JP7612564B2 - Security management system and security management method - Google Patents

Description

The present invention relates to a security management system and a security management method.

In recent years, the methods of cyber attacks have become more diverse, making it increasingly important to take measures against threats that target vulnerabilities in complex information processing systems. In order to take appropriate measures quickly against various threats, it is essential to efficiently plan effective countermeasures against threats.

As a mechanism for supporting the planning of security measures, for example, Patent Document 1 describes a security measures selection support system configured for the purpose of verifying the cost-effectiveness of combinations of security measures. For any combination of security measures stored in a database, the security measures selection support system calculates and outputs the total cost of the security measures for the combination and the expected amount of damage over a specified period of time when the security measures for the combination are implemented, based on the information stored in the database.

For example, Patent Document 2 describes a security operations management system that is configured for the purpose of reducing the burden on administrators who construct knowledge in security operations management using knowledge such as threat countermeasure knowledge by using knowledge that can be commonly applied to multiple information systems, even if the information systems have different system configurations. The security operations management system derives a formula for calculating a risk value that reflects the system configuration information by applying the system configuration information to common threat countermeasure knowledge that is not dependent on the system configuration information, and analyzes the risk of the information system using the formula and the system configuration information.

JP 2016-200991 A JP 2009-140041 A

However, in security consulting work, for example, which involves identifying potential threats to a client's information processing system and helping to develop countermeasures against those threats, it is necessary to clearly explain to the client that appropriate countermeasures have been implemented to defend against threatening attacks.

However, in complex information processing systems, there are many combinations of threats and countermeasures, and it takes a lot of time and effort to organize the threats and countermeasures, select countermeasures against the threats, and ensure that all countermeasures against the threats are included. In addition, when providing consulting services, it is necessary to respond in detail to various customer requests, such as the effectiveness of the proposed countermeasures against threats and the priority of the countermeasures that should be taken.

The technology described in the above Patent Document 1 does not organize the correspondence between specific threats and countermeasures. Therefore, it is not possible to grasp which threats the countermeasures are effective against. Moreover, the technology described in Patent Document 2 loses the correspondence (traceability) between threats and countermeasures, making it impossible to specifically show customers which threats the countermeasures are being taken against.

The present invention was made in consideration of this background, and aims to provide a security management system and a security management method that support the development of effective and appropriate measures against threats.

One of the present inventions for achieving the above-mentioned object is a security management system configured using an information processing device having a processor and a memory, which stores attack event information including information on attacks against each of the assets that constitute an information processing system, countermeasure list information including information on countermeasures against the attacks, and an evaluation target model including information specifying the configuration of an information processing system that is the subject of an evaluation of security countermeasures, extracts attacks expected against the assets of the evaluation target model from the attack event information, extracts countermeasures against each of the extracted attacks from the countermeasure list information, outputs a screen showing information that corresponds the extracted attacks with the extracted countermeasures , provides the screen with a function for allowing a user to select one or more of the extracted countermeasures, calculates an index indicating the attack extension effect obtained by each of the measures selected by the user, and writes information based on the calculated index on the screen .

Other problems and solutions disclosed in this application will be made clear in the detailed description of the invention and the drawings.

The present invention can assist in the development of effective and appropriate countermeasures against threats.

FIG. 1 illustrates an example of a security management system. FIG. 2 is a diagram illustrating an example of functions of a center server. FIG. 2 is a diagram illustrating an example of functions provided in a user terminal. FIG. 1 illustrates an example of an information processing device used in a configuration of a security management system. FIG. 11 is a sequence diagram illustrating an example of a countermeasure planning process. 1 is an example of a module/asset list. 11 is a schematic diagram showing an example of evaluation target information and an attack module ID. 1 is an example of a link list. This is an example of a lifecycle/participant definition. 1 is an example of a What template. 1 is an example of a What template. 1 is an example of attack event information (attack event table). 13 is an example of an impact level classification table. 13 is an example of an attack ease classification table. 1 is an example of threat list information. This is an example of an attack path model. 1 is an example of an attack event map. 13 is an example of countermeasure list information. 13 is an example of a countermeasure selection condition table. 13 is an example of a countermeasures table. 13 is an example of a presentation screen. 13 is an example of a presentation screen. 13 is an example of a presentation screen. 13 is an example of standard compliance measure information. 13 is an example of past analysis result information. FIG. 13 is a sequence diagram showing an example of a consultant-customer sequence. 13 is a flowchart illustrating an example of an attack event information update process. 13 is a flowchart showing an example of a countermeasure selection condition table update process. 13 is a flowchart showing an example of a standard compliance countermeasure information update process.

Below, an embodiment of the present invention will be described with reference to the drawings as appropriate. The following description and drawings are examples for explaining the present invention, and some omissions and simplifications have been made as appropriate for clarity of explanation. The present invention can also be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

In the following explanation, when describing identification information, we use terms such as "identifier," "name," "ID," and "number," but these terms can be used interchangeably.

In the following explanation, various types of information may be described using expressions such as "table" and "information", but the various types of information may be expressed in data structures other than these. In addition, to indicate independence from the data structure, an "XX table" etc. may be referred to as "XX information".

In addition, in the following explanation, the "communication network" may be referred to as the "communication NW." In addition, in the following explanation, the "communication interface" may be referred to as the "communication IF."

In addition, in the following explanation, duplicate explanations of identical or similar configurations may be omitted. Also, in the following explanation, the letter "S" before a reference symbol indicates a processing step.

Figure 1 shows a schematic configuration of an information processing system (hereinafter referred to as "security management system 1") described as one embodiment.

As shown in the figure, the security management system 1 includes a center server 100 and one or more user terminals 200. The center server 100 and the user terminals 200 are communicatively connected via a first communication NW 51. The center server 100 is communicatively connected via a second communication NW 52 to an external server 300 that provides information related to security (hereinafter referred to as "security-related information"). The first communication NW 51 and the second communication NW 52 are wired or wireless communication networks, such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, various public wireless communication networks, a dedicated line, etc. The first communication NW 51 and the second communication NW 52 may be a common communication network or a communication network that is connected to each other.

The center server 100 is, for example, an information processing device managed by a business providing SOC services (SOC: Security Operation Center), and uses security-related information to generate information on threats and countermeasures against threats (hereinafter referred to as "threat/countermeasure information") and provides the generated threat/countermeasure information to the user via the user terminal 200.

The user terminal 200 is an information processing device used by a user who uses the threat/countermeasure information provided by the center server 100. The user is, for example, a security advisor who provides consulting services on explaining anticipated threats to a customer's information processing system and countermeasures against those threats.

The external server 300 provides security-related information. In this embodiment, the external server 300 provides, for example, information in which tactics (TPP), techniques, and procedures that an attacker uses to achieve a target objective in an information processing system are organized in a matrix, and information on threat countermeasures (mitigation measures, detection methods) linked to specific methods that an attacker may use. Examples of information provided by the external server 300 include "ATT&CK for Enterprise" (registered trademark) provided by "MITRE (registered trademark)" and "Cyber Kill Chain" (registered trademark) developed by "Lockheed Martin (registered trademark)".

Figure 2 shows the main functions of the center server 100. As shown in the figure, the center server 100 has the following functions: a memory unit 110, an information acquisition management unit 130, an information update management unit 132, an evaluation target model generation unit 134, a threat list generation unit 140, a risk assessment unit 142, an attack path model generation unit 145, a countermeasure generation unit 150, an information presentation unit 160, and a countermeasure reception unit 165.

Of the above functions, the storage unit 110 stores various input information 111, evaluation target model 112, threat list information 113, attack path model 114, attack event map 115, countermeasure list information 116, countermeasure selection condition table 117, countermeasure proposal table 118, user-provided information 119, various reference information 120, standard specification compliant countermeasure information 122, attack event information DB 123, and past analysis result information 124. Of these, the various input information 111 includes a module/asset list 1101, evaluation target information 1102, link list 1103, lifecycle/participant definition 1104, AWhat template 1105, and attack module ID 1106. In addition, the various reference information 120 includes an impact classification table 1211 and an attack ease classification table 1212.

The information acquisition management unit 130 acquires information from the external server 300 and the user terminal 200, and manages the acquired information as various input information 111 and various reference information 120.

The information update management unit 132 acquires information from the external server 300 and reflects the acquired information in the standard compliance countermeasure information 122 and the attack event information 123. The information update management unit 132 also updates the past analysis result information 124.

The evaluation target model generation unit 134 generates an evaluation target model 112 based on various input information 111.

The threat list generation unit 140 extracts anticipated threats for the evaluation target model 112 from the attack event information 123 and manages the extracted threats in the threat list information 113.

The risk assessment unit 142 calculates a risk value for each of the extracted threats, and reflects the calculated value in the threat list information 113. The risk value is, for example, a risk score based on the Common Vulnerability Scoring System (CVSS).
The calculation is based on the Vulnerability Scoring System.

The attack path model generation unit 144 generates an attack path model 114, which is a model that reflects information indicating the attack path of each threat in the threat list information 113 in the evaluation target model 112. The attack path model generation unit 144 also generates an attack event map 115, which is information that visually shows the attack path model 114. The attack path model 114 and the attack event map 115 are described in accordance with specifications for describing cyber attack activities, such as STIX (Structured Threat Information eXpression).

The countermeasure generation unit 150 extracts countermeasures for each threat in the threat list information 113 based on the countermeasure list information 116 and the countermeasure selection condition table 117, and stores the extracted countermeasures in the countermeasure proposal table 118.
Manage to.

The information presentation unit 160 generates information (screen information, audio information, etc.) to present to the user and transmits the generated information to the user terminal 200.

The countermeasure reception unit 165 receives the countermeasure selection results by the user from the user terminal 200. The received selection results are reflected in the past analysis result information 124 by the information update management unit 132.

Figure 3 is a block diagram explaining the main functions of the user terminal 200. As shown in the figure, the user terminal 200 has the functions of a memory unit 210, a dialogue processing unit 220, a variety of input information receiving unit 230, a variety of input information transmitting unit 235, a user-provided information receiving unit 240, and a user-provided information output unit 245.

Of the above functions, the memory unit 210 stores various input information 111 and user-provided information 119.

The dialogue processing unit 220 provides functions for accepting information input from the user and presenting information to the user.

The various input information receiving unit 230 receives various input information 111 via the dialogue processing unit 220. The various input information transmitting unit 235 transmits the various input information 111 received by the various input information receiving unit 230 to the center server 100 via the first communication NW 51.

The user-provided information receiving unit 240 receives the user-provided information 119 from the center server 100 via the first communication network 51. The user-provided information output unit 245 presents the user-provided information 119 to the user via the dialogue processing unit 220.

Figure 4 shows an example of the hardware configuration of an information processing device (computer) used to implement the center server 100 and the user terminal 200.

The illustrated information processing device 10 includes a processor 11, a main storage device 12 (memory), an auxiliary storage device 13 (external storage device), an input device 14, an output device 15, and a communication device 16. These are communicatively connected via a bus, a communication cable, or the like. Examples of the information processing device 10 include a personal computer, a server device, a smartphone, a tablet, an office computer, a general-purpose machine (mainframe), and the like.

The information processing device 10 may be realized, in whole or in part, by using virtual information processing resources provided by using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a cloud system via an API (Application Programming Interface) or the like. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a cloud system via an API (Application Programming Interface), or the like. Furthermore, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a service provided by a service provider such as SaaS (Software as a Service), PaaS (Platform as a Service), IaaS (Infrastructure
This may be realized by using the Service as a Service, etc.

The processor 11 may be, for example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), or the like.
It is composed of a gate array, an application specific integrated circuit (ASIC), an artificial intelligence (AI) chip, etc.

The main memory device 12 is a device used by the processor 11 when executing a program, and is, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), or a non-volatile memory (NVRAM (Non Volatile RAM)). Various functions realized in the center server 100 and the user terminal 200 are realized by each processor 11 reading out programs and data stored (memorized) in the auxiliary memory device 13 into the main memory device 12 and executing them.

The auxiliary storage device 13 is a device that stores programs and data, and may be, for example, a solid state drive (SSD), a hard disk drive, or an optical storage device (CD (Compact Disc)
, DVD (Digital Versatile Disc), a storage system, a reading/writing device for non-transient recording media such as IC cards, SD cards, and optical recording media, a non-transient storage area of a cloud server, etc. Programs and data can be read into the auxiliary storage device 13 from other information processing devices equipped with non-transient recording media or non-transient storage devices via a recording medium reading device or a communication device 16. The programs and data stored (memorized) in the auxiliary storage device 13 are read into the main storage device 12 as needed.

The input device 14 is an interface that accepts information input from the outside, and is, for example, a keyboard, a mouse, a touch panel, a card reader, a pen-input tablet, a voice input device, etc.

The output device 15 is an interface that outputs various information such as the progress of processing and the results of processing to the outside. The output device 15 is, for example, a display device (liquid crystal monitor, LCD (Liquid Crystal Display), graphic card, etc.) that visualizes the various information described above, a device that converts the various information described above into audio (audio output device (speaker, etc.)), or a device that converts the various information described above into text (printer, etc.). Note that, for example, the information processing device 10 may be configured to input and output information to and from other devices via the communication device 16.

The input device 14 and the output device 15 constitute a user interface that realizes interactive processing with the user (accepting information, providing information, etc.).

The communication device 16 is a device that realizes communication with other devices. The communication device 16 is a wired or wireless communication interface that realizes communication with other devices via the communication medium 5, and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, etc.

In addition, the information processing device 10 may be equipped with, for example, an operating system, a file system, a DBMS (DataBase Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), etc.

Figure 5 is a sequence diagram explaining the processing performed in the security management system 1 (hereinafter referred to as "countermeasure planning processing S500"). Below, countermeasure planning processing S500 will be explained with reference to the same figure. Note that the user in the following explanation is, as an example, a security advisor who provides consulting services regarding security management for a client's information processing system (hereinafter referred to as the "evaluation target system").

As shown in the figure, the information update management unit 132 of the center server 100 acquires the latest information from the external server 300 via the second communication NW 52 at any time, and updates the contents of the standard compliance countermeasure information 122 and the attack event information 123 at any time based on the acquired information (S511). Details of the standard compliance countermeasure information 122 and the attack event information 123 will be described later.

The user terminal 200 accepts various input information 111 (module/asset list 1101, evaluation target information 1102, link list 1103, life cycle/participant definition 1104, What template 1105, and attack module ID 1106) from the user, and transmits the accepted information to the center server 100 (S512).

Figure 6 shows an example of a module/asset list 1101. The module/asset list 1101 manages information related to the modules and assets that make up the system to be evaluated. As shown in the figure, the module/asset list 1101 is made up of multiple records, each of which consists of the following items: module ID 611 (denoted as "#" in the figure; the same applies to the other figures), module name, asset 613, asset ID 614, asset type 615, and impact level 616.

Of the above items, module ID 611 stores the module ID, which is an identifier for the module. Module name 612 stores the name of the module. Asset 613 stores the name of the asset that is the target of protection from attacks among the assets that make up the module. Asset type 615 stores information indicating the type of asset (such as "function" or "information (communication data)"). CIA impact 616 stores information indicating the impact of each CIA (C: confidentiality, I: integrity, A: availability) when each asset is attacked. In this example, it is assumed that one of the ranks "none", "minor", or "severe" is selected for each CAI. The numerical value entered in this item is used, for example, to calculate a risk value.

Figure 7 is a schematic diagram showing the evaluation target information 1102 and the attack module ID 113. The figure shows an example in which the evaluation target is an "IoT control device." The entities of the evaluation target information 1102 and the attack module ID 113 are managed, for example, as a table or data in a specified format.

As shown in the figure, the evaluation target information 1102 includes information indicating modules (mobile communication function, IoT function, control information communication function, external center, control network, etc.), assets of each module (mobile communication function, external information, IoT function, control information, sensor information, control instructions, etc.), and communication between modules (pass with authentication, pass without authentication, etc.).

Attack module ID 113 includes information (hereinafter referred to as "attack module ID") indicating the module (hereinafter referred to as "attack module") that is the target of an external attack. In the example shown in the figure, the attack modules are the "external center" and the "control network", and "4" and "5" are stored in attack module ID 113.

Figure 8 shows an example of the link list 1103. The link list 1103 includes information regarding the communication paths used in the system to be evaluated and the number of authentication processes performed on each path (hereinafter referred to as the "number of authentications").

As shown in the figure, the link list 1103 is composed of multiple records, each of which has the following items: module ID (source) 811, module ID (destination) 812, link name 813, number of shortest paths 814, shortest paths 815, and number of authentications 816.

Of the above items, Module ID (source) 811 stores the module ID of the source module, and Module ID (destination) 812 stores the module ID of the destination module.

Link name 813 stores an identifier (hereinafter referred to as a "link name") that is assigned to each connection (link) between the system being evaluated and the outside world.

The number of shortest routes 814 stores the number of shortest routes connecting the source module and the destination module. The shortest routes 815 stores information indicating the above shortest routes.

The number of times authentication processing is performed on the shortest path is stored in the authentication count 816.

9 shows an example of a life cycle/participant definition 1104. The life cycle/participant definition 1104 includes information equivalent to "Who" in the 5W analysis (hereinafter referred to as "life cycle/participant definition"). As shown in the figure, the life cycle/participant definition 1104 is made up of a plurality of records each consisting of the items of a definition ID 911, a phase 912, a sub-phase 913, an overview 914, and a participant 916.

Of the above items, definition ID 911 stores a definition ID, which is an identifier for each lifecycle/participant definition.

In phase 912, information indicating a phase (such as "planning", "product development", "development and manufacturing") in the life cycle of the business carried out using the system to be evaluated is stored.In sub-phase 913, information indicating a sub-phase (such as "planning", "product design", "manufacturing") in the above life cycle is stored.

In Overview 914, information indicating an overview of the subphase is stored. In Participants 916, information indicating the participants (users, third parties, etc.) of the subphase is stored.

Figures 10A and 10B show examples of a What template 1105. The What template 1105 includes information equivalent to "What" in the 5W analysis. The What template 1105 stores What information for each asset type 615 in the module/asset list 1101. Figure 10A is an example of a What template 1105 that focuses on information assets (stored data, communication data). Figure 10B is an example of a What template 1105 that focuses on functional assets (the functions themselves, firmware that realizes the functions).

The What template 1105 illustrated in FIG. 10A and FIG. 10B includes information describing attack methods (reference numbers 1012, 1013, 1021, 1022) for each of C (confidentiality), I (integrity), and A (availability) (reference numbers 1011, 1021).

Returning to FIG. 5, next, when the information acquisition management unit 130 of the center server 100 receives various input information 111 from the user terminal 200, it manages the contents of the received various input information 111 as information defining the evaluation target model 112 (S513).

Then, the threat list generation unit 140 of the center server 100 extracts threats assumed for the evaluation target model 112 from the attack event information 123 (S514). The threat list generation unit 140 also calculates the risk value of each extracted threat using the impact classification table 1211 and the attack ease classification table 1212, and reflects the calculated values in the threat list information 113 (S515).

Figure 11 shows an example of a table (hereinafter referred to as the "attack event table") constituting the attack event information 123. The attack event table includes information that organizes the tactics, techniques, and procedures that attackers use to achieve their targeted objectives, as well as information on threat countermeasures (mitigation measures, detection methods) linked to specific methods that attackers may employ.

As shown in the figure, the illustrated attack event table is composed of multiple records including the following items: major category ID 1111, major category 1112, attack ID 1113, attack item 1114, communication IF type 1115, time required for attack 1116, attack prevention countermeasure policy 1117, and countermeasure effect 1118.

Of the above items, major category ID 1111 stores a major category ID that is an identifier for each major category. Major category 1112 stores the name of the major category.

Attack ID 1113 stores an attack ID that is an identifier for an attack in each category. Note that attack IDs are assigned in ascending order according to the principle of the order of attacks within a large category. Attack item 1114 stores information indicating the content of the attack.

In the communication IF type 1115, information is stored indicating the target of the attack (mobile communication, control network, etc.), whether an attack is selected depending on the target, and the link destination of the attack order.In the time required for the attack 1116, an estimated time required for the attack is stored.

In attack prevention countermeasure policy 1117, information specifying the countermeasure policy against the attack (in this example, the identifier of the countermeasure policy) is stored.In effect of countermeasure 1118, information indicating the effect of taking the countermeasure is stored.In this example, the effect is expressed as large, medium, or small, with large being evaluated as a 10-fold effect, medium being evaluated as a 5-fold effect, and small being evaluated as a 3-fold effect.

Figure 12A shows an example of the impact classification table 1211, and Figure 12B shows an example of the exploitability classification table 1212. The impact classification table 1211 and the exploitability classification table 1212 manage information about parameters used when calculating risk assessment values by CVSS.

12A, an impact level classification table 1211 manages information indicating a classification 1202 and a definition 1203 for each parameter (AV, AC, Au, C, I, A) 1201. In addition, in Fig. 12B, numerical values used to calculate a risk value for each classification of each parameter (AV, AC, Au) are managed.

The threat list generation unit 140 calculates a risk value for each threat extracted using the impact classification table 1211 and the attack susceptibility classification table 1212. The threat list generation unit 140 calculates the risk value, for example, from the following formulas.

[Equation 1]
Impact =10.41×(1-(1-C)×(1-I)×(1-A))
[Number 2]
Attack Ease = 20 x AV x AC x Au
[Number 3]
f(impact) = 0 (if the impact is 0), 1.176 (if the impact is non-zero)
[Number 4]
Risk value = ((0.6 x impact) + (0.4 x ease of attack) - 1.5) x f (impact)

When calculating the risk value using the above formula, for example, the threat list generation unit 140 may automatically select the parameters (AV, AC, Au).

13 shows an example of the threat list information 113. In the threat list information 113, threats extracted from the attack event information 123 for the evaluation target model 112 and the risk value of each threat are managed. As shown in the figure, the illustrated threat list information 113 includes an asset 1311, a From 131,
2, Who 1313, When 1314, Why 1315, What 1316, and risk value 1317.

Of the above items, Asset 1311 stores information indicating an asset. From 1312 stores information indicating an attack path. Who 1313, When 1314, Why 1315, and What 1316 store information used in 5W analysis. Risk value 1317 stores the risk value calculated by the threat list generation unit 140 for each threat.

Returning to FIG. 5, the attack path model generation unit 144 of the center server 100 then generates information indicating the attack paths of each threat in the threat list information 113 in the evaluation target model 112 based on the threat list information 113 as an attack path model 114 (S516). The attack path model generation unit 144 also generates an attack event map 115, which is information that visually shows the attack path model 114 (S517).

Figure 14A shows an example of an attack path model 114, and Figure 14B shows an example of an attack event map 115.

Returning to FIG. 5, the countermeasure generation unit 150 of the center server 100 then extracts countermeasures for each threat in the threat list information 113 based on the countermeasure list information 116 and the countermeasure selection condition table 117, and generates a countermeasure proposal table 118 that lists the extracted countermeasures (S518).

Figure 15 shows an example of countermeasure list information 116. The countermeasure list information 116 manages proposed countermeasure policies for threats against various assets, obtained from the external server 300 or user input, etc. Note that the countermeasures in the countermeasure list information 116 may include countermeasures that are effective against multiple attacks.

As shown in the figure, the countermeasure list information 116 is composed of multiple records having the following items: asset 1511, From 1512, Who 1513, When 1514, Why 1515, What 1516, risk value 1517, countermeasure type 1518, and countermeasure 1519.

Of the above items, asset 1511 stores information indicating an asset. From 1512 stores information indicating an attack path. Who 1513, When 1514, Why 1515, and What 1516 store information used in 5W analysis. Risk value 1517 stores a risk value calculated for the attack. Countermeasure type 1518 stores information indicating the type of target to which countermeasure 1519 is applied (hereinafter referred to as "countermeasure type"). Countermeasure 1519 stores information indicating the specific content of the countermeasure.

Figure 16 shows an example of the countermeasure selection condition table 117. The countermeasure selection condition table 117 is a table used by the countermeasure generation unit 150 when extracting countermeasures corresponding to threats extracted for the evaluation target model 112 from the countermeasure list information 116. As shown in the figure, the countermeasure selection condition table 117 is made up of multiple records having the following items: condition ID 1611, condition 1612, countermeasure type 1613, and countermeasure 1614.

Of the above items, condition ID 1611 stores a condition ID that is an identifier of the condition used to select a countermeasure. Condition 1612 stores the content of the above condition (Not, And, Or). Countermeasure type 1613 stores the countermeasure type corresponding to the condition. Countermeasure 1614 stores information indicating the content of the countermeasure corresponding to the condition.

Figure 17 shows an example of the countermeasure proposal table 118. The countermeasure proposal table 118 manages the countermeasures selected from the countermeasure list information 116 by the countermeasure selection condition table 117.

As shown in the figure, the countermeasure proposal table 118 is composed of multiple records having the following items: countermeasure ID 1711, countermeasure type 1712, and countermeasure 1713.

Of the above items, countermeasure ID 1711 stores an identifier of an individual countermeasure (hereinafter referred to as "countermeasure ID") selected from countermeasure list information 116. Countermeasure type 1712 stores information indicating the countermeasure type of the countermeasure. Countermeasure 1713 stores information indicating the content of the countermeasure.

Returning to FIG. 5, the information presentation unit 160 of the center server 100 generates user-provided information 119 based on information such as the attack event map 115 and countermeasure proposal table 118 in response to a request from the user terminal 200, and transmits the generated user-provided information 119 (screen information, audio information, etc.) to the user terminal 200 (S519).

Figures 18A to 18C show examples of screens displayed by the user terminal 200 based on the user-provided information 119 provided by the information presentation unit 160.

The screen shown in FIG. 18A (hereinafter referred to as "presentation screen 1810") is configured to allow users or customers to select measures for each threat while checking the change in security level (change in security level when evaluated according to the standard) that occurs when each measure is selected.

As shown in the figure, the presentation screen 1810 has a display column 1811 for the selection conditions of measures, a display column 1812 for measures, a display column 1813 for the presence or absence of an impact on the security level for each measure in the countermeasure proposal table 118, a selection column 1814 for measures, and a graph 1815 showing the change in security level when the selected measure is adopted. Note that the display column 1811 for the selection conditions of measures, the display column 1812 for the contents of the countermeasure proposal table 118, and the display column 1813 for the presence or absence of an impact on the security level for each measure in the countermeasure proposal table 118 display information in descending order of the risk value of the threat (descending order of risk value).

Of the above columns, the countermeasure selection condition display column 1811 displays information indicating the conditions when a countermeasure in the countermeasure proposal table 118 was selected from the countermeasure list information 116. The countermeasure display column 1812 displays information indicating the contents of the countermeasure in the countermeasure proposal table 118. The impact on security level display column 1813 displays information indicating the impact on the security level in the standard specification acquired by the information presentation unit 160 from the standard plan response countermeasure DB 122 ("○" if there is an impact, and "×" if there is no impact). The countermeasure selection column 1814 displays check boxes that accept from the user whether or not to select each countermeasure. The graph 1815 showing the change in security level displays the total value of the security level when the countermeasure selected in the countermeasure selection column 1814 is applied as a bar graph.

19 shows an example of the standard-compliant countermeasure information 122. The standard-compliant countermeasure information 122 manages information indicating, for each countermeasure, the effect (presence or absence of effect) of the countermeasure on the security level in the standard (for example, the security level (SL) defined in the international industrial security standard IEC 62443).

As shown in the figure, the table of standard specification-compliant countermeasure information 122 (hereinafter referred to as the "standard specification-compliant countermeasure table") has the following items: countermeasure ID 1911, countermeasure type 1912, countermeasure 1913, and security level 1914. Note that a standard specification-compliant countermeasure table is provided for each type of standard specification.

Of the above items, countermeasure ID 1911 stores a countermeasure ID. Countermeasure type 1912 stores a countermeasure type. Countermeasure 1913 stores information indicating the content of the countermeasure. Security level 1914 stores information indicating whether or not the security level SL1 to SL4 is applicable ("○" if applicable, "X" if not applicable).

By referring to the presentation screen 1810 shown in FIG. 18A, the user can easily check what countermeasures are available against high-risk threats that should be addressed as a priority. In addition, by selecting various patterns of countermeasures from the countermeasure selection field 1814, the user can visually (intuitively) grasp the change in the effectiveness of the countermeasures for each pattern.

The screen shown in FIG. 18B (hereinafter referred to as "presentation screen 1820") is configured to allow users or customers to select countermeasures against threats while checking the effects of each countermeasure (attack extension effect).

As shown in the figure, the presentation screen 1820 includes a display field 1821 for the extension effect by attack path and a display field 1822 for a list of countermeasures.

The display field 1821 for the extension effect by attack path includes multiple rows with the following items: path selection field 18211, attack path name 18212, communication IF 18213, attack order 18214, total attack time before countermeasures 18215, extension effect after countermeasures are implemented 18216, target threat 18217, and risk value 18218.

Among the above items, the path selection column 18211 displays a check box for the user to select an attack path. The attack path name 18212 displays the name of the attack path. The communication IF 18213 displays the type and name of the communication interface of the attack path. The attack order 18214 displays information indicating the attack order of the assets by the attack path. The total attack time before countermeasures 18215 displays the total attack time required before countermeasures are taken. The extension effect after countermeasures are taken 18216 displays the total attack time after countermeasures are taken. The value of the extension effect after countermeasures are taken 18216 illustrated in the figure is calculated based on, for example, the effect of countermeasures 1118 in the attack event table. The target threat 18217 displays information indicating the content of the threat in the attack path. The risk value 18218 displays the risk value calculated for each threat. In addition, the attack paths listed in the display field 1821 for the extension effect by attack path are displayed, for example, in order of increasing risk value 18218 (descending order of risk value).

As shown in the figure, the countermeasure list display column 1822 includes multiple rows with the following items: countermeasure ID 18221, countermeasure type 18222, countermeasure 18223, target category 18224, priority 18225, attack extension effect 18226, and implementation/non-implementation selection column 18227.

Of the above items, countermeasure ID 18221 displays the countermeasure ID. Countermeasure type 18222 displays the countermeasure type. Countermeasure 18223 displays information indicating the contents of the countermeasure. Target category 18224 displays the major category of the countermeasure. Priority 18225 displays the priority of each countermeasure within the major category. Attack extension effect 18226 displays the attack extension effect of the countermeasure. The above priority is determined in descending order of attack extension effect. Implementation presence/absence selection column 18227 displays check boxes that allow the user to select a countermeasure.

By using the presentation screen 1810 shown in FIG. 18B, the user can select a measure while checking the effect of each measure.

The screen shown in FIG. 18C (hereinafter referred to as "presentation screen 1830") is configured to allow the user or customer to select measures while checking the effect (hereinafter referred to as "protection in depth effect") of measures taken for each stage of attack (hereinafter referred to as "defense in depth").

As shown in the figure, the presentation screen 1830 includes a display field 1831 for the extension effect by attack path, a display field 1832 for a list of countermeasures (by layer), and a display field 1833 for the defense-in-depth effect.

The display field 1831 for the extension effect by attack path includes multiple rows with the following items: path selection field 18311, attack path name 18312, communication IF 18313, attack order 18314, total attack time before countermeasures 18315, extension effect after countermeasures are implemented 18316, target threat 18317, and risk value 18318.

Among the above items, the path selection column 18311 displays a check box for the user to select an attack path. The attack path name 18312 displays the name of the attack path. The communication IF 18313 displays the type and name of the communication interface of the attack path. The attack order 18314 displays information indicating the order of attacks on assets by the attack path. The total attack time before countermeasures 18315 displays the total attack time required before countermeasures are taken. The extension effect after countermeasures are taken 18316 displays the total attack time after countermeasures are taken. The value of the extension effect after countermeasures are taken 18316 illustrated in the figure is calculated based on the effect of countermeasures 1118 in the attack event table. The target threat 18317 displays information indicating the content of the threat in the attack path. The risk value 18318 displays the risk value calculated for each threat. In addition, the attack paths listed in the display field 1831 for the extension effect by attack path are displayed, for example, in order of increasing risk value 18318 (descending order of risk value).

The countermeasures list (by layer) display field 1832 includes multiple rows with the following items: major category ID 18321, major category 18322, attack ID 18323, attack item 18324, communication IF type 18325, time required for attack 18326, attack prevention countermeasure policy 18327, countermeasure effect 18328, and implementation/non-implementation selection field 18329.

Among the above items, the major category ID 18321 stores a major category ID that is an identifier for each major category. The major category 18322 stores the name of the major category. The attack ID 18323 stores an attack ID that is an identifier for an attack in each category. The attack IDs are assigned in ascending order according to the principle of the order of attacks in the major category. The attack item 18324 stores information indicating the content of the attack. The communication IF type 18325 stores information indicating the target of the attack (mobile communication, control network, etc.), whether or not an attack is selected according to the target, and the link destination of the attack order. The time required for the attack 18326 stores an estimated time required for the attack. The attack prevention countermeasure policy 18327 stores information that identifies the countermeasure policy for the attack (in this example, the identifier of the countermeasure policy). The effect of the countermeasure 18328 stores information indicating the effect when the countermeasure is taken. The value of the countermeasure effect 18328 shown in the figure is calculated based on the countermeasure effect 1118 in the attack event table. The implementation/non-implementation selection field 18329 displays check boxes that allow the user to select a countermeasure.

The defense in depth effect display field 1833 displays the total effect (total time) of the measures selected by the user in the implementation/non-implementation selection field 18329 for each major category.

By using the presentation screen 1810 shown in FIG. 18C, the user can select measures while checking the effects of taking measures for each major category.

In addition, in the above-exemplified presentation screens 1810 to 1830, information on countermeasures, etc. may be displayed, for example, in the order in which attacks are carried out. Also, for example, countermeasures may be displayed in the order of lowest cost incurred in their execution. Also, information on attacks against modules or functions located near the entrance of an external attack may be preferentially displayed.

Returning to FIG. 5, the countermeasure reception unit 165 of the center server 100 then receives the countermeasures selected by the user from the user terminal 200, and reflects the received content in the past analysis result information 124 (S521, S522).

Figure 20 is an example of past analysis result information 124. As shown in the figure, the illustrated past analysis result information 124 is composed of multiple records each consisting of the items of countermeasure ID 2011, countermeasure type 2012, countermeasure 2013, and implementation 2014.

Of the above items, countermeasure ID 2011 stores a countermeasure ID. Countermeasure type 2012 stores a countermeasure type. Countermeasure 2013 stores a countermeasure. Implementation 2014 stores information indicating whether or not the user selected the countermeasure ("○" if selected, "X" if not selected).

The contents of the past analysis result information 124 are used to check the current status of countermeasures and as reference information when taking new countermeasures.

21 is a sequence diagram for explaining the flow of a security consulting service performed between a user and a client when selecting a countermeasure (hereinafter referred to as a "consultant-client sequence S2000"). The consultant-client sequence S2000 will be explained below with reference to the same figure.

First, the user (consultant) requests the client to create input information (S2111), and the client returns the input information to the user (S2112).

The user inputs the input information received from the customer into the security management system 1 via the user terminal 200 (S2113), and causes the security management system 1 to generate countermeasures (S2114).

The user checks the countermeasures generated by the security management system 1 (for example, the contents of the countermeasure proposal table 118 shown in FIG. 17) via the user terminal 200 (S2115), and selects countermeasures while interacting with the customer using the screen showing the contents of the countermeasure proposal table 118 and the presentation screens 1810-1830 provided by the security management system 1 and displayed on the user terminal 200 (S2116, S2117).

In this way, the user can use the countermeasures and presentation screens 1810 to 1830 provided by the security management system 1 to efficiently formulate countermeasures against anticipated threats in the customer's system to be evaluated. Furthermore, by using these screens, the user can appropriately plan countermeasures while responding to customer requests in a detailed manner.

<Various update processes>
Next, the process of updating various pieces of information performed by the center server 100 will be described.

22 is a flowchart illustrating an example of a process (hereinafter referred to as "attack event information update process S2200") that the information update management unit 132 performs when updating the attack event information 123. The attack event information update process S2200 will be described below with reference to the same figure.

When the information update management unit 132 acquires update information (difference information) for the attack event information 123 from the external server 300, the user terminal 200, etc. (S2211), it accepts input from the user of the type of communication interface that is affected by the attack in the update information (S2212).

Next, the information update management unit 132 identifies attack items for executing the purpose of the attack on the update information based on the evaluation target model 112 (S2213).

Next, the information update management unit 132 identifies the paths between the attack items and generates attack order links (S2214).

Next, the information update management unit 132 generates the time required for the attack, a countermeasure policy for preventing the attack, and the countermeasure effect (S2215).

Next, the information update management unit 132 reflects the content generated by the above process in the attack event information 123 as a new attack event.

Figure 23 is a flowchart explaining an example of the process (hereinafter referred to as "countermeasure selection condition table update process S2300") that the information update management unit 132 performs when updating the countermeasure selection condition table 117. The countermeasure selection condition table update process S2300 is executed when a new attack event is added to the attack event information 123 by the attack event information update process S2200. The attack event information update process S2200 will be explained below with reference to the same figure.

The information update management unit 132 obtains countermeasures for the new attack event from the countermeasure list information 116 (S2311).

Next, the information update management unit 132 generates a condition (Not, And, OR) and a countermeasure type in the countermeasure selection condition table 117 based on the new attack event and the acquired countermeasure (S2312).

Then, the information update management unit 132 determines whether the combination of the generated condition (Not, And, OR) and the countermeasure type already exists in the countermeasure selection condition table 117 (S2314). If it does not exist (S2313: NO), the combination of the generated condition (Not, And, OR) and the countermeasure type is added to the countermeasure selection condition table 117. If it exists (S2313: YES), the countermeasure selection condition table update process S2300 ends.

Figure 24 is a flowchart explaining an example of the process (hereinafter referred to as "standards compliance countermeasure information update process S2400") that the information update management unit 132 performs when updating the standard compliance countermeasure information 122. As shown in the figure, when the information update management unit 132 acquires a new standard compliance countermeasure (S2411), it reflects the acquired standard compliance countermeasure in the information update management unit 132 (S2412).

As described above in detail, the security management system 1 of this embodiment extracts anticipated attacks against the assets of the evaluation target model 112 from the attack event information 123, extracts countermeasures against each of the extracted attacks from the countermeasure list information 116, and generates a screen showing information that correlates the extracted attacks with the extracted countermeasures and presents it to the user. Therefore, by inputting information about the evaluation target model 112, the user can obtain information about anticipated threats and countermeasures for that model.

In addition, since the information is displayed in order of risk value (e.g., descending order of risk value), the user can appropriately determine the priority of countermeasures, taking into consideration the necessity of the countermeasures. In addition, since the threats and countermeasures are displayed on the screen in correspondence with each other, the user can plan countermeasures without missing anything.

In addition, users can easily understand which countermeasures are effective against multiple threats, allowing them to plan countermeasures efficiently and at reduced costs. Users can also provide consulting services while explaining the relationship between threats and countermeasures to their customers.

In addition, users can simulate the effects of measures simply by selecting whether or not to implement them, allowing them to show customers a variety of measures and efficiently plan security measures that will satisfy customers.

Although the embodiments have been described above, the present invention is not limited to the above-described embodiments, and includes various modified examples, and is not necessarily limited to those having all of the configurations described. It is also possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

1 security management system, 51 first communication network, 52 second communication network, 100 center server, 200 user terminal, 300 external server, 110 memory unit, 111 various input information, 1101 module/asset list, 1102 evaluation target information, 1103 link list, 1104 life cycle/participant definition, 1105 What template, 1106 attack module number, 112 evaluation target model, 113 threat list information, 114 attack path model, 115 attack event map, 116 countermeasure list information, 117 countermeasure selection condition table, 118 countermeasure proposal table, 119 user-provided information, 120 various reference information, 1211 impact classification table, 1212 attack ease classification table, 122 standard compliance countermeasure information, 123 attack event information, 124 past analysis result information, 130 Information acquisition management unit, 132 Information update management unit, 134 Evaluation target model generation unit, 140 Threat list generation unit, 142 Risk assessment unit, 145 Attack path model generation unit, 150 Countermeasure generation unit, 160 Information presentation unit, 165 Countermeasure reception unit, S1500 Countermeasure planning process, 1810-1830 Presentation screen

Claims (14)

A security management system configured using an information processing device having a processor and a memory,
Attack event information including information regarding attacks on each of the assets constituting the information processing system;
A countermeasure list including information regarding countermeasures against the attack;
an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures;
Remember,
extracting from the attack event information an attack anticipated against the asset of the evaluation target model;
Extracting countermeasures against each of the extracted attacks from the countermeasure list information;
outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other;
providing a function on the screen for allowing a user to select one or more of the extracted measures;
calculating an index showing an attack extension effect obtained by each of the countermeasures selected by the user;
information based on the obtained index is displayed on the screen;
Security management systems. A security management system configured using an information processing device having a processor and a memory,
Attack event information including information regarding attacks on each of the assets constituting the information processing system;
A countermeasure list including information regarding countermeasures against the attack;
an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures;
Remember,
extracting from the attack event information an attack anticipated against the asset of the evaluation target model;
Extracting countermeasures against each of the extracted attacks from the countermeasure list information;
outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other;
providing a function on the screen for allowing a user to select one or more of the extracted measures;
calculating an index showing the effectiveness of security measures obtained by each of the measures selected by the user;
Entering information based on the obtained index on the screen;
displaying on said screen information showing the effect of security measures obtained by each of said measures selected by the user for each stage of attack;
Security management systems. 3. The security management system according to claim 1,
the information showing the extracted attacks and the extracted countermeasures in association with each other is displayed on the screen in descending order of the risk value evaluated for each of the extracted attacks;
Security management systems. 4. The security management system according to claim 3 ,
storing information on vulnerability of the evaluation target model based on evaluation criteria in the Common Vulnerability Scoring System (CVSS);
determining the risk value based on the information;
Security management systems. 5. The security management system according to claim 4 ,
The evaluation criteria are at least one of the following: attack vector (AV), attack condition complexity (AC), authentication requirement before the attack (AU), confidentiality impact (C), integrity impact (I), and availability impact (AI);
Security management systems. 3. The security management system according to claim 1,
The indicator is a security level based on a standard in an industrial control system.
Security management systems. 7. The security management system according to claim 6,
displaying on the screen a graph showing an integrated value of the security levels for each of the measures selected by the user;
Security management systems. 7. The security management system according to claim 6,
A communication connection is established with another information processing device that provides a security level based on the standard,
obtaining latest information on the security level based on the standard from the other information processing device as needed and using the information in calculating the index;
Security management systems. 3. The security management system according to claim 1,
At least one of the countermeasures is effective against a plurality of the attacks.
Security management systems. 3. The security management system according to claim 1,
A communication connection is established with another information processing device that provides the attack event information,
acquiring latest information of the attack event information from the other information processing device as needed and updating the stored attack event information;
Security management systems. 3. The security management system according to claim 1,
a communication connection with another information processing device that provides conditions for extracting countermeasures against each of the extracted attacks from the countermeasure list information;
obtaining the latest information on the conditions from the other information processing devices as needed and using the information to extract the countermeasures;
Security management systems. An information processing device having a processor and a memory,
Attack event information including information regarding attacks on each of the assets constituting the information processing system;
A countermeasure list including information regarding countermeasures against the attack;
an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures;
storing the
Extracting, from the attack event information, attacks assumed against the assets of the evaluation target model;
extracting countermeasures against each of the extracted attacks from the countermeasure list information ;
outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other;
providing a function on the screen that allows a user to select one or more of the extracted measures;
determining an index indicating an attack extension effect obtained by each of the countermeasures selected by a user;
And,
a step of displaying information based on the obtained index on the screen;
A security management methodology. An information processing device having a processor and a memory,
Attack event information including information regarding attacks on each of the assets constituting the information processing system;
A countermeasure list including information regarding countermeasures against the attack;
an evaluation target model including information for identifying a configuration of an information processing system to be evaluated for security measures;
storing the
Extracting, from the attack event information, attacks assumed against the assets of the evaluation target model;
extracting countermeasures against each of the extracted attacks from the countermeasure list information ;
outputting a screen showing information indicating the extracted attacks and the extracted countermeasures in association with each other;
providing a function on the screen that allows a user to select one or more of the extracted measures;
determining an index showing the effectiveness of security measures obtained by each of the measures selected by the user;
a step of displaying information based on the obtained index on the screen;
And,
a step of displaying on said screen information showing the effect of security measures obtained by each of said measures selected by a user for each stage of an attack;
A security management methodology. 14. A security management method according to claim 12 or 13 , comprising:
a step of displaying, on the screen, the information indicating the extracted attacks and the extracted countermeasures in association with each other, in descending order of risk values evaluated for each of the extracted attacks, by the information processing device;
The security management method further comprises:

Images