JP2003242112A - Security control system and method, security control program, and recording medium with the program recorded thereon - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security control system capable of automatically coping with a security problem when the security problem existing in a network server is detected. <P>SOLUTION: This system is characterized in that it is provided with a diagnosis module 6 to obtain diagnosis items to detect security problems from a security information DB 7, obtain setting information of the network server 1 held in a device setting information DB 3, examine if security problems of the network server 1 exist or not based on setting information regarding the diagnosis items, obtain coping information from the security information DB 7 when security problems exist, and derive the most proper security measures by comparing the coping information with the setting information. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security management system and method characterized by detecting a security problem and automatically dealing with the problem, a security management program, and a recording medium recording the program.

[0002]

2. Description of the Related Art In recent years, attacks on servers on the Internet have become widespread. Most attacks against servers on the Internet are based on security weaknesses and misconfigurations existing in the servers. To protect your server from these attacks, apply a patch to the server to eliminate the security weaknesses that exist in the server, to thoroughly check the settings, to configure the firewall on the network, IDS
(Intrusion Detection System
For example, a security device such as em) may be arranged. In addition, it is used to find out what kind of security weakness the server has.
It is a security diagnostic tool called remote scanner or local scanner. The remote scanner and the local scanner are generally computer programs, and the remote scanner remotely gives a host computer a special diagnostic IP (Internet Protocol).
l) Send a packet and analyze the response of the host computer to the IP packet to determine whether the server has a security weakness. On the other hand, the local scanner is installed on the server, verifies the contents of various setting files held by the server, and reports as a diagnostic result that settings with security problems are made. It is a thing.

Generally, the server administrator or the administrator of the network to which the server is connected applies a patch or a software version so that the security weakness is filled on the server based on the diagnosis result of the remote scanner or the local scanner. Etc., and change the settings so that the host computer is protected,
Alternatively, an attack on the host computer can be filtered by properly setting a firewall and IDS. The advantage of using a remote scanner or local scanner is that you can handle security efficiently and accurately by accurately grasping the security problems that currently exist, as compared to the case where these programs are not used. .

FIG. 7 is a structural explanatory view showing a conventional security management device (remote scanner). As shown in FIG. 7, the conventional security management device featuring remote diagnosis includes a remote scanner 61, a security information DB (database) 62, and a network server (diagnosis target server) 63. FIG. 8 is an explanatory diagram showing the security information DB.

The security management device having such a configuration operates as follows.

That is, the security information DB 62 as shown in FIG.
Refer to to obtain security diagnostic items. The security diagnosis of the items acquired in step 3 is performed on the network server 63. As a result of the diagnosis, the remote scanner 61 outputs a problematic point as a diagnosis result.
A security expert creates a countermeasure from the result of the security diagnosis in (1), and implements the countermeasure for the network server 63.

FIG. 9 is a structural explanatory view showing a conventional security management device (local scanner). As shown in FIG. 9, the conventional security management device featuring local diagnosis includes a security information DB 62, a network server (diagnosis target server) 63, a local scanner 64, and device setting information 65. FIG. 10 is an explanatory diagram showing device setting information.

The security management device having such a configuration operates as follows.

That is, the local scanner 64 acquires the diagnostic item from the security information DB 62, and then the local scanner 64 acquires the device setting information from the device setting information 65. After creating a diagnostic item based on the information acquired in and, the security diagnosis is performed on the network server 63. The local scanner 64 outputs the result of the security diagnosis as the diagnosis result.
A security expert creates a countermeasure from the result of the security diagnosis in (1) and takes countermeasures against the network server 63.

[0010]

The first problem in the prior art is that a security expert intervenes in the process of formulating a coping method from the result of security diagnosis, and is not automated. The reason for this is that security and IP (Inter
This is because only a person who has a deep knowledge of an et Protocol) network or the like can perform it, but there is currently a chronic shortage of engineers who can perform the above work.

The second problem is that the security expert must take all measures to correct the security weakness. The reason is currently IP
Devices used in the network and server OS (O
There is a wide variety of operating systems, and it is very difficult to prepare a security expert who is familiar with all of these devices and server OSs.

The third problem is that the conventional remote scanner may erroneously diagnose the network server because the network server is remotely diagnosed. The reason is that, in principle, it is extremely difficult to judge what kind of security weakness the network server has only from the information obtained from outside the network server.

A fourth problem is that security diagnosis is not performed at an appropriate timing. The reason is that conventional remote scanners and local scanners do not have a mechanism for automatically executing the diagnostic process when new security weaknesses are reported by various information sources.

The present invention has been made in view of the above circumstances, and when a security problem existing in a network server is detected, a security management system and method capable of automatically dealing with the problem, a security management. It is an object to provide a program and a recording medium recording the program.

[0015]

In order to achieve the above object, the present invention is a security management system for detecting and dealing with a security problem existing in a network server, and device setting information holding setting information of the network server. DB, a diagnostic item for detecting a security problem and a security information DB for holding countermeasure information for the security problem, and a diagnostic item from the security information DB for the network server held in the device setting information DB. The setting information is acquired, whether or not there is a security problem of the network server with respect to the diagnostic item is verified based on the setting information.
And a diagnostic module for deriving the most appropriate security countermeasures by comparing the countermeasure information with the setting information.

Further, the present invention is a security management system for detecting and dealing with a security problem existing in a network server, a network server to be protected, a network constituent device for protecting the network server on the network, and the network. A host agent which is arranged on the server and the network constituent device and which transmits and receives information and handles security problems;
A device setting information DB that acquires and holds setting information of the network server and the network constituent device from the host agent, a security information DB that holds diagnostic items for detecting security problems and countermeasure information for the security problems, The diagnostic information is acquired from the security information DB, the setting information of the network server and the network constituent device held in the device setting information DB is acquired, and the security problem of the network server is acquired from the setting information of the diagnostic item. A diagnostic module that verifies whether or not the security problem exists, acquires countermeasure information from the security information DB when the security problem exists, and derives the most appropriate security countermeasure by comparing the countermeasure information with the setting information. Characterized by comprising A.

According to the present invention, in the security management system, the security information DB holds handling information as an executable program, and the diagnostic module uses the handling information and the setting information to connect the network server and the network constituent device. A security countermeasure is created as a program executable by the host agent, the security countermeasure is transmitted to the host agent, and the host agent executes the security countermeasure so that the network server responds to the security problem. Further, it is characterized in that the network constituent device automatically takes measures.

The present invention further comprises a remote scanner in the security management system, which diagnoses the network server through a network to identify existing security problems, and the remote scanner diagnoses the network server and exists. And the diagnostic module acquires security information corresponding to the security problem from the security information DB, and acquires the setting information of the network server and the network constituent device held in the device setting information DB, With respect to the security information, by verifying whether the security problem exists in the network server according to the setting information, verifying whether the security problem detected by the remote scanner really exists in the network server, Evidenced that was derived most appropriate security countermeasure for the security issues, also characterized in that the automatic addressing.

Further, according to the present invention, in the security management system, when it is found that a new security problem exists, by registering a diagnostic item and a countermeasure information corresponding to the security problem in the security information DB, the network server It is characterized in that whether or not the security problem exists is verified, and if there is, the most appropriate security countermeasure for the security problem is derived, and the security countermeasure is automatically taken.

Further, the present invention provides a security management method for detecting and dealing with a security problem existing in a network server, and obtaining a diagnostic item for detecting a security problem from a security information DB,
There is a step of obtaining the setting information of the network server held in the device setting information DB, a step of verifying whether there is a security problem of the network server for the diagnostic item by the setting information, and the security problem exists. In this case, it comprises a step of acquiring countermeasure information from the security information DB and a step of deriving the most appropriate security countermeasure by comparing the countermeasure information with the setting information.

[0021]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a structural explanatory view showing a security management system according to an embodiment of the present invention. That is,
A security management system for detecting and dealing with a security problem existing in the network server 1 includes a network server 1 to be protected and the network server 1
Network device 5 that protects the network
A host agent (agent program) 2 arranged on the network server 1 and the network constituent device 5 for transmitting and receiving information and dealing with security problems, and from the host agent 2 to the network server 1 and the network constituent device 5. Device setting information DB (database) 3 that acquires and holds the setting information of
And security information D that holds diagnostic items for detecting a security problem and countermeasure information for the security problem.
B7, the diagnostic items are acquired from the security information DB7, the setting information of the network server 1 and the network constituent device 5 held in the device setting information DB3 is acquired, and the diagnostic items are acquired by the setting information. The most appropriate security countermeasure is performed by verifying whether the security problem of the network server 1 exists, acquiring the countermeasure information from the security information DB 7 when the security problem exists, and comparing the countermeasure information with the setting information. And a diagnostic module 6 for deriving a measure.

Further, in the security management system, the security information DB 7 holds handling information as an executable program, and the diagnostic module 6 uses the handling information and the setting information in the network server 1 and the network constituent device 5. The host agent 2 creates a security countermeasure as an executable program, transmits the security countermeasure to the host agent 2, and the host agent 2 executes the security countermeasure to solve the security problem. The network server 1 and the network constituent device 5 are characterized by automatic measures.

The security management system further comprises a remote scanner 4 which diagnoses the network server 1 through a network and identifies existing security problems, and the remote scanner 4 diagnoses the network server 1 and exists security. The problem is detected, the diagnosis module 6 acquires the security information corresponding to the security problem from the security information DB 7, and the setting information of the network server 1 and the network constituent device 5 stored in the device setting information DB 3 By acquiring the security information and verifying whether the security problem exists in the network server 1 based on the setting information, the security problem detected by the remote scanner 4 is truly present in the network server 1. Prove it and to derive the most appropriate security countermeasure for the security issues that have been verified, also characterized in that it automatically deal.

Further, in the security management system, as shown in FIG. 2, when it is found that a new security problem exists, the administrator 8 stores in the security information DB 7 diagnostic items and countermeasure information corresponding to the security problem. By registering, whether or not the security problem exists in the network server 1 is verified, and if it exists, the most appropriate security countermeasure for the security problem is derived, and the countermeasure is automatically taken.

The operation of FIG. 1 will be described. , The host agent 2 arranged in the network server 1 and the network constituent device 5 transmits the information of the network server 1 and the network constituent device 5 to the device setting information DB 3, and the device setting information of the device setting information as shown in FIG. DB3
Automatically created. Next, the remote scanner 4 remotely carries out a security diagnosis of the network server 1 and passes the security diagnosis result to the diagnosis module 6.
Next, the diagnosis module 6 acquires the security diagnosis items from the security information DB 7 and the device setting information from the device setting information DB 3 as shown in FIG. With respect to the security diagnosis item, whether or not there is a problem on the network server 1 is diagnosed, and at the same time, the validity of the remote security diagnosis result acquired at the time is used to make a determination based on the device setting information acquired. According to the above process, after the list of security weaknesses possessed by the network server 1 is created, the solution for solving the found security weaknesses is acquired from the security information DB 7 as countermeasure information, and the network server 1 transmits the countermeasures to be taken on the network 1 and the countermeasures to be taken on the network constituent device 5. The countermeasures transmitted to the host agent 2 in the form of the command are in a form that the host agent 2 can directly execute. The host agent 2, which has received the countermeasure for resolving the security weakness in an executable form from the diagnostic module 6, executes the countermeasure on the network server 1 and the network constituent device 5, respectively, to eliminate the security weakness. Do it automatically.

FIG. 2 is an operation diagram when security information is added according to the embodiment of the present invention. As shown in FIG. 2, when the administrator 8 adds new security information to the security information DB 7, the diagnosis module 6 automatically starts the security diagnosis process. The process acquires the security information newly added to the security information DB 7 and the device setting information of the network server 1 from the device setting information DB 3, and whether the newly added security information affects the network server 1 Security information D
The countermeasures are acquired from B7, and the countermeasures in the executable form against the new security weakness are transmitted to the host agent 2 on the network server 1 and the host agent 2 on the network constituent device 5, respectively. The host agent 2 which has received the feasible countermeasure automatically executes the countermeasure on the network server 1 and the network constituent device 5 to thereby execute the countermeasure.
Automatically respond to new security weaknesses that affect.

Next, the operation of the embodiment of the present invention will be described with reference to the flow charts of FIGS.

The flowchart of FIG. 4 will be described.

Step 1: The host agent (agent program) 2 transmits the setting information of the network server 1 and the network constituent device 5. Step 2: The device setting information DB 3 is created from the information of the host agent 2. Step 3: In the device setting information DB 3. It is determined from the information and the information in the security information DB 7 whether the network server 1 and the network constituent device 5 have security weaknesses. Step 4: If the determination result of Step 3 is a security weakness, go to Step 5 If there is no weakness in step 6, step 5: Using the name of the weakness in security found in step 3 as a key, the security information DB 7 is searched to obtain a countermeasure for the weakness in security found 6 : Processing program end step 7: The countermeasure for the security weakness created in Step 5 is sent to the host agent 2, and the host agent 2 implements the countermeasure on the network server 1 and the network constituent device 5 to eliminate the security weakness. Processing completion The flowchart of FIG. 5 will be described.

Step 8: The host agent (agent program) 2 transmits the setting information of the network server 1 and the network constituent device 5. Step 9: The device setting information DB 3 is created from the information of the host agent 2. Step 10: The remote scanner 4 is the network. Diagnosis of server 1 Step 11: Remote scanner 4 passes diagnosis result to diagnosis module 6 Step 12: Diagnosis module 6 sets device setting information DB3
Setting information of the network server 1 and the network constituent device 5 and information about the diagnosis result from the security information DB 7 are obtained to judge whether the diagnosis result is valid Step 13: If the diagnosis result of Step 12 is valid, go to Step 14; Step 15 Step 14: Security information DB based on the diagnosis result
Step 15: Processing program end Step 16: Sending a countermeasure to the security weakness created in Step 15 to the host agent 2,
The host agent 2 implements countermeasures on the network server 1 and the network constituent device 5 to eliminate security weaknesses and complete processing. The flowchart of FIG. 6 will be described. Step 17: Administrator 8 adds new security weakness information to security information DB 7 Step 18: Diagnostic module 6 security information D
Detecting a change in B7 and acquiring information on a new security weakness Step 19: Acquiring current settings of the network server 1 and the network constituent device 5 from the device setting information DB 3 Step 20: New security weakness is a network server 1 and whether the network constituent device 5 exists or not Step 21: If the security weakness exists as a result of the judgment of Step 20, go to Step 22; if not, go to Step 23 Step 22: Security based on the diagnosis result Information DB
Step 23: end the processing program Step 24: send a countermeasure to the security weakness created in Step 22 to the host agent 2,
The host agent 2 implements countermeasures on the network server 1 and the network constituent device 5 to eliminate weaknesses in security and complete processing. The security management method in the above embodiment is as follows.
Specifically, it is executed by a computer such as a personal computer based on a predetermined security management program in advance. The security management program can be recorded in a predetermined computer-readable recording medium.

That is, the security management program for detecting and dealing with the security problem existing in the network server is the procedure for acquiring the diagnostic item for detecting the security problem from the security information DB, and the network stored in the device setting information DB. A procedure for obtaining server setting information, a procedure for verifying whether there is a security problem of the network server based on the setting information for the diagnostic item, and a countermeasure information when the security problem exists, is acquired from the security information DB. The computer is caused to execute a procedure and a procedure for deriving the most appropriate security countermeasure by comparing the countermeasure information with the setting information.

As described above, using the result of diagnosis as a key,
By searching the security information DB, it is possible to automatically generate an actionable measure that eliminates the security weakness.

Device setting information DB and security information DB
By identifying the security weaknesses existing in the network server / network constituent device from the information of the above, and searching the security information DB using the existing security weaknesses as a key, it is possible to execute the security weaknesses. Countermeasures can be automatically generated.

The validity of the remote scan result is judged from the information registered in the device setting information DB and the security information DB, and a more reliable remote scan result can be obtained.

The countermeasure for the security hole is sent to the automatically created host agent in a form that can be immediately executed.

By sending a feasible countermeasure to the security weakness to the host agent, the host agent automatically executes the countermeasure against the transmitted security hole on the network server,
Try to eliminate security weaknesses.

When information is registered in the security information DB, security diagnosis is performed at the same time, and if a new security weakness is found in the network server / network constituent device, it can be automatically dealt with.

[0039]

As described above, according to the present invention, when a security problem existing in a network server is detected, a security management system and method and a security management program capable of automatically dealing with the problem. It is also possible to provide a recording medium having the program recorded therein.

[Brief description of drawings]

FIG. 1 is a configuration explanatory diagram showing a security management system according to an exemplary embodiment of the present invention.

FIG. 2 is a configuration explanatory diagram showing an operation at the time of adding security information according to the exemplary embodiment of the present invention.

FIG. 3 is security information D according to the embodiment of the present invention.
It is explanatory drawing which shows B.

FIG. 4 is a flowchart showing an operation of the security management system according to the exemplary embodiment of the present invention.

FIG. 5 is a flowchart showing an operation of the security management system according to the exemplary embodiment of the present invention.

FIG. 6 is a flowchart showing an operation of the security management system according to the exemplary embodiment of the present invention.

FIG. 7 is an explanatory diagram showing a configuration of a conventional security management device (remote scanner).

FIG. 8 is an explanatory diagram showing a conventional security information DB.

FIG. 9 is a configuration explanatory view showing a conventional security management device (local scanner).

FIG. 10 is an explanatory diagram showing a device setting information DB.

[Explanation of symbols]

1 network server 2 Host agent 3 Device setting information DB 4 remote scanner 5 Network components 6 Diagnostic module 7 Security information DB

Claims (8)

[Claims] 1. A security management system for detecting and dealing with a security problem existing in a network server, a device setting information DB for holding setting information of the network server, a diagnostic item for detecting the security problem, and a security problem Security information DB holding countermeasure information
And the diagnostic item from the security information DB, the setting information of the network server held in the device setting information DB, and the security item of the network server exists according to the setting information of the diagnostic item. A diagnostic module that verifies whether or not the security problem exists, acquires countermeasure information from the security information DB, and compares the countermeasure information with the setting information to derive the most appropriate security countermeasure. A security management system characterized by: 2. A security management system for detecting and dealing with a security problem existing in a network server, a network server to be protected, a network constituent device for protecting the network server on a network, the network server and the network server. A host agent that is arranged on the network constituent device and sends and receives information and handles security problems; a device setting information DB that acquires and holds the setting information of the network server and the network constituent device from the host agent; Security information DB that holds diagnostic items for detecting security and countermeasure information for the security problem
And a diagnostic item from the security information DB, setting information of the network server and the network constituent device held in the device setting information DB, and a diagnostic item of the network server according to the setting information. The most appropriate security countermeasure is derived by verifying whether the security problem exists, acquiring the countermeasure information from the security information DB when the security problem exists, and comparing the countermeasure information with the setting information. A security management system comprising a diagnostic module. 3. The security management system according to claim 2, wherein the security information DB holds handling information as an executable program, and the diagnostic module uses the handling information and the setting information to connect the network server and the network. The security countermeasure is created as a program executable by the host agent in the constituent device, the security countermeasure is transmitted to the host agent, and the host agent executes the security countermeasure, thereby solving the security problem. A security management system characterized by automatically taking measures in a network server and the network constituent device. 4. The security management system according to claim 2, further comprising a remote scanner that diagnoses the network server through a network to identify existing security problems, and the remote scanner diagnoses the network server. An existing security problem is detected, and the diagnostic module detects the security information DB.
The security information corresponding to the security problem is acquired from the device, the setting information of the network server and the network constituent device held in the device setting information DB is acquired, and the security server stores the security information in the network server according to the setting information. By verifying whether the security problem exists, verify whether the security problem detected by the remote scanner really exists in the network server, and derive the most appropriate security countermeasure for the verified security problem. A security management system characterized by automatic and automatic measures. 5. The security management system according to claim 2 or 3, wherein when a new security problem is found to exist, a diagnostic item and countermeasure information corresponding to the security problem are registered in the security information DB. A security management system characterized by verifying whether or not the security problem exists in the network server, deriving the most appropriate security countermeasure for the security problem and automatically dealing with the security countermeasure when the security problem exists. 6. A security management method for detecting and coping with a security problem existing in a network server, the step of acquiring a diagnostic item for detecting a security problem from the security information DB, and holding the device in the device setting information DB. A step of obtaining setting information of the network server, a step of verifying whether there is a security problem of the network server based on the setting information for the diagnostic item, and a countermeasure information when the security problem exists, the countermeasure information is stored in the security information DB. And a step of deriving the most appropriate security countermeasure by comparing the countermeasure information with the setting information. 7. A security management program for detecting and dealing with a security problem existing in a network server, a procedure for acquiring a diagnostic item for detecting a security problem from a security information DB, and a network held in a device setting information DB. Procedure for obtaining server setting information, procedure for verifying whether there is a security problem of the network server for the diagnostic item based on the setting information, and acquisition of countermeasure information from the security information DB when the security problem exists Procedure, a security management program for causing a computer to execute a procedure for deriving the most appropriate security countermeasure by comparing the countermeasure information with the setting information. 8. A procedure for acquiring a diagnostic item for detecting a security problem from a security information DB in a recording medium storing a security management program for detecting and dealing with a security problem existing in a network server, in a device setting information DB. A procedure for obtaining the setting information of the network server that is held, a procedure for verifying whether there is a security problem of the network server based on the setting information for the diagnostic item, and a countermeasure information when the security problem exists. A computer-readable recording medium recording a security management program for causing a computer to execute a procedure for obtaining a most appropriate security countermeasure by comparing the countermeasure information with the setting information.