JP2005242754A - Security management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security management system capable of performing integrated security management such as risk analysis, formulation of security measures and security policies, and security monitoring based on vulnerability information collected from inspection target devices.
Security vulnerabilities are diagnosed for a device to be inspected 210, security measures can be presented and set, and risk analysis is performed based on vulnerability data collected from the device to be inspected 110. A risk analysis device 120 and a security measure formulation device 130 for formulating a security measure and an information security policy are provided.
[Selection] Figure 1

Description

  The present invention relates to a security management system that diagnoses security vulnerabilities in a device to be inspected and monitors vulnerabilities in a device to be inspected.

  Generally, in a computer system, there is a risk that data is destroyed, falsified, or leaked by unauthorized access from the outside, such as a buffer overflow attack, a DoS attack, or a brute force attack. Therefore, it is necessary to take sufficient security management measures in the computer system. In particular, when handling important information such as trade secrets and personal privacy, thorough security management measures are required.

  For this reason, in the conventional security management system, a pseudo-attack is applied to the inspection target device according to a preset inspection plan, and the vulnerability inspection is performed based on the behavior taken by the inspection target device against this attack. Proposals have been made so that security measures can be taken by making it possible to obtain results and identifying the type of attack that has been applied (see, for example, Patent Document 1). .

  In addition, other conventional security management systems automatically diagnose unauthorized access countermeasure rules that are optimized to diagnose vulnerabilities in protected networks and to protect vulnerabilities in protected network environments based on the diagnosis results. There has also been proposed a system in which the burden of security management work can be reduced by making it possible to stipulate automatically (see, for example, Patent Document 2).

JP 2002-229946 A JP 2002-328896 A

  Although the conventional security management system described in Patent Document 1 can output a diagnosis result of a security vulnerability and specify the type of attack on a computer system, it automatically formulates security measures. It is not done until. Therefore, all security measures must be created manually, which is a heavy burden.

  In addition, the security management system described in Patent Document 2 can automatically formulate security measures such as diagnosing vulnerabilities and prescribing optimal unauthorized access countermeasure rules based on the diagnosis results. , The burden of security management work has been reduced.

  However, in the case of this patent document 2, the security policy for countermeasures against security vulnerabilities, which is the basis for defining the rules for dealing with unauthorized access, is a fixed policy set in advance by network administrators and is regularly It cannot be updated automatically. Therefore, the illegal access countermeasure rules formulated based on this security policy are standardized, making it difficult to flexibly deal with unauthorized access.

  That is, the attack on the computer system is not limited to one type, and various types of attacks may be added. Also, the type and content of the attack may change over time. However, when security policies and security countermeasure rules are uniquely set in advance and cannot be updated regularly, it is difficult to always take appropriate countermeasures against various types of attacks.

  In any of the techniques described in Patent Documents 1 and 2, risk analysis and statistical analysis are not performed based on collected vulnerability information. Therefore, you can understand what a single attack is, but what kind of external equipment is used to attack the entire computer system, and what type of attack tends to occur? It was difficult to analyze. For this reason, it is difficult to analyze what security measures are most appropriate in the future.

  The present invention has been made in order to solve the above-described problems, and enables security inspection and monitoring of an inspection target device to be performed periodically, as well as formulation of a security policy relating to a computer system and each inspection target device. The purpose is to provide a security management system that can automatically and regularly implement security measures related to various types of attacks and always take appropriate measures against various types of attacks . Furthermore, the present invention can easily analyze what kind of external equipment is used to attack the computer system as a stepping stone, and what kind of tendency the type of attack has. The purpose is to provide a security management system that can be used.

  In order to achieve the above object, the security management system of the present invention is a vulnerability that inspects a security vulnerability of the inspection target device by performing a pseudo attack on the inspection target device and receiving a response from the inspection target device. Affects an inspection device, a vulnerability information database that stores vulnerability information for security obtained by the vulnerability inspection device, an information asset information database that stores information asset information for the inspection target device, and the information asset Security incident information database for storing security incident information that causes loss, and vulnerability information quoted from the vulnerability information database, information asset information quoted from the information asset information database, and security incident Information database A risk analysis device that performs risk analysis of the inspection target device based on the security incident information cited in the above, and a risk analysis information database that stores risk analysis information obtained by the risk analysis device. Includes a security measure formulation device that formulates security measures based on risk analysis information quoted from the database. This security measure formulation device formulates and verifies security measures from the risk analysis information and generates a security measure definition file. It has a security measure verification unit and a policy formulation unit that receives the security measure definition file and formulates an information security policy.

  The security management system according to the present invention can periodically perform security inspection and monitoring of the inspection target device by the vulnerability inspection device and the security monitoring device, and formulate a security policy for the computer system and perform each inspection by the security countermeasure development device. Security measures related to the target device can be formulated automatically and regularly. Therefore, it is possible to always take appropriate countermeasures against various types of attacks that change from time to time without being standardized against unauthorized access. As a result, it is possible to contribute to the reduction of the workload of the system administrator and the improvement of work efficiency.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing the configuration of the security management system according to Embodiment 1 of the present invention.

  In the security management system according to the first embodiment, a security management device main body 100 and an inspection target device 210 such as a personal computer or a workstation are connected to each other via the Internet 310. Here, for the sake of convenience, only a single inspection target device 210 is shown, but in reality, a large number of inspection target devices are connected to the Internet 310.

  The security management apparatus main body 100 includes a vulnerability inspection apparatus 110, a risk analysis apparatus 120, a security countermeasure development apparatus 130, a vulnerability information database 150, an information asset information database 160, a risk analysis information database 170, and a security incident information database 180. ing.

  The vulnerability inspection device 110 performs a pseudo attack (for example, a buffer overflow attack, a DoS attack, a brute force attack, etc.) on the inspection target device 210 and receives a response from the device 210, thereby causing a security vulnerability of the inspection target device 210. Is to inspect. In addition, the inspection target device 210 creates a statistical graph indicating statistical information by security vulnerability risk level (high / medium / low) for each inspection target device 210 based on the security vulnerability inspection result 152. Output to the display.

  The vulnerability information database 150 stores vulnerability information indicating security vulnerability inspection results of the inspection target device 210 obtained by the vulnerability inspection device 110. The information asset information database 160 stores information asset information for the inspection target device 210 (for example, information defining security-critical information such as information belonging to a trade secret or information related to personal privacy). In addition, the security incident information database 180 stores security incident information (for example, information for specifying the above-described various types of attacks) that is a factor that affects information assets and causes loss.

  The risk analysis device 120 is based on vulnerability information 152 quoted from the vulnerability information database 150, information asset information 161 quoted from the information asset information database 160, and security incident information 181 quoted from the security incident information database 180. The risk analysis of the inspection target device 210 is performed. That is, the risk analysis device 120 clarifies an event (security incident information) and an inherent weakness (vulnerability information) that are difficult to occur for the information asset information in the inspection target device, and determines the value of the information asset information and the security Incident information and vulnerability information are comprehensively analyzed to determine the severity of risk. Further, the risk analysis apparatus 120 outputs the risk analysis result to a display or the like. The risk analysis information database 170 stores risk analysis information 171 obtained by the risk analysis device 120.

  The security measure formulation device 130 formulates security measures based on the risk analysis information 171 cited from the risk analysis information database 170. The data measure 131, the security measure verification unit 132, the policy formulation unit 133, And a document generation unit 134.

  The data receiving unit 131 receives the risk analysis information 171 from the risk analysis information database 170. The security countermeasure verification unit 132 formulates and verifies an optimal security countermeasure for each inspection target device 210 based on the risk analysis information 171 and generates a security countermeasure definition file. In this case, the security countermeasure definition file is illegal based on information such as an address having a weak point of the inspection target device 210, a vulnerable access point, and characteristic information (= signature) that is found during an attack or intrusion from the device. It defines the security implementation method specific to each inspection target device 210 when there is access, the specific response when security is violated, and the like.

  The policy formulation unit 133 receives the security measure definition file 137 generated by the security measure verification unit 132 and formulates a security policy that is necessary for security measures in common with all computer systems. The document generation unit 134 generates and outputs the security basic design formulated by the security countermeasure verification unit 132 and the security policy formulated by the policy formulation unit 133 as documents 135 and 136.

  FIG. 2 is a flowchart for explaining the operation of the security management system according to the first embodiment. In addition, the code | symbol S in FIG. 2 means each process step.

  When the security management apparatus main body 100 starts processing (step 61), first, the vulnerability inspection apparatus 110 starts a pseudo attack on the inspection target apparatus 210 (step 62). The vulnerability inspection apparatus 110 receives a response of the security vulnerability inspection result from the inspection target apparatus 210 to this attack (step 63).

  The vulnerability inspection apparatus 110 stores the inspection result as vulnerability information 152 in the vulnerability inspection database 150 (step 64). Further, the vulnerability inspection apparatus 110 creates a statistical graph based on the vulnerability information stored in the vulnerability inspection database 150 (step 65). That is, based on the security vulnerability inspection result 152, a statistical graph indicating the security vulnerability risk level (for example, three stages of high, medium, and low) for each inspection target device 210 is created and displayed. Output to. As a result, data statistically analyzed from the vulnerability information 152 stored in the vulnerability information database 150 can be presented, and more appropriate security measures can be taken for the inspection target device 210.

  Further, the risk analysis apparatus 120 quotes vulnerability information of each inspection target apparatus 210 from the vulnerability information database 150, information asset information 161 from the information asset information database 160, and security incident information 181 from the security incident information database 180. Then, risk analysis is performed (step 66). The risk analysis apparatus 120 outputs the risk analysis result 171 to a display or the like (step 67), and stores the risk analysis result 171 in the risk analysis information database 170 (step 68).

  On the other hand, the data receiving unit 131 of the security measure formulation device 130 receives the risk analysis information 171 from the risk analysis information database 170, and then the security measure verification unit 132 formulates a security measure based on the risk analysis information 171. The security countermeasure definition file is generated by verification (step 69).

  Subsequently, the policy formulation unit 133 receives the security measure definition file 137 generated by the security measure verification unit 132 and formulates a security policy (step 70). The document generation unit 134 generates and outputs the security basic design formulated by the security countermeasure verification unit 132 and the security policy formulated by the policy formulation unit 133 as documents 135 and 136 (step 71). Thereafter, the security management apparatus main body 100 ends the process (step 72).

  As described above, in the security management system of the first embodiment, the vulnerability inspection apparatus 110 can periodically perform a security inspection on the inspection target apparatus 210, and the risk analysis apparatus 120 can detect the risk of each inspection target apparatus 210. In addition, the security countermeasure formulation device 130 can automatically and regularly formulate a security policy regarding the computer system and security measures regarding each inspection target device 210. For this reason, it is possible to always take appropriate security measures against various types of attacks that change from time to time without being standardized against unauthorized access. As a result, the management and operation of the system administrator are facilitated, and the work load can be reduced and the work efficiency can be improved.

Embodiment 2. FIG.
FIG. 3 is a block diagram showing the configuration of the security management system according to the second embodiment of the present invention, and the same reference numerals are given to the components corresponding to those in the first embodiment shown in FIG.

  The feature of the second embodiment is that, in addition to the configuration shown in the first embodiment, a security monitoring device 140 is provided in the security management device 100, while a monitoring agent 211 is provided in each inspection target device 210. Is provided.

  The security monitoring device 140 performs data communication with the monitoring agent 211 to monitor the type and number of attacks on the inspection target device 210, the presence / absence of intrusion, and the like, and also detects detection information sent from the monitoring agent 211 as vulnerability information. As a monitoring manager stored in the vulnerability information database 150.

  The security monitoring device 140 performs data communication between the management unit 143 that controls the security vulnerability of the inspection target device 210 and the monitoring agent 211 provided in the inspection target device 210. And a data communication unit 142.

  On the other hand, the monitoring agent 211 detects the type and number of attacks from other devices on the inspection target device 210, the presence / absence of intrusion, etc., and transmits the detection information to the security monitoring device 140, and includes a data communication unit 212, a signature database 214, and an intrusion detection unit 213.

  The data communication unit 212 performs data communication with the security monitoring device 140, and the signature database 214 is viewed in the event of an attack or intrusion from another device (not shown) via the Internet 310. Information such as a communication protocol type such as PCT, an access point of a communication port, and an unauthorized access pattern are registered. Further, the intrusion detection unit 213 compares the input information from the Internet 310 and the feature information (signature) registered in the signature database 214, the type and number of attacks, the presence / absence of intrusion, and the IP address of the device that made the attack Are detected.

  Further, in the second embodiment, the vulnerability inspection apparatus 110 uses the security vulnerability inspection result 152 obtained for the inspection target apparatus 210 and the detection information from the monitoring agent 211 collected by the security monitoring apparatus 140. Based on the vulnerability risk level (high / medium / low) statistical information, detection item statistical information, source port statistical information, daily statistical information, and time zone statistical information It is like that.

  Since other configurations are the same as those of the first embodiment shown in FIG. 1, detailed description thereof is omitted here.

  FIG. 4 is a flowchart for explaining the operation of the security management system according to the second embodiment. In addition, the code | symbol S in FIG. 4 means each process step.

  When the security management device main body 100 starts processing (step 71), first, the security monitoring device 140 requests the monitoring agent 211 to collect detection information (step 72).

  The monitoring agent 221 transmits the collected detection information 151 to the security monitoring device 140 in response to a request from the security monitoring device 140 (step 73). The detection information 151 in this case includes information such as the type of attack, the number of attacks, the presence / absence of intrusion, and the IP address of the device that made the attack.

  The security monitoring device 140 collects the detection information 151 sent from the monitoring agent 221 and stores it in the vulnerability information database 150 as vulnerability information (step 74).

  Thereafter, basically the same processing as the operation shown in the first embodiment (step 62 to step 71 in FIG. 2) is performed (step 75). However, the second embodiment differs from the first embodiment in that a vulnerability risk level (based on a security vulnerability inspection result 152 obtained by the vulnerability inspection apparatus 110 for the inspection target apparatus 210) ( In addition to creating a statistical graph of statistical information by high, medium, and low), and further, based on detection information from the monitoring agent 211 collected by the security monitoring device 140, statistical information by detection item (for example, by attack type) Attack frequency), statistical information by source port (for example, the number of accesses by IP address of the device making the attack), daily statistical information and statistical information by time zone (for example, daily or hourly attack Frequency) and other statistical graphs.

  Further, the risk analysis device 120 performs a risk analysis that incorporates the detection information 151 from the monitoring agent 211 collected by the security monitoring device 140. Similarly, the security measure formulation device 130 formulates a security measure and a security policy that incorporate the detection information from the monitoring agent 211 collected by the security monitoring device 140.

  Thereafter, the security management device 100 ends the process (step 76). Since other processing operations are the same as those in the first embodiment, detailed description thereof is omitted here.

  As described above, in the second embodiment, not only can the security vulnerability of the inspection target device 210 be inspected by the vulnerability inspection device 110, but also the security monitoring device 140 can always monitor the inspection target device 210. In addition, a statistical graph may be created based on the detection information 151 collected by the security monitoring device 140, and a risk analysis, security measures, and security policy formulation incorporating the inspection information 151 may be performed automatically and periodically. it can. Therefore, it is possible to always take appropriate measures against various types of attacks that change from time to time without standardizing against unauthorized access, and a more secure environment can be maintained. .

Embodiment 3 FIG.
FIG. 5 is a block diagram showing the configuration of the security management system according to the second embodiment of the present invention, and the same reference numerals are given to the components corresponding to those in the second embodiment shown in FIG.

  A feature of the third embodiment is that a security agent definition file 137 formulated by the security countermeasure verification unit 132 of the security countermeasure formulation device 130 is provided to a predetermined inspection target device via the security monitoring device 140. The security measures are automatically set by transmitting to 211 and registering in the signature database 214.

  Since other configurations are the same as those of the second embodiment shown in FIG. 3, detailed description thereof is omitted here.

  FIG. 6 is a flowchart for explaining the operation of the security management system according to the third embodiment. In addition, the code | symbol S in FIG. 6 means each process step.

  When the security management apparatus main body 100 starts processing (step 81), first, processing similar to that shown in steps 72 to 75 in FIG. 4 is performed (step 82). A description of the processing in this case is omitted. Thereafter, the security countermeasure definition file 137 formulated by the security countermeasure formulation apparatus 130 is transmitted to the monitoring agent 211 provided in the predetermined inspection target apparatus 210 via the security monitoring apparatus 140 and the Internet 310 (steps 83 and 84). ). The monitoring agent 211 registers the sent security countermeasure definition file 137 in the signature database 214.

  As a result, information about the security measures is registered in the signature database 214 together with the characteristic information found in the case of an attack or intrusion from another device. Therefore, the monitoring agent 211 performs automatic setting of security measures based on the information of security measures registered in the signature database 214 (step 85). Therefore, information on security measures can be patched, feature information seen during attacks and intrusions from other devices, security implementation methods unique to each inspection target device 210, and specific details when security is violated The quality of information such as correspondence is improved automatically and regularly. Thereafter, the security management apparatus main body 100 ends the process (step 86).

  As described above, in the third embodiment, the security countermeasure definition file 137 formulated by the security countermeasure formulation apparatus 130 is transmitted to the monitoring agent 211 provided in the predetermined inspection target apparatus 210. Security measures can be implemented automatically and regularly. As a result, the security of the inspection target device 210 can be constantly increased, and the risk of data destruction, falsification, leakage, etc. due to unauthorized access from the outside is further reduced.

  In the third embodiment, the security measure definition file 137 is encrypted and transmitted from the security monitoring device 140 to the monitoring agent 211 of the inspection target device 210 in order to prevent a malicious third party from eavesdropping. It is desirable to make it. That is, when the monitoring agent 211 receives the security countermeasure definition file 137 encrypted and transmitted from the security management apparatus 140, the monitoring agent 211 decrypts the security countermeasure definition file 137 in the data communication unit 212, and the decrypted security countermeasure definition file 137 is signature database 214. Security measures are automatically set by registering in.

It is a block diagram which shows the structure of the security management system in Embodiment 1 of this invention. It is a flowchart which shows operation | movement of the security management system in Embodiment 1 of this invention. It is a block diagram which shows the structure of the security management system in Embodiment 2 of this invention. It is a flowchart which shows operation | movement of the security management system in Embodiment 2 of this invention. It is a block diagram which shows the structure of the security management system in Embodiment 3 of this invention. It is a flowchart which shows operation | movement of the security management system in Embodiment 3 of this invention.

Explanation of symbols

100 security management device main body, 110 vulnerability inspection device,
120 risk analysis device, 130 security measure development device,
132 Security Countermeasure Verification Department, 133 Policy Development Department,
140 security monitoring device, 150 vulnerability information database,
160 Information asset information database, 170 Risk analysis information database,
180 security incident information database, 210 inspection target device,
211 Monitoring agent.

Claims (5)

A vulnerability inspection device that inspects a security vulnerability of the inspection target device by performing a pseudo attack on the inspection target device and receiving a response from the inspection target device, and security vulnerability information obtained by the vulnerability inspection device Vulnerability information database that stores information, information asset information database that stores information asset information for the inspection target device, and security incident information that stores security incident information that affects the information asset and causes loss The inspection target based on the database, the vulnerability information quoted from the vulnerability information database, the information asset information quoted from the information asset information database, and the security incident information quoted from the security incident information database A risk analysis device that performs risk analysis on the device and a risk analysis information database that stores risk analysis information obtained by the risk analysis device, and security measures based on the risk analysis information cited from the risk analysis information database The security countermeasure formulation device includes a security countermeasure verification unit that formulates and verifies security countermeasures from the risk analysis information and generates a security countermeasure definition file, and receives the security countermeasure definition file. A security management system characterized by having an information security policy. The inspection target device is provided with a monitoring agent that detects the type and number of attacks from other devices on the device, the presence / absence of intrusion, and the like, and transmits the detection information. A security monitoring device that performs communication to monitor whether there is an attack or intrusion on the inspection target device, and stores the detection information sent from the monitoring agent in the vulnerability information database as vulnerability information; The security management system according to claim 1, wherein: The vulnerability inspection device is a vulnerability risk level statistic based on vulnerability information obtained by inspecting the inspection target device and detection information from the monitoring agent collected by the security monitoring device. The security management system according to claim 2, wherein each statistical graph such as information and statistical information for each detection item is created. The security countermeasure definition file formulated by the security countermeasure verification unit of the security countermeasure development apparatus is transmitted to the monitoring agent provided in a predetermined inspection target apparatus via the security monitoring apparatus, and security for the inspection target apparatus is transmitted. The security management system according to claim 2 or 3, wherein a countermeasure is automatically set. 5. The security management system according to claim 4, wherein encrypted communication is performed in data communication between the security monitoring device and the inspection target device.

Images