from the threat/countermeasure information, as events (S35).

More specifically, the support device 100 develops the F by, for example, setting the selected threat as a parent event and developing specific procedures for causing the threat (methods identified from the tactics and techniques of the threat/countermeasure information) acquired from the threat/countermeasure information as child events.
In the above expansion, the support device 100 generates FT by combining the methods with a logical AND relation when the parent event is not realized unless all of the child events are realized, and by combining the methods with a logical OR relation when the parent event is realized if any of the child events are realized.

Next, the support device 100 uses the generated FT to plan countermeasures against the selected threats, for example, while interactively processing with a user such as an analyst via the user terminal 200 (S36).

In this manner, in this embodiment, the results of the FT analysis are used to plan countermeasures, so that a user such as an analyst can easily and accurately match threats with countermeasures. For example, when multiple countermeasures exist for one threat, a user can easily determine, from the logical relationship between the threat and the countermeasures, whether implementing one of the countermeasures is sufficient or whether it is necessary to implement all of the countermeasures. Therefore, a user can efficiently plan effective countermeasures to a necessary and sufficient extent.

In addition, the threat/countermeasure information provided by the external server 300 is updated on an ongoing basis, allowing users to plan appropriate countermeasures based on the latest information. In addition, the threat/countermeasure information provided covers a wide range of fields, including enterprise, mobile, industrial control systems (ICS), automobiles, and healthcare, making it possible to flexibly respond to a variety of systems to be evaluated and plan the countermeasures required for each system, without mobilizing experts for each field (domain).

In addition, this embodiment utilizes threat/countermeasure information (scenario frameworks, etc.), allowing users to perform consistent security management (threat analysis, risk assessment, vulnerability analysis, vulnerability management, countermeasure planning, etc.).

Next, we will explain in detail the configuration of the security management system 1.

Figure 4 shows the main functions of the support device 100. As shown in the figure, the support device 100 has the following functions: a memory unit 110, an information acquisition management unit 130, an evaluation target model generation unit 132, a threat list generation unit 134, a risk assessment unit 136, a threat selection unit 138, an FT generation and analysis unit 140, and a countermeasure planning unit 150.

Of the above functions, the memory unit 110 stores evaluation target information 111, evaluation target model 112, attack path information 113, threat list information 114, threat/countermeasure information 115, attack path generation constraints 116, strategy/technology list 117, attack procedure (strategy level) 118, attack procedure (technical level) 119, FT 120, FT analysis results 121, and countermeasure planning results 122. Details of this information will be described later.

The information acquisition management unit 130 acquires information about the system to be evaluated from the user terminal 200, and manages the acquired information as evaluation target information 111. The information acquisition management unit 130 also acquires threat/countermeasure information, which is information that describes threats and countermeasures against threats, from the external server 300 at any time, and manages the acquired threat/countermeasure information as threat/countermeasure information 115.

The evaluation target model generation unit 132 generates an evaluation target model based on the evaluation target information 111, and manages the generated evaluation target model as the evaluation target model 112.

The threat list generation unit 134 extracts threats anticipated for the evaluation target model 112 from the threat/countermeasure information 115, and manages information related to the extracted threats in the threat list information 114.

The risk assessment unit 136 determines a risk value for each threat in the threat list information 114 (risk assessment) and reflects the determined risk value in the threat list information 114. The risk assessment unit 136 determines the risk value, for example, using the common vulnerability assessment system described above.

The FT generation and analysis unit 140 generates an FT for the evaluation target model 112. As shown in the figure, the FT generation and analysis unit 140 has an attack path identification unit 141, an attack procedure (strategic level) generation unit 142, an attack procedure (technical level) generation unit 143, an FT generation unit 144, and an FT analysis unit 145.

The attack path identification unit 141 identifies the attack path of each threat in the threat list information 114 in the evaluation target model 112, and manages information indicating the identified attack path as attack path information 113. The attack path information 113 is, for example, a structured threat information eXpression (STIX) standard.
It is written in accordance with specifications for describing cyber attack activities such as

The attack procedure (tactics level) generation unit 142 generates information indicating attack procedures at the tactics level for the attack paths identified by the attack path identification unit 141 based on the threat/countermeasure information 115, and manages the generated information as attack procedures (tactics level) 118.

The attack procedure (technical level) generation unit 143 further generates attack procedures at a technique level based on the threat/countermeasure information 115 for each attack procedure in the attack procedures (strategic level) 118 generated by the attack procedure (strategic level) generation unit 142, and manages the generated information as attack procedures (technical level) 119.

The FT generation unit 144 generates an FT based on the attack procedure (technical level) 119 and manages the generated FT as an FT 120.

The FT analysis unit 145 analyzes the contents of the FT 120 and manages the analysis results as the FT analysis results 121. The FT analysis results 121 include information indicating, for example, the conditions under which a threat (attack) is established (hereinafter referred to as "attack establishment conditions") and the conditions under which a threat (attack) is not established (hereinafter referred to as "attack non-establishment conditions").

The countermeasure planning unit 150 plans countermeasures for each threat in the evaluation target model 112 (each threat in the threat/countermeasure information 115) based on the FT 120, and outputs the planned results. For example, the countermeasure planning unit 150 plans countermeasures against threats while presenting to a user (an analyst, a customer of the analyst, etc.) the contents of the FT 120 and the FT analysis result 121, and the contents of the countermeasures obtained from the countermeasures associated with the strategies and technologies in the threat/countermeasure information 115. The countermeasure planning unit 150 manages the planning results as countermeasure planning results 122. The countermeasure planning unit 150 also presents information based on the countermeasure planning results 122 to a user (an analyst, a customer of the analyst, etc.) via the user terminal 200.

Figure 5 is a block diagram explaining the main functions of the user terminal 200. As shown in the figure, the user terminal 200 has the functions of a memory unit 210, a dialogue processing unit 220, an evaluation target information receiving unit 230, an evaluation target information transmitting unit 235, a countermeasure planning result receiving unit 240, and a countermeasure planning result output unit 245.

Of the above functions, the memory unit 210 stores the evaluation target information 111 and the countermeasure planning results 122.

The dialogue processing unit 220 provides functions for accepting information input from the user and presenting information to the user.

The evaluation target information receiving unit 230 receives the evaluation target information 111 via the dialogue processing unit 220. The evaluation target information transmitting unit 235 transmits the evaluation target information 111 received by the evaluation target information receiving unit 230 to the support device 100 via the first communication NW 51.

The countermeasure planning result receiving unit 240 receives the countermeasure planning result 122 from the support device 100 via the first communication network 51. The countermeasure planning result output unit 245 presents the countermeasure planning result 122 to the user via the dialogue processing unit 220.

Figure 6 shows an example of the hardware configuration of an information processing device (computer) used to realize the support device 100 and the user terminal 200.

The illustrated information processing device 10 includes a processor 11, a main storage device 12 (memory), an auxiliary storage device 13 (external storage device), an input device 14, an output device 15, and a communication device 16. These are communicatively connected via a bus, a communication cable, or the like. Examples of the information processing device 10 include a personal computer, a server device, a smartphone, a tablet, an office computer, a general-purpose machine (mainframe), and the like.

The information processing device 10 may be realized, in whole or in part, by using virtual information processing resources provided by using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a cloud system via an API (Application Programming Interface) or the like. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a cloud system via an API (Application Programming Interface), or the like. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a service provider such as SaaS (Software as a Service), PaaS (Platform as a Service), IaaS (Infrastructure
This may be realized by using the Service as a Service, etc.

The processor 11 may be, for example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), or the like.
It is composed of a gate array, an application specific integrated circuit (ASIC), an artificial intelligence (AI) chip, etc.

The main memory device 12 is a device used by the processor 11 when executing a program, and is, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), or a non-volatile memory (NVRAM (Non Volatile RAM)). Various functions realized in the support device 100 and the user terminal 200 are realized by each processor 11 reading out programs and data stored (memorized) in the auxiliary memory device 13 into the main memory device 12 and executing them.

The auxiliary storage device 13 is a device that stores programs and data, and may be, for example, a solid state drive (SSD), a hard disk drive, or an optical storage device (CD (Compact Disc)
, DVD (Digital Versatile Disc), a storage system, a reading/writing device for non-transient recording media such as IC cards, SD cards, and optical recording media, a non-transient storage area of a cloud server, etc. Programs and data can be read into the auxiliary storage device 13 from other information processing devices equipped with non-transient recording media or non-transient storage devices via a recording medium reading device or a communication device 16. The programs and data stored (memorized) in the auxiliary storage device 13 are read into the main storage device 12 as needed.

The input device 14 is an interface that accepts information input from the outside, and is, for example, a keyboard, a mouse, a touch panel, a card reader, a pen-input tablet, a voice input device, etc.

The output device 15 is an interface that outputs various information such as the progress of processing and the results of processing to the outside. The output device 15 is, for example, a display device (liquid crystal monitor, LCD (Liquid Crystal Display), graphic card, etc.) that visualizes the various information described above, a device that converts the various information described above into audio (audio output device (speaker, etc.)), or a device that converts the various information described above into text (printer, etc.). Note that, for example, the information processing device 10 may be configured to input and output information to and from other devices via the communication device 16.

The input device 14 and the output device 15 constitute a user interface that realizes interactive processing with the user (accepting information, providing information, etc.).

The communication device 16 is a device that realizes communication with other devices. The communication device 16 is a wired or wireless communication interface that realizes communication with other devices via a communication network, and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, etc.

In addition, the information processing device 10 may be equipped with, for example, an operating system, a file system, a DBMS (DataBase Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), etc.

Figure 7 is a flowchart explaining the details of the processes S31 to S36 shown in Figure 3 (hereinafter referred to as "countermeasure planning process S700"). Below, countermeasure planning process S700 will be explained with reference to this figure.

The information acquisition management unit 130 acquires information about the evaluation target system from the user terminal 200 via the first communication network 51, and manages the acquired information as evaluation target information 111. The information acquisition management unit 130 also acquires the latest threat/countermeasure information by communicating with the external server 300 via the second communication network 52, and updates the threat/countermeasure information 115 (S711).

The evaluation target model generation unit 132 generates the evaluation target model 112 based on the evaluation target information 111 (S712).

Figure 8 is an example of the evaluation target information 111. This figure shows an example of the evaluation target information 111 when the evaluation target system is an in-vehicle network system. The evaluation target information 111 manages information about the assets that make up the evaluation target system. An asset is a unit into which the components of the evaluation target system (physical components and software components) are broken down according to a specified criterion.

As shown in the figure, the evaluation target information 800 is composed of multiple records having the following items: node ID 1111, asset 1112, asset requirement 1113, and link ID 1114. Of the above items, node ID 1111 stores a node ID, which is an identifier assigned to each asset that constitutes the evaluation target system. Asset 1112 stores the name of the asset (information indicating the content of the asset and the function provided by the asset). Asset requirement 1113 stores information indicating the safety required for the asset (such as the safety level in the SIL (Safety Integrity Level) standard). Link ID 1114 stores the node ID of another asset that is linked (communicates) with the asset.

The evaluation target information 111 may further include information used to generate the evaluation target model 112 and various other information used to plan countermeasures against threats.

9 is a schematic diagram showing an example of the evaluation target model 112. The evaluation target model 112 is generated based on the evaluation target information 111. The evaluation target model 112 includes information showing paths of communication (wired communication, wireless communication) that exist between assets constituting the evaluation target system and that can be attack paths. The evaluation target model 112 is represented, for example, using a DFD (Data Flow Diagram).

Returning to FIG. 7, the threat list generation unit 134 then generates threat list information 114 based on the evaluation target model 112 and the attack path information 113 (S713). The contents of the attack path information 113 are generated based on, for example, threat/countermeasure information 115 provided by the external server 300. The contents of the attack path information 113 may also be set by the user via, for example, the user terminal 200.

Figure 10 is an example of attack path information 113. In the attack path information 113, a list of attack paths assumed in the evaluation target model 112 is managed. As shown in the figure, the attack path information 113 is composed of multiple records each consisting of the items To node ID 1131, To node name 1132, From node ID/From node name 1133, and attack path 1134. One record of the attack path information 113 corresponds to one attack path.

Of the above items, To Node ID 1131 stores the node ID of the asset that is the target of the attack. To Node Name 1132 stores the name of the asset (information indicating the content and function of the asset). From Node ID/From Node Name 1133 stores the node ID and name of the asset that is the entry point for an attack targeting the asset (for example, the node identified by "Where" in the 5W method). Attack Path 1134 stores information indicating the attack path from the entry point for the asset.

Figure 11 is an example of threat list information 114. As shown in the figure, threat list information 114 is composed of multiple records having the following items: threat ID 1141, asset 1142, From node ID 1143, To node ID 1144, threat event 1145, and risk value 1146. One record in threat list information 114 corresponds to one threat.

Of the above items, Threat ID 1141 stores a threat ID that is an identifier for the threat. Asset 1142 stores the name of the asset that is the target of the threat (information indicating the content and function of the asset). From node ID 1143 stores the node ID of the asset that attacks the asset. To node ID 1144 stores the node ID of the asset (or function) that is the target of the attack. Threat event 1145 stores information indicating the content of the threat. Risk value 1146 stores the risk value of the threat.

Returning to FIG. 7, the threat list generation unit 134 then calculates a risk value for each threat in the generated threat list information 114, and reflects the calculated risk values in the threat list information 114 (S714).

Then, the threat selection unit 138 selects threats for which countermeasures are to be developed from the threat list information 114 (S715). The threat selection unit 138 selects a predetermined number of threats as targets for development of countermeasures, for example, starting with those with high risk values.

Next, the FT generation and analysis unit 140 performs a process of generating and analyzing an FT for the threat selected as the planning target (hereinafter, this process is referred to as "FT generation and analysis process S716") (S716).

Figure 12A is a flowchart explaining the details of the FT generation analysis process S716. Below, the FT generation analysis process S716 will be explained with reference to the same figure.

First, the attack path identification unit 1211 identifies the attack path from the FROM node to the TO node for the threat selected by the threat selection unit 138 based on the attack path information 113.

Next, the attack procedure (strategy level) generation unit 142 generates attack procedures (ordered combinations of attack procedures (hereinafter referred to as "permutation combinations")) within each node (each asset) that constitutes the attack path identified by the attack path identification unit 141 based on the threat/countermeasure information 115 (S1212).

13 shows an example of the threat/countermeasure information 115. As shown in the figure, the illustrated threat/countermeasure information 115 is made up of a plurality of records each having one or more combinations of an attack method ID 1151, an attack method (strategy) 1152, and an attack method (technology) 1153 and a countermeasure/cost 1154.

Of the above items, attack method ID 1151 stores an attack method ID, which is an identifier assigned to each attack method. Attack method (strategy) 1152 stores information indicating an attack method related to strategy. Attack method (technique) 1153 stores information indicating an attack method related to technique. Countermeasure/cost 1154 stores information indicating a countermeasure against the attack method and information indicating the cost.

Figure 14A shows an example of a permutation combination (hereinafter referred to as "permutation combination 1400") generated by the attack procedure (strategy level) generation unit 142 in S1212. Note that this figure is an example of a permutation combination when the evaluation target model 112 has the configuration shown in Figure 14B. As shown in this figure, the illustrated permutation combination 1400 is made up of multiple records having the following items: node 1401, strategy level permutation combination ID 1402, technology level permutation combination ID 1403, strategy (1) 1404, strategy (2) 1405, technology (1) 1406, and technology (2) 1407. One record of permutation combination 1400 corresponds to one permutation combination.

In the figure, node 1401 stores a node ID that is an identifier of the node, strategy level permutation combination ID 1402 stores a strategy level permutation combination ID that is an identifier of a strategy level permutation combination, technology level permutation combination ID 1403 stores a technology level permutation combination ID that is an identifier of a technology level permutation combination, strategy (1) 1404 and strategy (2) 1405 store the content of the strategy, and technology (1) 1406 and technology (2) 1407 store the content of the technology.

12A , the attack procedure (strategy level) generation unit 142 then generates an attack procedure at the tactics level for the attack path identified in S1211 based on the permutation combination 1400, and manages the generated attack procedure as the attack procedure (strategy level) 118 (S1213). The attack procedure (strategy level) generation unit 142 generates the attack procedure so as to satisfy the constraint conditions defined in the attack path generation constraint conditions 116.

Figure 15 shows an example of the attack path generation constraint conditions 116. As shown in the figure, the attack path generation constraint conditions 116 are composed of one or more records having the following items: constraint condition ID 1161, node condition 1162, and constraint condition 1163. One record of the attack path generation constraint conditions 116 corresponds to one constraint condition.

Of the above items, constraint condition ID 1161 stores a constraint condition ID, which is an identifier assigned to each constraint condition. Node condition 1162 stores information that identifies the node to which the constraint condition applies. Constraint condition 1163 stores information that indicates the content of the constraint condition.

Figure 16 shows an example of the attack procedure (strategy level) 118. The attack procedure (strategy level) 118 includes the results of extracting permutation combinations at the strategy level that satisfy the constraint conditions of the attack path generation constraint conditions 116 from the permutation combinations generated in S1212, and arranging them in the order of the nodes of the attack path.

As shown in the figure, the attack procedure (strategy level) 118 is composed of one or more records having each item of a strategy level attack path ID 1181, an attack path 1182, a first node: a strategy level permutation combination ID 1183, a second node: a strategy level permutation combination ID 1184, and a third node: a strategy level permutation combination ID 1185. One record of the attack procedure (strategy level) 118 corresponds to one attack procedure.

Of the above items, strategic level attack path ID 1181 stores a strategic level attack path ID, which is an identifier assigned to each strategic level attack path. Attack path 1182 stores information indicating the attack path. First node: strategic level permutation combination ID 1183, second node: strategic level permutation combination ID 1184, and third node: strategic level permutation combination ID 1185 store combinations of strategic level permutation combination IDs between nodes that make up the attack path.

Returning to FIG. 12A, the attack procedure (technique level) generation unit 143 then generates an attack procedure at the technique level for the attack path identified in S1211 based on the permutation combination 1400 generated in S1212 and the attack procedure (strategy level) 118 generated in S1213, and manages the generated attack procedure as the attack procedure (technique level) 119 (S1214).

Figure 17 shows an example of an attack procedure (technical level) 119. The attack procedure (technical level) 119 includes the results of extracting permutation combinations of technical levels obtained from the permutation combinations 1400 generated in S1212 for the attack procedure (strategy level) 118 generated in S1213, arranged in the order of the nodes of the attack path.

As shown in the figure, attack procedure (technical level) 119 is composed of one or more records having each of the following items: technical level attack path ID 1191, attack path 1192, first node: technical level permutation combination ID 1193, second node: technical level permutation combination ID 1194, and third node: technical level permutation combination ID 1195. One record of attack procedure (technical level) 119 corresponds to one attack procedure.

Of the above items, technical level attack path ID 1191 stores a technical level attack path ID, which is an identifier assigned to each technical level attack path. Attack path 1192 stores information indicating the attack path. First node: technical level permutation combination ID 1193, second node: technical level permutation combination ID 1194, and third node: technical level permutation combination ID 1195 store combinations of technical level permutation combination IDs between nodes that make up the attack path.

The processing of S1212 to S1214 shown in FIG. 12A may be, for example, as shown in S1222 to S1224 shown in FIG. 12B. In the example of FIG. 12B, instead of generating an attack procedure (strategic level) 118 and then generating an attack procedure (technical level) 119 as in S1213 of FIG. 12A, an attack procedure within the node of the attack path identified in S1211 is generated at a technical level based on threat/countermeasure information (S1223), and the generated attack procedure is used to generate the attack procedure (technical level) 119 (S1224).

12A , the FT generation unit 144 then generates an FT based on the attack procedure (technique level) 119 generated in S1214, and manages the generated FT as an FT 120 (S1215). Specifically, the FT generation unit 144 connects a plurality of attack procedures from the attack entry point in the evaluation target system to the final target asset (hereinafter referred to as the "target asset") using a logical OR relationship, and further generates an FT by connecting each element (technique of attacking the target asset) of each attack procedure connected using a logical AND relationship.

An example of the FT 120 is shown in Fig. 18. In this example, a plurality of attack procedures 1822 ("Technical level attack procedure 1" to "Technical level attack procedure 15") from the intrusion point to the target asset are connected to the selected threat 1811 by a logical relation of OR 1820. In addition, for each attack procedure 1813 connected by the logical relation of OR 1820, each element 1814 (technique 1815 of attacking the target asset) is connected by a logical relation of AND 1830. For example, the support device 100 may present the contents of the FT 120 to the user via the user terminal 200 at any time.

12A , the FT analysis unit 145 then analyzes the contents of the FT 120 and manages the analysis result as the FT analysis result 121 (S1216). For example, the FT analysis unit 145
An FT analysis result 121 is generated, which includes information indicating the conditions under which a threat (attack) exists (attack existence conditions) and the conditions under which a threat (attack) does not exist (attack non-existence conditions), and is presented to the user via the user terminal 200.

Figure 19 shows an example of an FT analysis result 121 that includes an attack success condition. As shown in the figure, the example FT analysis result 121 is composed of one or more records that have the following items: attack success condition ID 1211, attack target asset 1212, and attack technique level 1213. One record of the example FT analysis result 121 corresponds to one attack success condition.

Of the above items, the attack success condition ID 1211 stores an attack success condition ID that is an identifier for each attack success condition. The attack target asset 1212 stores information indicating the attack target asset. The attack technique level 1213 stores a combination of attack technique levels that will satisfy the attack success condition.

By switching the sum (OR) and product (AND) of the generated FT 120, it is possible to generate an FT analysis result 121 including information indicating a condition (condition for attack not to be established) under which a threat (attack) is not established. For example, if the condition for attack to be established is "(α-1 AND B-2 AND A-3) OR (α-1 AND
When the condition is expressed as "(α-1 OR B-2 OR A-3) AND (α-1 OR B-2 OR A-3')," which replaces the sum (OR) and product (AND), the condition for an attack to fail is expressed as "(α-1 OR B-2 OR A-3) AND (α-1 OR B-2 OR A-3')."

By referring to the FT analysis results 121, users such as analysts can easily understand what combinations of attack technical levels will result in an attack on the target assets.

Returning to FIG. 7, the countermeasure planning unit 150 then uses the FT analysis result 121 to plan countermeasures against the threat, manages the plan results as countermeasure planning results 122, and presents the contents of the countermeasure planning results 122 to the user (S717).

The countermeasure planning unit 150 plans countermeasures against threats by interactive processing with the user while presenting the FT analysis result 121 including information indicating conditions under which a threat (attack) is established (attack establishment conditions) and conditions under which a threat (attack) is not established (attack non-establishment conditions) to the user via the user terminal 200. For example, when the attack non-establishment condition is expressed as "(α-1 OR B-2 OR A-3) AND (α-1 OR B-2 OR A-3')," the countermeasure planning unit 150 derives, as countermeasures against threats, for example, "countermeasures against α-1,""countermeasures against B-2,""countermeasures against A-3 AND countermeasures against α-1,""countermeasures against A-3 AND countermeasures against B-2,""countermeasures against A-3 AND countermeasures against A-3',""countermeasures against A-3' AND countermeasures against α-1," and "countermeasures against A-3' AND countermeasures against B-2."

Figure 20 shows an example of a countermeasure planning result 122. The illustrated countermeasure planning result 122 is composed of one or more records having the following items: node ID 1221, countermeasure ID 1222, cost (expense) 1223, and cost (time) 1224.

Among the above items, the node ID 1221 stores a node ID that is an identifier of a node that constitutes an attack path. The countermeasure ID 1222 stores a countermeasure ID that is an identifier given to each countermeasure.
D is stored in the cost (expense) 1223. Information indicating the monetary cost incurred by taking the countermeasure is stored in the cost (time) 1224. Note that the countermeasure planning unit 150 obtains the contents of the cost (expense) 1223 and the cost (time) 1224 from, for example, the threat/countermeasure information 115.

Figure 21 is an example of a screen (hereinafter referred to as "countermeasure planning result presentation screen 2100") displayed on the user terminal 200 when the countermeasure planning unit 150 presents the contents of the countermeasure planning result 122 to the user. The illustrated countermeasure planning result presentation screen 2100 has display columns for an attack success condition ID 2111, an attack target asset 2112, a countermeasure 2113, a minimum cost (expense) 2114, a minimum cost (time) 2115, and a maximum threat risk 2116.

Attack success condition ID 2111 displays an attack success condition ID, which is an identifier for each attack success condition. Attack target asset 2112 displays information indicating the attack target asset. Measures 2113 displays information indicating the measures proposed for the asset. Minimum cost (expense) 2114 displays the cost (expense) of the measure that has the smallest monetary cost among the measures displayed in measures 2113. Minimum cost (time) 2115 displays the cost (time) of the measure that has the smallest time cost among the measures displayed in measures 2113. Maximum threat risk 2116 displays the risk value of the threat selected in S715 of FIG. 3.

By referring to the countermeasure planning result presentation screen 2100, the user can easily understand what countermeasure or combination of countermeasures is effective against what type of attack, what countermeasure or combination of countermeasures is cost-effective, and what threats are high-risk threats.

The above describes the security management system 1 of this embodiment, which allows users such as analysts to easily grasp the relationship between threats (attacks) and countermeasures based on the FT analysis results 121. Furthermore, since the security management system 1 generates one or more combinations of countermeasures that correspond to the conditions for an attack to occur, the user can efficiently select appropriate countermeasures from the multiple combinations of countermeasures presented, while taking costs into consideration. In this way, the security management system 1 of this embodiment can support the planning of effective and appropriate countermeasures against threats.

Although the embodiments have been described above, the present invention is not limited to the above-described embodiments, and includes various modified examples, and is not necessarily limited to those having all of the configurations described. It is also possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

1 Security management system, 51 First communication network, 52 Second communication network, 100 Support device, 110 Memory unit, 111 Evaluation target information, 112 Evaluation target model, 113 Attack path information, 114 Threat list information, 115 Threat/countermeasure information, 116 Constraint conditions at the time of attack path generation, 117 Strategy/technology list, 118 Attack procedure (strategy level), 119 Attack procedure (technology level), 120 FT, 121 FT analysis result, 122 Countermeasure planning result, 130 Information acquisition management unit, 132 Evaluation target model generation unit, 134 Threat list generation unit, 138
Threat selection unit, 140 FT generation and analysis unit, 141 Attack path identification unit, 142 Attack procedure (strategic level) generation unit, 143 Attack procedure (technical level) generation unit, 144 FT generation unit, 145 FT analysis unit, 150 Countermeasure planning unit, 200 User terminal, 210 Storage unit, 220
Dialogue processing unit, 230 Evaluation target information receiving unit, 235 Evaluation target information transmitting unit, 240 Countermeasure planning result receiving unit, 245 Countermeasure planning result output unit, 300 External server, S700 Countermeasure planning process, S716 FT generation and analysis process, 2100 Countermeasure planning result display screen

Claims (9)

A security management system configured using an information processing device having a processor and a memory,
Threat/countermeasure information including information on attacks against each of the assets constituting the information processing system and information on countermeasures against the attacks;
an evaluation target model including information for identifying a configuration of an evaluation target system, which is an information processing system that is a target for evaluating security measures;
Attack path information indicating attack paths of threats assumed in the evaluation target model;
Remember,
generating information indicating an attack procedure for each of the assets in the attack path based on the threat/countermeasure information;
generating one or more pieces of information indicating attack procedures in the attack path based on the generated information indicating the attack procedures in each of the assets;
generating a Fault Tree (FT) with the threat as an event by logically connecting information indicating an attack procedure in the generated attack path ;
the information on the attack in the threat/countermeasure information includes information indicating a strategy of the attack and information indicating a technique of the attack;
the information indicating the attack procedure in the attack path is generated based on the information indicating the attack strategy and the information indicating the attack technique;
The generated information indicating the attack procedure in the attack path is connected in a logical OR relationship;
generating the FT (Fault Tree) by connecting information indicating each of the attack techniques to each of the connected information indicating the attack procedures in a logical AND relationship;
Security management systems. 2. The security management system according to claim 1 ,
Based on the Fault Tree (FT), a condition for the attack to be successful is identified by a combination of the techniques of the attack;
Obtaining countermeasures for each of the attack techniques constituting the identified combination from the threat/countermeasure information;
Generate information indicative of the measures obtained;
Security management systems. 3. The security management system according to claim 2 ,
the threat/countermeasure information includes information indicating a cost required for the countermeasure;
outputting information indicating a cost required for the countermeasure together with the information indicating the acquired countermeasure;
Security management systems. 4. The security management system according to claim 3 ,
The countermeasure with the lowest cost is output preferentially.
Security management systems. 3. The security management system according to claim 2 ,
outputting information indicating the risk of the threat together with the information indicating the acquired countermeasure;
Security management systems. 2. The security management system according to claim 1,
The attack path of the threat assumed in the model to be evaluated is a path extracted by imposing a preset constraint on a path connecting an asset at an entry point of the attack and an asset that is a target of the attack in the model to be evaluated.
Security management systems. 2. The security management system according to claim 1,
The threat/countermeasure information is information acquired from an external server communicably connected via the Internet.
Security management systems. An information processing device having a processor and a memory,
Threat/countermeasure information including information on attacks against each of the assets constituting the information processing system and information on countermeasures against the attacks;
an evaluation target model including information for identifying a configuration of an evaluation target system, which is an information processing system that is a target for evaluating security measures;
Attack path information indicating attack paths of threats assumed in the evaluation target model;
storing the
generating information indicating an attack procedure for each of the assets in the attack path based on the threat/countermeasure information;
generating one or more pieces of information indicating attack procedures in the attack path based on the generated information indicating the attack procedures in each of the assets; and
generating a Fault Tree (FT) with the threat as an event by logically connecting information indicating an attack procedure in the generated attack path;
Run
the information on the attack in the threat/countermeasure information includes information indicating a strategy of the attack and information indicating a technique of the attack;
the information indicating the attack procedure in the attack path is generated based on the information indicating the attack strategy and the information indicating the attack technique ;
A step of connecting the generated information indicating the attack procedure in the attack path in a logical OR relationship; and
generating the Fault Tree (FT) by connecting information indicating each of the attack techniques to each of the connected information indicating the attack procedures in a logical AND relationship;
The security management method further comprises: 9. A security management method according to claim 8 , comprising:
The information processing device,
identifying a condition for the attack to be successful based on the Fault Tree (FT) by a combination of the attack techniques;
acquiring, from the threat/countermeasure information, a countermeasure for each of the attack techniques constituting the identified combination; and
generating information indicative of the acquired measures;
The security management method further comprises:

Images