JP7682073B2 - Security measures support device and security measures support method - Google Patents

Description

The present invention relates to a security measures support device and a security measures support method.

It is important to analyze security threats that exploit system vulnerabilities and develop effective countermeasures. However, as these threats tend to become more diverse and sophisticated with each passing year, the costs and effort required to analyze the risks and develop countermeasures are also increasing.
As a conventional technique for analyzing and evaluating security risks, a risk assessment countermeasure planning system that determines countermeasures for reducing vulnerabilities and security tests (see Patent Document 1) has been proposed.

This system is a risk assessment and countermeasure planning system that has a processing device and a storage device, and that plans countermeasures and security tests against attacks against a system. The storage device stores a vulnerability database that stores vulnerability information about vulnerabilities, and a product information database that stores product information. The processing device has an input/output processing unit that receives design information, a vulnerability analysis unit that analyzes the vulnerabilities based on the design information, a threat analysis processing unit that analyzes threats to the system based on the analysis results of the vulnerability analysis unit and outputs the threat analysis results, a countermeasure planning unit that plans the countermeasures to reduce the impact of the vulnerabilities based on the threat analysis results output from the threat analysis processing unit and the vulnerability information stored in the vulnerability database, a security test planning unit that plans the security test based on the countermeasure planning unit, an evaluation calculation unit that performs an evaluation based on the security test planned by the security test planning unit and outputs the evaluation results, and a result processing unit that processes the evaluation results evaluated by the evaluation calculation unit, generates security countermeasures as the product information, and stores them in the product information database.

JP 2020-166650 A

Conventional technology can output insufficient security measures based on the cost of the measures, but it does not cover optimization of the countermeasure locations and countermeasure contents based on the constraints and system configuration based on the system configuration. In other words, it only statically outputs countermeasures corresponding to one threat event, and does not consider the countermeasure effectiveness and cost for the entire system.
Therefore, an object of the present invention is to provide a technique that can support efficient selection of cost-effective security measures with a small number of work steps for the entire target system.

The security countermeasure support device of the present invention, which solves the above-mentioned problems, is characterized by comprising a storage device that retains profile information on a target system for security countermeasures and candidate information on security countermeasures determined according to the points and patterns of attacks, a process that compares information on the occurrence points and patterns of each attack identified based on the profile information with the candidate information to identify candidate security countermeasures for each of the attacks, a process that calculates, for each of the candidate security countermeasures , the response scope and implementation cost for each of the attacks, and the application conditions for the candidate security countermeasures , based on the candidate information, and a calculation device that executes a process of determining the priority order of the candidate security countermeasures based on the result of the calculation, that is, the response scope is large and the implementation cost and the number of application conditions are small.
In addition, the security countermeasure support method of the present invention is characterized in that an information processing device stores in a storage device profile information related to a target system for security countermeasures and candidate information on security countermeasures determined according to the points and patterns of attacks, and executes a process of comparing information related to the occurrence points and patterns of each attack identified based on the profile information with the candidate information to identify candidate security countermeasures for each of the attacks, a process of calculating, based on the candidate information , the response scope and implementation cost for each of the candidate security countermeasures, and the application conditions for the candidate security countermeasures, and a process of determining the priority order of the candidate security countermeasures based on the result of the calculation that the response scope is large and the implementation cost and the number of application conditions are small.

The present invention makes it possible to assist in the efficient selection of cost-effective security measures for the entire target system with minimal work effort.

1 is an overall configuration diagram including a security countermeasure support device according to an embodiment of the present invention; 1 is a diagram illustrating an example of a hardware configuration of a security countermeasure support device according to an embodiment of the present invention. 1 is a configuration diagram of a network system to which a security measure according to an embodiment of the present invention is applied. 1 is an explanatory diagram of a logical path on a target system of a security measure according to the present embodiment. 1 is an explanatory diagram of a logical path on a target system of a security measure according to the present embodiment. 1 is a table showing an attack procedure performed along an attack path in this embodiment. 1 is a table showing an attack procedure performed along an attack path in this embodiment. 11 is a diagram showing an example of the configuration of a point list in a system profile of the present embodiment. FIG. 11 is a diagram showing an example of a configuration of a logical configuration profile in a system profile of the present embodiment. FIG. FIG. 11 is a diagram illustrating an example of a configuration of a physical configuration profile in a system profile of the present embodiment. FIG. 2 is a diagram illustrating an example of the configuration of a countermeasure candidate DB according to the present embodiment. FIG. 11 is a diagram illustrating an example of an attack path identification flow in this embodiment. FIG. 2 is a diagram showing a specific example of a point requiring countermeasures in this embodiment. FIG. 11 is a diagram showing a list of points requiring countermeasures in this embodiment. FIG. 2 is a diagram showing an example of a flow of a security countermeasure support method according to the present embodiment. FIG. 11 is a diagram illustrating an example of a list of countermeasure candidates in the present embodiment. FIG. 11 is a diagram showing a specific example of cost determination in the present embodiment. FIG. 11 is a diagram showing an example of output in this embodiment.

<Overall composition>
An embodiment of the present invention will be described in detail below with reference to the drawings. Fig. 1 is an overall configuration diagram including a security countermeasure support device 100 according to the present embodiment. The security countermeasure support device 100 shown in Fig. 1 is a computer capable of supporting efficient selection of cost-effective security countermeasures with a small number of work steps for the entire target system 10.

As shown in FIG. 1, the security countermeasure support device 100 of this embodiment is communicatively connected to a target system 10 and a user terminal 200 via an appropriate network 1 such as the Internet or a LAN (Local Area Network).

Alternatively, instead of this configuration, the security countermeasure support device 100 may be configured as a standalone machine, and may obtain information about the target system 10 for security countermeasures through its own user interface and execute predetermined processing.

On the other hand, the target system 10 for security measures is a system whose physical and logical configuration is described in a system profile (profile information).

This target system 10 has assets (e.g., personal information, technical information, trade secrets, etc.) that may be subject to attack by a malicious third party. Of course, there is no limitation on the types of assets. In addition, assets that are targets of attack are not limited to those that are directly subject to theft, such as specific information or data.

The user terminal 200 is, for example, a terminal operated by a user of the security countermeasure support service provided by the security countermeasure support device 100 or by an administrator of the service. Specifically, the user terminal 200 may be a personal computer, a smartphone, a tablet terminal, or the like.
<Hardware Configuration>
The hardware configuration of the security countermeasure support device 100 of this embodiment is as shown in FIG.

That is, the security measure support device 100 includes a storage device 101, a memory 103, a computing device 104, an input device 105, an output device 106, and a communication device 107.

Of these, the storage device 101 is composed of an appropriate non-volatile storage element such as an SSD (Solid State Drive) or a hard disk drive.

In addition, memory 103 is composed of a volatile memory element such as RAM.

The calculation device 104 is a CPU that executes the program 102 stored in the storage device 101 by reading it into the memory 103, etc., and performs overall control of the device itself as well as various judgments, calculations, and control processes.

The input device 105 is an input device such as a keyboard that accepts key input from the user and a microphone that accepts voice input.

In addition, the output device 106 is an output device such as a display that displays the processing results of the calculation device 104.

The communication device 107 is assumed to be a network interface card or the like that is connected to the network 1 and handles communication processing with the target system 10 and the user terminal 200.

Note that if the security measure support device 100 does not function as a standalone machine and input and output are performed via the user terminal 200, the input device 105 and output device 106 may be omitted.

In addition to the program 102 for implementing the functions required for the security countermeasure support device of this embodiment, at least a system profile 125 and a countermeasure candidate DB 126 are stored in the storage device 101. However, details of these databases will be described later.
<Systems subject to security measures>
Here, a configuration example of the target system 10 to which the security measures are applied in this embodiment will be described with reference to FIGS. 3A to 4. FIG.

The target system 10 includes an untrusted OA-NW (Network) such as the Internet, an information NW,
Each device is connected via a control network and a line network. The information network and the control network are wired LANs (Local Area Networks), and the line network is a serial peer connection.

The information network includes a monitoring terminal, a security gateway (GW), a monitoring control server, and an information network.
The control NW is connected to a monitoring control server, a control NW switch, and a PLC.
(Programmable Logic Controller). The line NW connects the PLC and the local HMI (Human Machine Interface).

The monitoring terminal can remotely operate the monitoring control server and the PLC. The local HMI can operate the PLC.

As shown by the wavy arrow in Figure 3A, attack path AP11 follows the route from security gateway → monitoring terminal → monitoring control server → PLC, and indicates unauthorized access with the PLC as the attack target (asset point). In this way, the attack path passes through each device (also called points or components) in order from the starting point (security gateway) to the ending point (PLC).

The number "6.44" attached to each device in the Security GW[6.44] in Figure 3A indicates the point importance of that device. Point importance is a parameter that indicates the importance of increasing security strength as the number increases, and is entered by the administrator for each device in advance.

Point importance, for example, is the importance of that point as an asset in business, and devices that store important confidential information such as customer personal information have a higher value. Alternatively, point importance is the degree to which an attacker can launch an attack, which can be derived from the layout (connection configuration) of the network system, and the higher the value, the easier it is for an attacker to access the device.

From the perspective of the side defending against attacks from attackers, it is necessary to block (kill) the attack at at least one point along the attack path AP11 "security gateway → monitoring terminal → monitoring control server → PLC", either at the security gateway, the monitoring terminal, or the monitoring control server.

In other words, by setting at least one kill point from the set of candidate points that make up an attack path, it is possible to block attacks that pass through that attack path (kill chain).

Here, if we focus on the attack path AP11, for example, if the attack is successfully blocked by using the security gateway at the starting point as the kill point, unauthorized access will not reach the monitoring terminal or monitoring control server at the subsequent stages, so there is no need to take excessive security measures. In other words,
By selecting kill points, we can propose cost-effective security measures.

Furthermore, we will explain the classification of attack paths. Attackers' attacks are classified into logical attacks on computers, such as unauthorized access, and physical attacks, such as the attacker invading a premises and destroying equipment. Therefore, an attack path in which the attacks from the start point to the end point are all logical, such as attack path AP11 in Figure 3A, is called a "logical path."

On the other hand, an attack path in which all attacks from the start point to the end point are physical attacks is called a "physical path," and an attack path that combines a physical path and a logical path is called a "logical path."

Figure 3B is an explanatory diagram of logical paths on the target system 10 of Figure 3A. Even in the same target system, important asset points may be distributed across multiple locations. Figure 3B shows attack path AP21 targeting the monitoring terminal, attack path AP22 targeting the monitoring control server, and attack path AP23 targeting the PLC.

Here, we define the number of stages that the attack path passes through.
Since the attack path is traced in the order of security gateway → information network → monitoring terminal, the points after the OA-NW are a total of three: security gateway, information network, and monitoring terminal. Therefore, the number of stages in the attack path AP21 is three.

The attack path AP22 follows the order OA-NW → security GW → information NW → monitoring terminal → monitoring control server. However, since "monitoring terminal → monitoring control server" can be remotely controlled, it is counted as 0 steps. Therefore, the number of steps of the attack path AP22 is 3.

Attack path AP23 follows the order OA-NW → security GW → information NW → monitoring terminal → monitoring control server → control NW → PLC. Therefore, the number of stages in attack path AP23 is five. In this way, the more stages an attack path has, the more attack steps are required to reach the asset point, making it a more difficult attack path.

Figure 4 is an explanatory diagram of the logical path on the target system 10 of Figure 3A. The target system 10 of Figure 3A is housed in a production building 320 as a physical configuration. The production building 320 is protected by a production building door 311 between it and the entrance 310 of the uncontrolled area.

The machine room 330 in the production building 320 houses a local HMI, a PLC, and a control NW switch, and is protected by a machine room door 331.

The monitoring room 340 in the production building 320 houses a security gateway, a monitoring terminal, and a server rack 342, and is protected by a monitoring room door 341. The server rack 342 houses a monitoring control server and an information network switch, and is protected by a server rack door 343.

The attacker goes to the entrance 310 → monitoring room 340 himself and operates the monitoring terminal at hand (physical path AP31 indicated by a solid arrow). The attacker then performs unauthorized access to the monitoring control server → PLC via the monitoring terminal he operates at hand (logical path AP32 indicated by a wavy arrow).

In this way, the logical-physical path is constructed by combining the physical path AP31 and the logical path AP32.

5A and 5B are tables showing attack procedures along attack paths. Table 511 shows the detailed attack procedures of attack path AP11 in FIG. 3A. Table 512 shows the detailed attack procedures of attack path AP11 in FIG. 4.
The detailed attack procedure for the logical path (physical path AP31 + logical path AP32) is shown below.

The "ID" columns in tables 511 and 512 have been added here to distinguish between the different attack procedures for explanatory purposes. Comparing tables 511 and 512, we can see that while the attack procedures differ up until the takeover of the monitoring terminal [6.44] (ID=A06), the attack procedures from ID=A06 onwards are the same. Therefore, by setting the monitoring terminal [6.44] as the kill point, both attack paths can be blocked at one location at the same time, improving cost-effectiveness.

In this way, in order to propose cost-effective security measures, it is effective to narrow down the kill points within the target system on which to focus countermeasures.

"Path priority" refers to the priority order on a path-by-path basis, indicating the order in which countermeasures should be taken against various attack paths anticipated in the target system.

"Point priority" is a priority order on a point-by-point basis that indicates the order in which the various candidate points that make up an attack path should be targeted as kill points.

In addition, for both pass priority and point priority, the smaller the number, the earlier it will be addressed, so it is selected in order of 1st, 2nd, ...

The method for calculating path priority is explained below. For example, path priority is determined in the following order: (Guideline 1), (Guideline 2), (Guideline 3).

(Guideline 1) Prioritize the "logical path" over the "physical path." This is because a logical attack has a lower attack cost than a physical attack.

(Guideline 2) When the path priority order is the same in (Guideline 1) above, the lower the protection level of the physical security measures for the route through which the physical path passes, the higher the priority. The protection level of physical security measures can be, for example, Level 1 to 3, and the higher the level number, the more secure the current situation is, so measures can be postponed.

This protection level may be set higher the longer the distance from the starting point of entry (production building door 311 in Figure 3), or may be set according to the barrier strength of the machine room door 331, monitoring room door 341, etc. (strength of the metal used to make the door, strength of biometric authentication required to pass through the door, etc.).

(Guideline 3) When the path priority is the same in (Guideline 1) and (Guideline 2) above, the shorter the distance from the start point to the end point (the number of steps), the higher the priority. This is because the smaller the number of steps, the lower the attack cost for an attacker.

According to the guidelines 1 to 3, for example, the path priorities for various attack paths assumed in the target systems of FIGS. 3A to 4 are ranked from 1st to 8th as follows.
The notation "to logic" indicates the switching point of the attack, where the path before this notation is a physical path and the path after this notation is a logical path. First, the first place tied is both a logical path and has the same number of steps.

・1st place: [0th level (physical) + 3th level (logical) = 3 levels in total] = OA-NW → Security GW (6.44) → Information NW (Information NW switch) → Monitoring and control server (9.54)
・1st place: [0th level (physical) + 3th level (logical) = 3 levels in total] = OA-NW → Security GW (6.44) → Information NW (Information NW switch) → Monitoring terminal (6.44) = Monitoring control server (9.54)
Next, third to sixth place are all logical-physical paths with protection level LV2, and the fewer the number of steps, the higher the ranking.

・3rd place: [LV2: 4 steps (physical) + 1 step (logical) = 5 steps in total] = (uncontrolled area) → entrance → production building → monitoring room door → monitoring room → [to logic] → monitoring terminal (6.44) = monitoring control server (9.54)
・4th place: [LV2: 4 levels (physical) + 3 levels (logical) = 7 levels in total] = (uncontrolled area) → entrance → production building → monitoring room door → monitoring room → [to logic] → security GW (6.44) → information NW → monitoring control server (9.54)
・4th place: [LV2: 6 levels (physical) + 1 level (logical) = 7 levels in total] = (uncontrolled area) → entrance → production building → monitoring room door → monitoring room → rack door → server rack → [to logic] → monitoring control server (9.54)
6th place: [LV2: 6 levels (physical) + 2 levels (logical) = 8 levels in total] = (uncontrolled area) → entrance → production building → monitoring room door → monitoring room → rack door → server rack → [to logic] → information network switch (6.44) → monitoring control server (9.54)
Furthermore, the 7th and 8th places are both logical and physical passes with protection level LV3, and the lower the number of steps, the higher the ranking.

・7th place: [LV3: 4 levels (physical) + 2 levels (logical) = 6 levels in total] = (uncontrolled area) → entrance → production building → machine room door → machine room → [to logic] → control NW switch (9.21) → monitoring control server (9.54)
8th place: [LV3: 4 levels (physical) + 4 levels (logical) = 8 levels in total] = (uncontrolled area) → entrance → production building → machine room door → machine room → [to logic] → local HMI (4.94) → PLC (9.21) → control NW → monitoring control server (9.54)
<Data structure example>
Next, a description will be given of various types of information used by the security measure support device 100 of this embodiment. 6A to 6C show an example of the system profile 125 in this embodiment.

The system profile 125 in this embodiment is information that describes the logical and physical configuration of the system 10 that is the target of security measures.

This system profile 125 is composed of, for example, a point list 1251, a logical configuration profile 1252, and a physical configuration profile 1253.

The point list 1251 shown in FIG. 6A is configured to associate the platform (HW: Hardware), platform (SW: Software), attribute information (purpose), and point importance as attributes for each point name (the name of the device through which the attack path passes) of the attack path.

The logical configuration profile 1252 shown in FIG. 6B is configured to associate a network type, a network control device, and a connection point for each logical network name.

The physical configuration profile 1253 shown in FIG. 6C is configured to associate each physical area name with attribute information, adjacent physical areas, and points installed within the area.

Therefore, the security measure support device 100 can understand the physical configuration and logical configuration of the target system 10 for security measures by referring to the system profile 125.

7 shows an example of the countermeasure candidate DB 126 in this embodiment. The countermeasure candidate DB 126 in this embodiment is a database that stores candidate information of security countermeasures determined according to the points and patterns of attacks.

Such countermeasure candidate DB 126 is a collection of records that link, for each type of point, data such as an attack pattern against that point and countermeasure candidate in that case.
<Pre-processing>
The actual procedure of the security countermeasure support method in this embodiment will be described below with reference to the drawings. The various operations corresponding to the security countermeasure support method described below are realized by a program that the security countermeasure support device 100 reads into a memory or the like and executes. This program is composed of codes for performing the various operations described below.

First, the pre-processing of the security countermeasure support method in this embodiment is described. In this pre-processing, the security countermeasure support device 100 identifies the point and pattern of an attack based on the system profile 125 of the storage device 101.

In summary, the security countermeasure support device 100, based on the system profile 125, sets the point to be protected (asset point) in the target system 10 as the end point (s1), identifies the attack path from the start point, which is the point of the attack, to the end point as an attack pattern (s2), and extracts points requiring countermeasures, or kill points, based on this attack pattern (s3).

More specifically, it is as follows. The security measure support device 100 identifies the problems with the security measures to be proposed based on the system profile 125 and a specified evaluation profile. The above-mentioned evaluation profile is, for example, the judgment information of the above-mentioned points and attacker capability information, and is stored in advance in the storage device 101.

Point judgment information is information used to calculate point importance. For example, the highest value is "severe," followed by "moderate" and "minor," in that order.

- Severe: If the attack is successful, it will have an extremely large impact on operations (man-made disaster/large-scale business losses).

- Medium: A successful attack will have a moderate impact on operations (small business loss).

-Minor: Even if the attack is successful, there will be no significant impact on business operations.

The attacker capability information indicates the attacker's expected capabilities in relation to the points mentioned above. Below, the higher the level, the more capable the attacker is.

- Level 3: An attacker with severe malice and advanced attack skills.

-Level 2: Attackers with mild malice and simple attack skills.

- Level 1: Misoperation/prank level attack.

For example, if a storage device for map data that only contains general geographical information such as rivers is protected as the point mentioned above, there is little benefit to attacking that point, so it is unlikely that a level 3 attacker would take the risk to attack. Therefore, the cost of countermeasures can be reduced by using only light security measures that only protect against level 1 attackers.

The security measure support device 100 also specifies which of the points scattered throughout the target system 10 should be protected as asset points according to the above-mentioned evaluation profile (point importance, attacker capability).

For example, by setting only points with a point importance of "very high" as asset points, countermeasure costs can be significantly reduced. Alternatively, the administrator of the target system 10 may directly specify individual points as asset points from the target system 10. The administrator also specifies the degree of attacker capability that each specified asset point needs to be protected from. For example, when protecting a storage device containing bank account information as an asset point, it is necessary to implement robust security measures that can protect against not only level 1 and 2 attackers, but also level 2 attackers.

The security countermeasure support device 100 references attack pattern information (not shown) stored in advance in the storage device 101 and generates an attack path (attack procedure) to each asset point specified in the above process.

The attack pattern information described above is information that indicates the attack procedures that are performed along the attack path. This information indicates the detailed attack procedures for the attack path and the detailed attack procedures for the logical-physical path (physical path + logical path). The attack path information has already been described.

The attack path generation process is performed for each asset point (e.g., according to the priority order between the attack paths) until attack paths are generated with all asset points already specified as above as end points.

For each attack path generated as described above, the security measure support device 100 determines the critical candidate points (those that can effectively kill the attack path) as kill points, i.e., points requiring countermeasures.

Below are four examples of algorithms for determining points requiring countermeasures: (Algorithm 1) to (Algorithm 4).

As (algorithm 1), the security measure support device 100 determines the point (starting point) closest to the attack origin of each attack path as the point requiring countermeasures. This allows unauthorized access to be appropriately blocked at the entrance to the in-house system by border control measures, making it possible to secure a wide area within the in-house system.

For example, for the logical path "OA-NW → security GW (6.44) → information NW (information NW switch) → monitoring control server (9.54)", the security measure support device 100 sets the point priority in the order from the starting point, namely, the security GW in first place, the information NW (information NW switch) in second place, and the monitoring control server in third place. Then, the security measure support device 100 sets the security GW with the first point priority as the point requiring countermeasures.

In addition, for a logical-physical path connecting a physical path to a logical path, the higher the protection level of the physical path included in the logical-physical path, the more secure the subsequent logical path is. Therefore, in Fig. 4, a first logical-physical path that starts a logical path from a monitoring terminal outside the server rack 342 to a PLC without opening the server rack 342 is given a higher path priority than a second logical-physical path that starts a logical path to a PLC after opening the server rack 342 and physically attacking the monitoring control server.

As a result, the security measure support device 100 makes the starting point of the first logical-physical path (monitoring terminal) more likely to be selected as a point requiring countermeasures by giving it a higher point priority than the starting point of the second logical-physical path (monitoring control server).

In (algorithm 2), the security measure support device 100 designates a point where multiple attack paths converge (in FIG. 4, this corresponds to the monitoring terminal [6.44]) as a point requiring countermeasures. In addition, when there are multiple consolidation points, the point that consolidates the greater number of attack paths is given priority in designating the point requiring countermeasures as a point requiring countermeasures. This makes it possible to block multiple attack paths collectively in one location, thereby improving cost-effectiveness.

For example, Figure 3B shows the following three attack paths:

・Attack path AP21 "OA-NW → Security GW → Information NW → Monitoring terminal"
・Attack path AP22 "OA-NW → Security GW → Information NW → Monitoring terminal → Monitoring control server"
・Attack path AP23: "OA-NW → Security GW → Information NW → Monitoring terminal → Monitoring control server → Control NW → PLC"
In this case, the points priority is as follows:

[1st place] Security GW, monitoring terminal (used by attack paths AP21, AP22, and AP23)
[Second place] Monitoring and control server (used by attack paths AP22 and AP23)

[3rd place] PLC (attack pass used by AP23)
As (Algorithm 3), for a set of candidate points that make up one attack path, if the same type of countermeasure is possible for multiple candidate points, the security measure support device 100 designates those multiple candidate points as points requiring countermeasures.

An example of a countermeasure of the same type would be to install the same security software on multiple routers running the same type of network OS.

As a result, multiple countermeasure points are set for one attack path, allowing focused security on one attack path. In addition, even if the same type of countermeasure is applied to multiple locations, the cost required for applying it to one location does not increase significantly, making it possible to implement cost-effective countermeasures over a wide area.

As (algorithm 4), the security countermeasure support device 100 selects points requiring countermeasures, taking into consideration the current countermeasure status that has been checked on the countermeasures presence/absence confirmation sheet. This countermeasures presence/absence confirmation sheet associates, for each point in the target system 10, an attack pattern that is the procedure for attacking that point with a countermeasure item for that attack pattern, and is stored in the storage device 101 by the security countermeasure support device 100. In addition, the countermeasures presence/absence confirmation sheet is provided with a check box for each countermeasure item, which allows the administrator to input whether or not a countermeasure is currently in place.

The security countermeasure support device 100 presents the pre-check countermeasure presence/absence confirmation sheet to the administrator on the output device 106 (outputs it on the screen) and accepts input by having the administrator click the check box to enter information.

For example, the security measure support device 100 determines the protection level for each attack path from the countermeasure status of the countermeasure-requiring points that have been checked on the countermeasure availability confirmation sheet described above, and selects the candidate points for the attack path with the lowest protection level as countermeasure-requiring points.

This improves cost-effectiveness by providing comprehensive protection against multiple attack paths.

Specific examples of points requiring countermeasures extracted as described above are shown in Figures 9 and 10. The points requiring countermeasures shown in Figure 9 are highlighted in gray based on their importance, etc., in scenarios 1 to 3, which define the attack patterns at each point in the extracted attack path.

10 shows a list of such points requiring countermeasures. Each record in the list, i.e., the information of a point requiring countermeasure, specifies the name of the point requiring countermeasures (e.g., user terminal, information LAN), the name of the attack pattern, and the severity.
<Flow example>
The actual procedure of the security countermeasure support method in this embodiment will be described below with reference to the drawings. The various operations corresponding to the security countermeasure support method described below are realized by a program that the security countermeasure support device 100 reads into a memory or the like and executes. This program is composed of codes for performing the various operations described below.

Figure 10 is a diagram showing an example of the flow of the security countermeasure support method in this embodiment. In this case, the security countermeasure support device 100 compares the list of points requiring countermeasures described above (points determined to be assets requiring countermeasures and information on attack patterns thereon) with each record in the countermeasure candidate DB 126, and identifies countermeasure candidates that match the point type and attack pattern for each point requiring countermeasure (s10).

An example of a list of candidate countermeasures identified in this way is shown in Figure 12. This list shows a specific example in which candidate security countermeasures are linked to each combination of points and attack patterns.

Next, the security measure support device 100 calculates the scope of measures to be taken against each attack and the implementation costs for each of the candidate security measures identified in s10 based on the candidate information for the candidate security measures (s11).

The calculation of the above-mentioned countermeasure scope is a process of counting the number of points requiring countermeasures for which the candidate security countermeasure will be effective. For example, in the case of candidate countermeasure (1) "education and training of users of user terminals," there is only one countermeasure point requiring countermeasures that will be effective, #1, so the countermeasure scope is also "1." On the other hand, in the case of candidate countermeasure (2) "introduction and activation of malware prevention functions on user terminals," there are three countermeasure points requiring countermeasures that will be effective, #1, #2, and #5, so the countermeasure scope is also "3."

Calculation of implementation costs involves a process of extracting cost information for candidate security measures from the corresponding records in candidate measure DB 126. For example, in the case of candidate measure (1) "education and training of users of user terminals," the implementation cost is "¥50k" according to the corresponding record in candidate measure DB 126. On the other hand, in the case of candidate measure (2) "introduction and activation of malware prevention functions in user terminals," the implementation cost is "¥500k."

The implementation costs obtained in this way can be managed and used either as actual values or as level values (large, medium, small) compared to a certain base amount.

The security measure support device 100 also calculates the application conditions for each candidate security measure based on the candidate information (s12).

The calculation of the application conditions described above involves a process of extracting the application conditions for the candidate security measures from the corresponding records in the candidate measures DB 126.

For example, for candidate countermeasure (1) "education and training of users of user terminals," the applicable condition is "none." On the other hand, for candidate countermeasure (2) "introduction and activation of malware prevention functions on user terminals," the applicable condition is "point = "user terminal, OS = "Enterprise OS," HW = "Host Device."

The security measure support device 100 also determines the priority order between the candidate security measures based on the results of the calculations in s11 and s12, which show that the scope of the measures is large and the implementation cost and number of application conditions are small (s13). Of course, in this case, the severity of the countermeasure points may also be taken into account.

However, which of the following factors is given more importance: the broad scope of coverage, low implementation costs, or the small number of applicable conditions is determined by the user's predefined settings.

For example, one possible operation would be to first sort security countermeasure candidates by lowest implementation cost, then give priority to measures with a larger scope than a certain standard, followed by measures with a smaller number of applicable conditions, and finally measures with a higher severity. Of course, this is just one example, and there are no limitations on which factors should be prioritized, or how to operate according to the level of priority.

In the example of determining security countermeasure costs shown in Figure 13, for example, if security countermeasure candidates are sorted primarily by the lowest implementation cost, and then the top-ranked measures are prioritized according to the scope of measures that exceed a certain threshold, then (1), (3), (6), and (7) are identified as measures with "low" implementation costs. From these, the measures with the largest number of "effective countermeasure points," high severity, and few applicable conditions are selected. The final priority order among the security countermeasure candidates is (3), (1), (6), and (7), from highest to lowest.

The security measure support device 100 also outputs information regarding the priority order of the candidate security measures determined in s13 (see FIG. 14) to the output device 106 or the user terminal 200 (s14), and ends the process.

The above describes in detail the best mode for carrying out the present invention, but the present invention is not limited to this, and various modifications are possible without departing from the spirit of the present invention.

This embodiment makes it possible to provide support for the efficient selection of cost-effective security measures for the entire target system with minimal work effort.

The description in this specification makes clear at least the following. That is, in the security measure support device of this embodiment, the computing device may further calculate the application conditions of each of the candidate security measures based on the candidate information, and when determining the priority, determine the priority of the candidate security measures based on the result of the calculation that the response scope is large and the implementation cost and the number of application conditions are small.

This makes it possible to propose priorities that take into consideration the breadth of coverage of security measures (i.e., the number of types of points that can be addressed) and low implementation costs, as well as ease of implementation. As a result, it becomes possible to more efficiently support the selection of cost-effective security measures with fewer man-hours for the entire target system.

In addition, in the security measure support device of this embodiment, the computing device may further execute a process of outputting information regarding the determined priority order of the candidate security measures to a specified device.

This makes it possible to output and display information on the priority order of candidate security measures to external clients via a specified network as appropriate. This in turn makes it possible to more efficiently support the selection of cost-effective security measures for the entire target system with minimal work effort.

In addition, in the security countermeasure support device of this embodiment, the computing device may be configured to, based on the profile information, identify an asset point to be protected in the target system as an end point, and identify an attack path from a start point, which is the point of the attack, to the end point as the attack pattern.

This makes it possible to efficiently identify the occurrence points and patterns of each attack based on the profile information, and to appropriately identify candidate security measures based on this. Ultimately, it becomes possible to more efficiently support the selection of cost-effective security measures with less work and effort for the entire target system.

In addition, in the security countermeasure support method of this embodiment, the information processing device may further calculate application conditions for each of the candidate security countermeasures based on the candidate information, and when determining the priority, determine the priority of the candidate security countermeasures based on the result of the calculation that the scope of action is large and the implementation cost and the number of application conditions are small.

In addition, in the security countermeasure support method of this embodiment, the information processing device may further execute a process of outputting information regarding the determined priority order of the candidate security countermeasures to a specified device.

In addition, in the security countermeasure support method of this embodiment, the information processing device may be configured to, based on the profile information, set an asset point to be protected in the target system as an end point, and identify an attack path from a start point, which is the point of the attack, to the end point as the attack pattern.

1 Network 10 Target system 100 Security countermeasure support device 101 Storage device 102 Program 103 Memory 104 Arithmetic device 105 Input device 106 Output device 107 Communication device 125 System profile 126 Countermeasure candidate DB
200 User terminal

Claims (6)

a storage device that holds profile information on a target system for security measures and candidate information on security measures determined according to points and patterns of attacks;
a computing device that executes a process of comparing information on an occurrence point and a pattern of each attack identified based on said profile information with said candidate information to identify candidate security measures for each of said attacks, a process of calculating, for each of said candidate security measures , a response range and an implementation cost for each of said candidate security measures and application conditions for said candidate security measures based on said candidate information, and a process of determining a priority order for said candidate security measures based on the result of said calculation that the response range is large and the implementation cost and the number of said application conditions are small;
A security countermeasure support device comprising: The computing device includes:
and further executing a process of outputting information regarding the determined priority order of the security countermeasure candidates to a predetermined device.
2. The security countermeasure support device according to claim 1. The computing device includes:
Based on the profile information, an asset point to be protected in the target system is set as an end point, and an attack path from a start point, which is a point of the attack, to the end point is identified as a pattern of the attack.
2. The security countermeasure support device according to claim 1. An information processing device,
profile information on a target system for security measures and candidate information on security measures determined according to points and patterns of attacks are stored in a storage device;
a process of comparing information on an occurrence point and a pattern of each attack identified based on said profile information with said candidate information to identify candidate security measures for each of said attacks; a process of calculating, for each of said candidate security measures, a response range and an implementation cost for each of said candidate security measures, and application conditions for said candidate security measures, based on said candidate information; and a process of determining a priority order for said candidate security measures based on the result of said calculation, that the response range is large and the implementation cost and the number of said application conditions are small.
A security countermeasure support method comprising the steps of: The information processing device,
and further executing a process of outputting information regarding the determined priority order of the security countermeasure candidates to a predetermined device.
5. The security countermeasure support method according to claim 4 . The information processing device,
Based on the profile information, an asset point to be protected in the target system is set as an end point, and an attack path from a start point, which is a point of the attack, to the end point is identified as a pattern of the attack.
5. The security countermeasure support method according to claim 4 .

Images