JP7803045B2 - Support system, method, and program - Google Patents

Description

This disclosure relates to support systems, etc.

In recent years, cloud services have become increasingly popular as a way to reduce the cost of equipment such as servers and to allow for flexible use of services. However, because cloud services can be accessed from anywhere via the Internet, they are at risk of cyberattacks targeting them. Therefore, companies that provide or use cloud services must consider countermeasures against cyberattacks, which are becoming more sophisticated every day.

Specifically, companies using cloud services may use services that monitor the security of the entire system after it goes into operation and services that deal with security incidents as security measures for their cloud services.

Note that, as a technology related to the present disclosure, Patent Document 1 discloses a system for evaluating the security of a system that combines multiple, heterogeneous cloud services. In Patent Document 1, security is evaluated at the system design stage, since evaluating security after the system has been constructed would require rework. In particular, the security of the entire system is evaluated at the stage of performing cloud-based design in accordance with the required specifications.

JP 2015-103212 A

Typically, when building a cloud service, the design of the service, the construction of the cloud infrastructure, the development of applications, and the construction of monitoring functions for the entire service are all considered separately. Specifically, the service to be provided on the cloud is designed first, followed by the construction of the cloud infrastructure, the development of applications, and the construction of security monitoring functions for the entire service, in that order.

If security monitoring functionality for the entire service is built later, it would take time and effort to understand and revise the service design, which could result in significant costs.

Patent Document 1 does not disclose the design or development of a function to monitor the entire system after operation begins.

The purpose of this disclosure is to provide a support system or the like that reduces the cost of introducing security monitoring functions compared to when security monitoring functions are introduced for the entire system after the service has been designed or developed.

The support system disclosed herein comprises an extraction means for extracting security requirements to be complied with and cloud infrastructure functions provided by a cloud service provider, an infrastructure design instruction means for instructing the design of a cloud infrastructure that adjusts the extracted security requirements and the cloud infrastructure functions, and an implementation instruction means for introducing security monitoring functions into the cloud infrastructure based on monitored data collected from monitored devices.

The method disclosed herein extracts the security requirements to be complied with and the cloud infrastructure functions provided by the cloud service provider, instructs the design of a cloud infrastructure that adjusts the extracted security requirements and the cloud infrastructure functions, and introduces security monitoring functions into the cloud infrastructure based on monitored data collected from monitored devices.

The program disclosed herein causes a computer to execute the following processes: extracting security requirements to be complied with and cloud infrastructure functions provided by a cloud service provider; instructing the design of a cloud infrastructure that adjusts the extracted security requirements and the cloud infrastructure functions; and introducing security monitoring functions into the cloud infrastructure based on monitored data collected from monitored devices.

This disclosure makes it possible to build cloud services with security monitoring capabilities at low cost.

FIG. 1 is a block diagram showing an example of the configuration of a support system 100. FIG. 1 is a schematic diagram illustrating an example of the system configuration of an entire cloud service system. 10 is a flowchart illustrating an example of the operation of the support system 100. FIG. 10 is a block diagram showing a configuration of a support system 100 according to a modified example. 10 is a flowchart showing an example of the operation of the support system 100 according to a modified example. FIG. 5 is a block diagram illustrating an example of the hardware configuration of a computer 500.

An embodiment of the present disclosure will be described using as an example a case where a system development company builds a cloud service at the request of a client company that wishes to use the cloud service. The system development company builds a cloud infrastructure using the service functions of the cloud infrastructure provided by the cloud service provider. The system development company then designs and develops the cloud service desired by the client company on the built cloud infrastructure.

Clouds developed by system development companies may be private clouds, community clouds, public clouds, or hybrid clouds that combine these.

Note that building cloud infrastructure and designing and developing cloud services is not limited to systems development companies. For example, companies that use cloud services may build the infrastructure and design and develop the services.

The support system 100 according to an embodiment supports the construction of a cloud infrastructure that serves as the foundation for designing cloud services. FIG. 1 is a block diagram showing an example configuration of the support system 100 according to an embodiment. The support system 100 includes an extraction unit 101, a platform design instruction unit 102, and an implementation instruction unit 103. The extraction unit 101, the platform design instruction unit 102, and the implementation instruction unit 103 are embodiments of an extraction means, a platform design instruction means, and an implementation instruction means, respectively.

Figure 2 is a schematic diagram showing an example of the overall system configuration of a cloud service system. The system includes at least one of a cloud server and an on-premise server used by the ordering company. The support system 100 supports the construction of a cloud infrastructure via a communication network.

The extraction unit 101 extracts security standards that cloud services must comply with.

The security requirements that cloud services must comply with may vary depending on the client company using the cloud service. Examples of security requirements include various security standards, such as national standards (including Japan Industrial Standards (JIS Q 27000)) and international standards. Furthermore, cloud services have unique features that differ from cloud service provider to cloud service provider, so security measures that correspond to these features may be required.

Therefore, the extraction unit 101 may, for example, refer to a list of security standard items used within an organization such as an ordering company, and extract security standard items. Alternatively, the extraction unit 101 may refer to a list created with reference to security standards that are commonly referenced in a particular industry, and extract security standard items. For example, the extraction unit 101 may refer to a list created based on the "Unified Standards for Information Security Measures for Government Agencies, etc." published by a Japanese government agency.

The extraction unit 101 further extracts service functions of the cloud infrastructure provided by the cloud service provider. The extraction unit 101 may extract service functions based on input from a development staff member at the system development company. The extraction unit 101 may also extract service functions by referencing a list of service functions to be extracted held by the ordering company or the system development company.

Before extraction by the extraction unit 101 is performed, a person in charge at the system development company may perform a predetermined operation. For example, the person in charge at the system development company may confirm with the ordering company which cloud service provider the ordering company will use for the cloud service it is considering. The person in charge may also confirm whether the ordering company will use an on-premise server. Depending on the items confirmed, the person in charge may select a list of security requirements to be referenced by the extraction unit 101.

Furthermore, the person in charge may generate a list of security requirements based on the results of investigating and examining the security standards that need to be complied with. The extraction unit 101 may extract security standard items by referencing the list of security requirements created by the person in charge and a database maintained by the system development company that shows the correspondence between security requirements and security standard items. The person in charge may also create data for a list of security standard items that can be referenced by the extraction unit 101. Here, if a list has previously been created for the security standards that the person wants to comply with, the list can be reused.

Similar to the list of security requirements, the person in charge may generate a list of service functions for the cloud infrastructure. The person in charge may select a list of service functions to be referenced by the extraction unit 101. If a list of service functions to be extracted has already been created, that list can be reused.

The platform design instruction unit 102 instructs the design of a cloud platform that adjusts the security requirements extracted by the extraction unit 101 and the service functions of the cloud platform. The platform design instruction unit 102 may also give instructions to other elements, such as other systems, programs, or tools, so that the service functions conform to the security requirements. The platform design instruction unit 102 may also give instructions to personnel at the development company.

Specifically, for example, the platform design instruction unit 102 instructs other elements or personnel to map cloud platform service functions that meet security requirements. Function mapping may include installing tools, enabling various system settings, or instructing the setting of various parameters. The platform design instruction unit 102 may also display the mapping results on any display.

The person in charge may build service functions onto the platform or install programs that realize the functions according to instructions from the platform design instruction unit 102. Alternatively, the platform design instruction unit 102 may instruct other elements on the design of the cloud platform based on input from the person in charge at the system development company.

For security requirements that the platform design instruction unit 102 cannot map, for example, after the platform design instruction unit 102 has finished mapping the feasible security requirements, a person in charge at the system development company will consider using another product. A security requirement that cannot be mapped is one that cannot be met using the functions provided by the cloud service provider. Specifically, for example, the cloud service provider does not provide a function that can meet the security requirement of "securing the server so that it cannot be easily moved." Therefore, the person in charge at the system development company will use another product, such as a security wire to secure the server.

The installation instruction unit 103 installs the security monitoring function of the cloud service system into the cloud infrastructure designed by the infrastructure design instruction unit 102. The security monitoring function is a function that collects, analyzes, or preserves monitored data from monitored devices. The installation instruction unit 103 may also instruct other elements, such as other systems, programs, or tools, to install the security monitoring function. Installing a security monitoring function includes, for example, a person in charge building the function into the infrastructure or installing a program that realizes the function.

Figure 2 shows an example of a security monitoring function added to cloud infrastructure functions. The monitored devices are, for example, cloud servers or servers in an on-premise environment used by the ordering company. The security monitoring function collects logs generated by the monitored devices as monitored data. The security monitoring function may also collect logs from firewalls as monitored data. As shown in Figure 2, the logs are collected, for example, at a monitoring center.

The security monitoring function may be a function that continuously monitors the cloud service while it is running. Specifically, the security monitoring function may be a service function such as a managed security service (MSS) function that performs security monitoring, analysis, and response. In this service function, the monitored data is monitored and analyzed by monitoring equipment or humans at a monitoring center, for example, to monitor for abnormalities. Furthermore, the monitoring center takes action taking into account countermeasures against cyber attacks (vulnerability information, etc.) that are becoming more sophisticated every day.

Alternatively, the security monitoring function may be a function that monitors when an incident occurs. Specifically, for example, it is a service function that performs initial incident response when an abnormality such as a security incident occurs. In this service function, monitored data may be preserved at a monitoring center when an abnormality occurs. For example, at the monitoring center, a minimum number of logs are preserved to quickly identify the cause and identify intrusion routes and unauthorized behavior, and a simple analysis is performed. The type and amount of logs to be preserved can be selected as appropriate.

The installation instruction unit 103 may instruct the installation of either a function to analyze monitored data or a function to preserve monitored data, or both, as security monitoring functions into the cloud infrastructure.

The installation instruction unit 103 may select the necessary equipment and data to install the security monitoring function. Selecting the equipment and data necessary for the security monitoring function is included in designing the security monitoring function. The design of the security monitoring function may be performed before the extraction unit 101 extracts security criteria items.

The installation instruction unit 103 may select the necessary equipment and data based on input from a person in charge at the system development company. The installation instruction unit 103, for example, selects the equipment required to install the security monitoring function from a system consisting of a cloud infrastructure and an on-premise server. Alternatively, the installation instruction unit 103, for example, selects the monitored data or logs that need to be collected from the entire system to implement the security monitoring function. When operation of the cloud service begins, the security monitoring function collects the selected monitored data or logs from the selected monitored equipment.

Before the implementation instruction unit 103 implements the function, a person in charge at the system development company may perform a predetermined operation to realize the security monitoring function. For example, the person in charge may establish a service system at the monitoring center. The person in charge may also establish the equipment, functions, and systems required for the service at the monitoring center. The implementation instruction unit 103 then implements the service system and environment-based service monitoring function that the person in charge has established into the cloud infrastructure.

The operation of the support system 100 will be described below. Figure 3 is a flowchart showing an example of the operation of the support system 100.

First, the extraction unit 101 extracts the security requirements to be complied with and the cloud infrastructure functions provided by the cloud service provider (step S1).

The infrastructure design instruction unit 102 instructs the design of a cloud infrastructure that adjusts the extracted security requirements and cloud infrastructure functions (step S2).

The installation instruction unit 103 installs security monitoring functions based on the monitoring target data collected from the monitoring target devices into the cloud infrastructure (step S3).

Through the above processing, a cloud infrastructure is constructed that serves as the basis for designing cloud services, that satisfies the security requirements extracted by the extraction unit 101, and that has security monitoring functions implemented. After step S3, the cloud service is designed and implemented, and then operation of the cloud service begins. After operation of the service begins, monitored data is collected from the monitored devices, and analysis of the monitored data is performed.

Note that the security monitoring function may be designed before step S3, but before or after step S1.

In addition, steps S1 to S3 may be performed as needed even after the service has begun operation. This allows the cloud infrastructure, security monitoring function, and cloud service to be updated as needed even after the service has begun operation.

According to this embodiment, the cost of introducing security monitoring functions can be reduced compared to introducing security monitoring functions for the entire system after the service has been designed or developed. This is because the introduction instruction unit 103 introduces security monitoring functions into a cloud infrastructure where security requirements and cloud infrastructure functions have been adjusted. Also, cloud services can be designed on a cloud infrastructure with security monitoring functions introduced.

Cyberattacks are becoming more sophisticated every year, and incident response is becoming increasingly important, so the implementation of security monitoring functions is required as a security measure. However, these functions are not considered in the early stages of cloud service design, and are often only considered when security measures are considered in the later stages of cloud service design, or after a cyberattack has occurred.

Implementing security functions after designing a cloud infrastructure and cloud services incurs costs for the work of understanding the current state of the entire service that has already been implemented. Additionally, it can be costly to address any issues that arise when modifying the design of a cloud service to introduce security monitoring functions. According to this embodiment, as described above, security monitoring functions are applied to the cloud infrastructure, making it possible to build cloud services with security monitoring functions at low cost.

Furthermore, according to this embodiment, it is possible to design and build a cloud infrastructure that complies with security standards. This is because the extraction unit 101 extracts the security requirements that must be complied with, and the infrastructure design instruction unit 102 instructs the design of a cloud infrastructure that adjusts the extracted security requirements and the service functions of the cloud infrastructure.

If security standards are not met, damage from cyber attacks may occur after the service begins operation. Therefore, it is preferable to avoid designing and building cloud services that do not comply with security standards. However, cloud service configurations become complex when combined with on-premises servers, which can lead to inadequate security measures.

As described above, this embodiment takes security requirements into consideration, allowing for the design and construction of a secure cloud infrastructure that complies with security standards.

(Modification)
In a modified example, the support system 100 according to the above embodiment may also support the design of cloud services on a cloud platform. Fig. 4 is a block diagram showing the configuration of the support system 100 according to the modified example. In the modified example, the support system 100 further includes a service design instruction unit 104. The service design instruction unit 104 is an embodiment of a service design instruction means.

The service design instruction unit 104 instructs the design of a cloud service on a cloud platform that has security monitoring functions installed. Specifically, the service design instruction unit 104 instructs the design of a service that is tailored to the monitored data and the settings of the security monitoring functions, for example. The service design instruction unit 104 may instruct the design of a service for other elements, or may instruct a person in charge at the development company to design a service.

When building a monitoring function for the entire service after completing service design, cloud infrastructure construction, and application development, the development company's personnel will design the service using a design method that is easy to implement or that they are familiar with. As a result, when building the monitoring function, it may be necessary to modify the service design. In this embodiment, the development company's personnel will design the service to match the cloud infrastructure with built-in security monitoring functions. This reduces the amount of work required to build the monitoring function, and reduces the cost of cloud service design.

Figure 5 is a flowchart showing an example of the operation of the support system 100 according to a modified example. The operations from step S1 to step S3 are the same as those in the flowchart of Figure 3, and therefore will not be described again. After step S3, the service design instruction unit 104 instructs the design of a cloud service on a cloud platform that has security monitoring functions installed (step S4). After step S4, the cloud service is implemented, and then operation of the cloud service begins.

According to this modified example, a cloud service that takes into account security monitoring functions for the entire service can be designed at low cost. This is because the service design instruction unit 104 instructs the cloud service to be designed on a cloud platform that has security monitoring functions installed.

[Hardware configuration]
In the above-described embodiment, each component of the assistance system 100 is represented by a functional block. Some or all of the components of each device may be realized by any combination of the computer 500 and a program.

Figure 6 is a block diagram showing an example of the hardware configuration of a computer 500. Referring to Figure 6, the computer 500 includes, for example, a CPU (Central Processing Unit) 501, ROM (Read Only Memory) 502, RAM (Random Access Memory) 503, a program 504, a storage device 505, a drive device 507, a communication interface 508, an input device 509, an input/output interface 511, and a bus 512.

Program 504 includes instructions for realizing each function of each device. Program 504 is stored in advance in ROM 502, RAM 503, or storage device 505. CPU 501 executes the instructions included in program 504 to realize each function of each device. For example, CPU 501 of assistance system 100 executes the instructions included in program 504 to realize the functions of assistance system 100. RAM 503 may also store data processed in each function of each device. For example, RAM 503 of computer 500 may store a list of security requirements for assistance system 100 and a list of cloud-based service functions.

The drive device 507 reads and writes data from the recording medium 506. The communication interface 508 provides an interface with the communication network. The input device 509 is, for example, a mouse or keyboard, and accepts information input from personnel at the system development company, etc. The output device 510 is, for example, a display, and outputs (displays) information to personnel, etc. The input/output interface 511 provides an interface with peripheral devices. The bus 512 connects these hardware components. The program 504 may be supplied to the CPU 501 via the communication network, or may be stored in advance on the recording medium 506, read by the drive device 507, and supplied to the CPU 501.

Note that the hardware configuration shown in Figure 6 is an example, and other components may be added, or some components may not be included.

There are many variations in how each device can be realized. For example, each device may be realized by any combination of a different computer and program for each component. Furthermore, multiple components of each device may be realized by any combination of a single computer and program.

Furthermore, some or all of the components of each device may be realized by general-purpose or dedicated circuits including a processor, etc., or a combination of these. These circuits may be configured on a single chip, or may be configured on multiple chips connected via a bus. Some or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and a program.

Furthermore, if some or all of the components of each device are realized by multiple computers, circuits, etc., the multiple computers, circuits, etc. may be centrally located or distributed.

Furthermore, at least a portion of the support system 100 may be provided in the form of SaaS (Software as a Service). That is, at least a portion of the functions for realizing the support system 100 may be performed by software executed over a network.

The present disclosure has been described above with reference to embodiments, but the present disclosure is not limited to the above embodiments. Various modifications that would be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure.

100 Support system 101 Extraction unit 102 Infrastructure design instruction unit 103 Introduction instruction unit 104 Service design instruction unit 500 Computer

Claims (6)

An extraction means for extracting security requirements that a system realizing a cloud service to be designed should comply with and cloud infrastructure functions provided by a cloud service provider;
a platform design instruction means for instructing one of other elements including other systems, programs, or tools, and a person in charge of a development company to map the functions of the cloud platform, including installing tools, enabling the settings of the system, and setting parameters, thereby instructing the other elements or the person in charge to design a cloud platform that adjusts the extracted security requirements and the functions of the cloud platform, and further displaying the results of the mapping;
an introduction instruction means for introducing a security monitoring function that monitors the system based on monitoring target data collected from monitoring target devices of the system, including a cloud server and an on-premise server, into the cloud infrastructure in which the security requirements and functions have been adjusted;
and a service design instruction means for instructing the other element or the person in charge to design the cloud service on the cloud platform on which the security monitoring function is installed. the introduction instruction means selects the monitoring target device and the monitoring target data to be collected from the monitoring target device;
The assistance system according to claim 1 . The support system according to claim 1 or 2, wherein the monitoring target data is data that is continuously monitored while the cloud service is running in order to monitor for abnormalities. The support system according to claim 1 , wherein the monitored data is data that is preserved when an abnormality occurs and is used for analysis when the abnormality occurs. The computer
Extract the security requirements that the system implementing the cloud service to be designed must comply with and the cloud infrastructure functions provided by the cloud service provider,
Instructing either another system, program, or other element including a tool or a person in charge of the development company to map the functions of the cloud infrastructure, including installing a tool, enabling the settings of the system, and setting parameters, to design a cloud infrastructure that adjusts the extracted security requirements and the functions of the cloud infrastructure to the other element or the person in charge , and further displaying the results of the mapping;
A security monitoring function that monitors the system based on monitoring target data collected from monitoring target devices of the system, including a cloud server and an on-premise server, is introduced into the cloud infrastructure whose security requirements and functions have been adjusted;
and instructing the other element or the person in charge to design the cloud service on the cloud infrastructure in which the security monitoring function is installed. A process of extracting security requirements that a system realizing a cloud service to be designed must comply with and cloud infrastructure functions provided by a cloud service provider;
a process of instructing either another system, program, or other element including a tool or a person in charge of a development company to map the functions of the cloud infrastructure, including installing a tool, enabling the settings of the system, and setting parameters, thereby instructing the other element or the person in charge to design a cloud infrastructure that adjusts the extracted security requirements and the functions of the cloud infrastructure, and further displaying the results of the mapping;
A process of introducing a security monitoring function that monitors the system based on monitoring target data collected from monitoring target devices of the system, including a cloud server and an on-premise server, into the cloud infrastructure in which the security requirements and functions have been adjusted;
a process of instructing the other element or the person in charge to design the cloud service on the cloud platform on which the security monitoring function is installed;
A program that causes a computer to execute the following.