JP2006146297A - Security management method, security management apparatus, and security management program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce time and labor of a system manager for security measures by quickly performing security enhancement against any virus or illegal access which is likely to be caused in an early stage from vulnerability disclosure. <P>SOLUTION: This security management server 104 is configured to manage the application state of software and a patch installed in each client 115, and to perform the TCP/IP port opening/closing control of a router 113 to which the client 115 is connected on the basis of the latest security information acquired through a network 110 for realizing security management. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a security management server, a security management method, and a security management program.

In recent years, information systems using Internet technology and network technology are also increasing. Along with this, the threat of virus infection targeting vulnerability of information systems is increasing.
Vulnerabilities related to information systems are released to the Internet every day, and patches are provided to prevent such vulnerabilities. The frequency of vulnerability disclosure has increased with the recent increase in virus occurrence, and the tendency to shorten the time from the disclosure of a vulnerability to unauthorized access by a cracker that exploits the vulnerability and the occurrence of a virus has increased. ing.
In response to such attacks targeting information system vulnerabilities, system administrators and users sequentially check security information issued by vendors over the Internet, and apply patches to vulnerabilities in published information systems early. Need to do.

Currently, security information is acquired from a plurality of sites via the Internet, a method for providing necessary security information to a user using a client in terms of reliability of information, and encouraging patch application (see Patent Document 1), A method for providing system administrators and business managers with information on vulnerabilities in the entire system by managing environment information of managed information systems and vulnerability correction work logs for monitored information systems (Patent Literature) 2).
JP 2003-216576 A JP 2003-256370 A

However, any of the above-described methods merely provides appropriate patch information to the system administrator or the user using the client, and prompts the user to apply the patch or confirms the patch application status.
Therefore, these methods have a time lag between the release of patch information and the completion of patch application to all clients due to differences in the information system environment and the work of the user of the client to be used. Therefore, there is a problem that there is a risk of intrusion of viruses and unauthorized access.

  It is an object of the present invention to enhance security against viruses and unauthorized access that tend to occur at an early stage after vulnerability disclosure as described above. Another object is to provide a security management device and the like that reduces the burden of system administrators and users who check security information via the Internet every day, reduces the impact on the network, and manages the operation of a secure information system quickly. And

  In order to solve the above-described problem, the security management device (security management server) of the present invention is used to specify a router (network connection device) that becomes an attack path to a vulnerability based on the latest security information acquired via the network. The TCP / IP (Transmission Control Protocol / Internet Protocol) port is blocked. That is, based on the latest security information acquired via the network, the TCP / IP port opening / closing control of the router connected to the client is performed, and the security management device that performs security management is configured with software names and software installed on the clients. A database storing the inventory information including the applied patch name, the security information and the identification information of the router, and a security keyword list indicating a predetermined keyword and a TCP / IP port associated with the application indicated by the keyword A storage unit for storing, an inventory information management unit for acquiring inventory information of each client from each of the clients, and storing it in the database, and the latest security data via the network. The security information is analyzed, the security information is analyzed, and when the security information includes a keyword shown in the security keyword list, the security information is stored in the database. A port open / close determination unit that determines whether or not there is a client that requires security measures based on the security information; and when there is a client that requires the security measures, the security information is referred to by referring to the database. The router connected to the client that needs countermeasures is configured to include a port opening / closing control unit that outputs a control signal for closing the TCP / IP port related to the patch. Other configurations will be described in the embodiments described later.

  According to the present invention, it is possible to take security measures for a client by changing the setting of a network device (router) against a virus or unauthorized access that occurs early after vulnerability disclosure. In addition, it analyzes the contents of the patch information page (security information page) and closes the TCP / IP port that may be a path of entry of a virus or unauthorized access that is determined to be vulnerable. The impact can be minimized.

Furthermore, since the security management server performs security measures based on the contents (security policy) set in the security keyword table by the system administrator, it becomes possible to perform security measures at necessary locations more flexibly. It also reduces the burden on the system administrator.
Furthermore, it is possible to construct a safe information system by eliminating the difference in security strength between clients due to the technical ability of the system administrator.

  Hereinafter, the best mode for carrying out the present invention (hereinafter referred to as an embodiment) will be described in detail with reference to the drawings.

<< First Embodiment >>
First, a first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration of a system including a security management server (security management apparatus) according to the first embodiment of this invention.

The system according to this embodiment includes a Web server 101 that publishes a security information list page 102, a patch information page 103, and the like via the Internet 110, a client 115 that transmits and receives various types of information via the Internet 110, download of patch information, The security management server 104 that analyzes the summary of patch information and controls the open / close state of the TCP / IP port (hereinafter simply referred to as a port) of the router 113, the client 115, and the security management server 104 are connected to the Internet (network) 110. And a database 114 for storing management information of the client 115 and the router 113 and management information such as the security information.
The database 114 is realized by a storage device such as a hard disk. The client 115 and the security management server 104 are realized by a computer including a CPU, a storage unit, and input / output means. The data in the database 114 may be stored in the storage unit of the security management server 104.
Further, the numbers of Web servers 101, clients 115, and routers 113 are not limited to the numbers shown in FIG.

  The security management server 104 downloads patch information (security information) via the Internet 110, analyzes the patch information, acquires the patch information, software installed in each client 115, and applied software. A port open / close determining unit 109 that determines whether or not there is a client 115 that requires security measures (referring to which client 115 should be subjected to security measures), and the security measures are required. A port opening / closing control unit 111 that performs port opening / closing control of the router 113 connected to the client 115, an inventory information management unit 112 that manages information of software installed in the client 115 and applied patches, Configured to include a section 100.

  The page acquisition analysis unit 105, the port opening / closing determination unit 109, the port opening / closing control unit 111, and the inventory information management unit 112 are the security management program stored in the storage unit 100 by the CPU (not shown) of the security management server 104. It is realized by executing.

  Each client 115 includes an inventory collection agent 116 for uploading (transmitting) inventory information such as an operating system (OS) of the client 115, installed software, and patches to the security management server 104. The inventory collection agent 116 is realized by executing a predetermined program stored in the client 115.

  The Web server 101 stores an OS or software patch information page 103 and a security information list page 102 indicating a list of URLs (Uniform Resource Locators) for accessing the patch information page 103. These pages are stored on the Internet. 110. The security management server 104 acquires patch information from the security information list page 102 and the patch information page 103 via the Internet 110.

The system administrator has a security information page URL 106 to be referred to by the security management server 104, a security keyword list 107, and a severity level countermeasure setting list describing necessity of countermeasures according to the severity level of the disclosed vulnerability. 108 is registered in the storage unit 100 using an input means (not shown) or the like.
The page acquisition / analysis unit 105 described above downloads security information (patch information) from the Web server 101 based on information registered (stored) in the storage unit 100, and analyzes the patch information.

The security keyword list 107 is a list showing the port numbers related to the application (software) indicated by the keyword for keywords related to system functions, software names, or security.
For example, if the application indicated by the keyword is an application using http (HyperText Transfer Protocol), the port number “80” used in http is described.

  FIG. 2 is a diagram for explaining the operation of each component in FIG. The operation of each component in FIG. 1 will be described using FIG. 2 with reference to FIG.

First, the inventory information management unit 112 of the security management server 104 requests the client 115 to collect inventory information (step S201).
The client 115 that is the inventory information collection request destination is specified with reference to the managed client table 210 (described later) stored in the database 114.

  Upon receiving the inventory collection request from the security management server 104, the inventory collection agent 116 of the client 115 uploads the inventory information of the client 115 to the security management server 104. That is, the client 115 notifies inventory information to the security management server 104 (step S202). Then, the inventory information management unit 112 stores this inventory information in the database 114.

Further, the page acquisition analysis unit 105 of the security management server 104 checks whether or not the security information list page 102 of the Web server 101 has been updated via the Internet 110 (see FIG. 1) (step S203). If the security information list page 102 has been updated, the web server 101 requests the patch information page 103 from the web server 101 (step S204), and the web server 101 sends information about the patch information page 103 to the security management server 104. Is notified (step S205).
The page acquisition / analysis unit 105 stores the information on the patch information page 103 notified from the Web server 101 in the database 114.

Next, the page acquisition analysis unit 105 of the security management server 104 analyzes the patch information page 103 acquired from the Web server 101 in step S205. Then, the analysis result is transferred to the port open / close determination unit 109.
Details of the operation of the page acquisition analysis unit 105 at this time will be described later.

  The port open / close determining unit 109 determines the port open / close of the router 113 connected to the client 115 from the analysis result of the patch information page 103 and the inventory information of the client 115 read from the database 114. Then, the port opening / closing control unit 111 performs port opening / closing control on the router 113 based on the determination result received from the port opening / closing determination unit 109 (step S206).

Next, a table stored in the database 114 will be described.
The database 114 includes a managed client table 210 that stores management information of the client 115, an installed software information table 211 that stores information about software and patches installed in the client 115, and patch application status (patch in the client 115). Stored is an applied patch list table 212 indicating whether it has not been applied, whether a patch has been applied, or a patch application target. Also, a managed router table 207 storing management information (for example, IP address) of the router 113 to be managed, a port state management table 208 storing the open / closed state of the port of the router 113, and a patch acquired from the Web server 101. The management target patch list table 209 stores information.

Although the managed client table 210, the installed software information table 211, and the applied patch list table 212 are described as being separate, they may be combined into one table.
The creation procedure of these tables and the processing procedure of each component referring to these tables will be described later.

FIG. 3 is a diagram for explaining a method for acquiring a patch information page published on the Web server of FIG. The patch information page acquisition method of the page acquisition analysis unit 105 will be described using FIG. 3 with reference to FIGS. 1 and 2 as appropriate.
3 exemplifies a security information list page before update in the Web server 101, and reference numeral 303 exemplifies a security information list page after update in the Web server 101.
The security information list page 301 (303) shows a list 302 (304) of links (URLs) to patch information pages that have been released so far.

For example, the list of reference numeral 302 indicates the URL of patch information related to “XXX vulnerability (111111)” and the URL of patch information related to “YYY security update program (222222)”. Here, only the title of each patch information is displayed, but it is assumed that the URL of the site providing each patch information is embedded in the title portion, that is, the hyperlink to each patch information page in the title portion. Is set. Further, as illustrated in FIG. 3, the security information list page 301 (303) may include information on the update date (update date / time) of each patch information.
By doing so, it becomes easy to specify newly added patch information and the latest patch information.

  The page acquisition analysis unit 105 of the security management server 104 in FIG. 1 first acquires the security information list page 102 (reference numeral 301 in FIG. 3) from the Web server 101 and stores the acquired page in the storage unit 100. . Next, after the elapse of a predetermined time, the updated security information list page 102 (reference numeral 303 in FIG. 3) is acquired from the Web server 101, the content is compared with the acquired security information list page 102, and the difference information is compared. Search for included URLs.

  In the case of the example in FIG. 3, when the contents of the security information list page 301 and the security information list page 303 are compared, the security information list page 303 has a reference numeral 305 “due to the vulnerability of ZZZ (333333)”. Patch information about has been added. That is, the information indicated by reference numeral 305 is difference information. The page acquisition analysis unit 105 acquires the URL of the newly released patch information page from the difference information 305. Here, for example, the URL “http://aa.bb.cc” is acquired, and the patch information page 103 indicated by this URL is accessed. Then, information on the patch information page 103 is acquired.

  FIG. 4 is a diagram illustrating a method for analyzing the patch information page acquired in FIG. The patch information page 103 includes a patch name 401 to which a unique number is added for each patch, information 405 regarding the disclosed vulnerability, affected software 403 indicating the software name affected by the vulnerability, and a system given by the vulnerability It is composed of information such as a severity level 402 that indicates the degree of the degree of influence.

  The page acquisition / analysis unit 105 in FIG. 1 performs security enhancement (security countermeasures) against the vulnerability according to the patch information page 103, the severity level countermeasure setting list 108 in the storage unit 100, and the security policy in the security keyword list 107. ) Is determined. As a result of the determination, if it is determined that the security enhancement should be performed, the information included in the patch information page 103 is added to the management target patch list table 209 of the database 114.

  It should be noted that the information of the severity level countermeasure setting list 108 and the security keyword list 107 is set and inputted in advance by a system administrator or the like.

The severity level countermeasure setting list 108 is information in which a flag indicating whether security countermeasures are necessary or unnecessary is set for each severity level of the patch information page 103.
For example, the severity level countermeasure setting list 108 in FIG. 4 indicates that the security countermeasure is “necessary” when the severity 402 of the patch information page 103 is “emergency”.

In the security keyword list 107, for each function function or software name or keyword related to security, the TCP / IP port number used by the keyword function or software, the communication protocol, and the security when the keyword is detected. Flags that require countermeasures or are unnecessary are set.
For example, in the security keyword list 107 of FIG. 4, when the keyword “AAA service” is included in the vulnerability information 405 of the released patch information page 103, the port number “135” and the protocol “TCP” are related. It shows that security measures are “necessary”.

  That is, when the page acquisition analysis unit 105 analyzes the patch information page 103 illustrated in FIG. 4, the severity level countermeasure setting list 108 is searched using the information “Urgent” of the severity 402 as a key, and “ Results. Further, the security measure for the port number “135” and the protocol “TCP” is “necessary” from the keyword “AAA service” in the information 405 on the disclosed vulnerability on the patch information page 103.

Here, since the security countermeasure is “necessary” in both the severity level countermeasure setting list 108 and the security keyword list 107, the page acquisition analysis unit 105 determines that the security countermeasure is to be performed based on the patch information page 103, and the patch information Information on the page 103 is added to the management target patch list table 209.
That is, the page acquisition analysis unit 105 extracts the keyword “included in the information 405 regarding the patch name 401“ 333333 ”, the affected software 403“ aaaXP ”, the severity 402“ emergency ”, and the disclosed vulnerability extracted from the patch information page 103. “AAA Service” is recorded in the management target patch list table 209.
It should be noted that an item related to the service pack name (or version name) of the affected software 403 may be provided, such as the “service pack” item in the management target patch list table 209 of FIG.
In this way, the page acquisition analysis unit 105 creates summary information about the patch information managed by the security management server 104 in the patch information page 103 and registers it in the managed patch list table 209.

FIG. 5 is a diagram illustrating the managed client table, the installed software information table, and the applied patch table in FIG.
The managed client table 210 stores various information about the client 115 such as the host name and IP address of the client 115, the OS installed in the client 115, and the service pack name of the OS for each client 115 to be managed. Yes.

For example, the managed client table 210 in FIG. 5 includes “SP (Service Pack) 4” of the OS “aaa2000” in the client 115 with the host name “Host A” and the IP address “192.168.0.2”. Indicates that it is installed.
The management target client table 210 is updated by the inventory information management unit 112 of the security management server 104 in FIG. 1 based on the inventory information uploaded from the inventory collection agent 116 of the client 115.
Note that the managed client table 210 may include information related to the update date and time of each information as illustrated in FIG.

The installed software information table 211 stores information such as the software name, version, service pack name, update date and time installed in the client 115 using the host name 501 of the managed client table 210 as a key. Information in the installed software information table 211 is updated by the inventory information management unit 112 of the security management server 104 based on the inventory information uploaded from the inventory collection agent 116.
It should be noted that the inventory information of the client 115 by the inventory information management unit 112 may be periodically acquired every predetermined period or may be irregularly performed.

  For example, the installed software information table 211 in FIG. 5 indicates that the client 115 of “host A” has “SP4” of version “9.0” of “software A” and version “6.1” of “software B”. It shows that “SP1” is installed.

The port open / close determining unit 109 determines whether or not the client 115 needs security measures based on the patch information page 103 based on information on software installed in the client 115.
The applied patch list table 212 is a table indicating the patch application status of the client 115 for each host name 501 of the managed client table 210.
The applied patch list table 212 is updated by the inventory information management unit 112 based on the inventory information uploaded by the inventory collection agent 116.

  For example, in the applied patch list table 212 of FIG. 5, the patch of the patch name “111111” has been applied (installed) and the patch of “222222” has not been applied (not yet applied) to the client 115 of “Host A”. Information indicating that the patch “333333” is not applicable.

Whether the patch is not applicable for the client 115 is determined by the inventory information management unit 112 by using the management target client table 210 and the installed software information table 211 (the OS of the client 115 and installed software), This is determined based on the management target patch list table 209 (patch information).
For example, in the inventory information management unit 112, the OS of host A (SP4 of aaa2000) and installed software (SP4 of version 9.0 of software A) must be the OS or software to which the patch (333333) is applied. For example, the information “not applicable” is written in the applied patch list table 212.
On the other hand, if an OS or software to which a patch is to be applied is installed on the host A but the patch has not been installed yet, information “not installed” is written in the applied patch list table 212. .

FIG. 6 is a diagram illustrating the managed router table and the port status management table of FIG.
The managed router table 207 stores network information for each router 113 to be managed by the security management server 104 in FIG. This managed router table 207 shows the IP address (reference numeral 207) of the router 113 for each name (reference numeral 601) of the router 113 as shown in FIG. 6, for example. The managed router table 207 in FIG. 6 indicates that the IP address of “Router A” is “192.168.0.1”.

  The port state management table 208 stores a port blocking state (closed state) for each router 113 controlled by the security management server 104 (port opening / closing control unit 111). For example, as shown in FIG. 6, the port status management table 208 includes, for each name of the router 113, the IP address of the router 113, the communication port number, the protocol, the patch name that triggered the port blocking, and the blocking status of the corresponding port. Is stored.

In FIG. 6, the IP address of the “router A” to be managed is “192.168.0.1”, the patch name “111111”, the communication port number “1433”, and the protocol “TCP” port is “blocked” (Closed) ”state.
The port state management table 208 is rewritten when the port opening / closing control unit 111 performs port opening / closing control of the router 113.
In this port state management table 208, in addition to information on closed ports, information on opened ports may be recorded together.

  7 to 9 are flowcharts showing patch information page acquisition and analysis procedures (security management program execution procedure) of the page acquisition and analysis unit in FIG. The processing procedure of the page acquisition analysis unit 105 of the security management server 104 will be described with reference to FIGS. 7 to 9 with reference to FIGS.

First, the page acquisition analysis unit 105 of the security management server 104 in FIG. 1 connects to the Web server 101 via the Internet 110 based on the security information list page URL 106 registered in advance by the system administrator (step S701). Then, the page acquisition analysis unit 105 downloads the security information list page 102 from the Web server 101 and stores it in the storage unit 100 (or the database 114) (step S702).
Thereafter, the process waits for a predetermined time (step S703), and downloads the security information list page 102 from the Web server 101 again (step S704). This predetermined time can be defined and set by the administrator of the security management server 104.

  Next, the difference between the security information list page 102 stored in step S702 and the security information list page 102 downloaded in step S704 is checked (step 705). If there is no difference in the security information list page 102 downloaded in step S704 (No in step S706), that is, if the security information list page 102 has not been updated, the process returns to step S703 and waits for a predetermined time. Later, the security information list page 102 is downloaded from the Web server 101 again. Then, the difference of the security information list page 102 is confirmed.

  On the other hand, if there is a difference in the security information list page 102 (Yes in step S706), the difference information is analyzed (step S707). Specifically, the page acquisition analysis unit 105 extracts difference information of the security information list page 102, and performs HTML (HyperText Markup Language) tag analysis on the difference information. Then, the newly added patch information title and hyperlink (linked URL) to the patch information page 103 are acquired from the analysis result (step S708). For example, the URL “http://aa.bb.cc” of the patch information page 103 linked with the difference information 305 in FIG. 3 is acquired. Then, the patch information page 103 is downloaded from the URL acquired in step S708 (step S709). Next, the process proceeds to step S708.

  In step S710 in FIG. 8, the page acquisition analysis unit 105 analyzes the patch information page 103 downloaded in step S709 in FIG. 7, and acquires information on the patch name, severity level, and affected software. The analysis of the patch information page 103 at this time is performed, for example, based on the patch information page 103 released so far, keywords indicating items to be extracted, such as the patch name, severity level, and affected software, and the patch information page 103 A standard format (format) or the like is stored in the storage unit 100 and is analyzed with reference to these pieces of information.

Then, the page acquisition analysis unit 105 acquires a countermeasure flag corresponding to the severity level indicated in the acquired patch information page 103 from the severity level countermeasure setting list 108 (step S711). Is determined (step S712). If the countermeasure flag is “necessary” (Yes in step S712), the keyword registered in the security keyword list 107 from the patch information page 103, for example, the security keyword list 107 in FIG. “AAA service” and the like are searched (step S713).
Next, when there is a keyword ("AAA service") registered in the security keyword list 107 in the patch information page 103, that is, when the search is successful (Yes in step S714), the security keyword list 107 The countermeasure flag for the keyword (“AAA service”) is acquired. Then, it is determined whether or not the acquired countermeasure flag is “necessary” (step S715). If the countermeasure flag is “necessary” (Yes in step S715), the contents of the patch information page 103 are security managed. It is determined that the server 104 should be a management target. Subsequently, the patch name in the patch information page 103, the affected software, the service pack of the affected software, the severity level, and the keyword successfully searched in step S713 (“AAA service”) are added to the management target patch list table 209. (Step S716).

The above process is performed for each keyword in the security keyword list 107. Then, the corresponding patch information page 103 is searched, and when the keyword search is successful (when the keyword is included in the patch information page 103), the countermeasure flag of the keyword is determined, and the management target patch list Register in the table 209.
When the search is completed for all keywords in the security keyword list 107 (Yes in step S717), the process proceeds to step S718 in FIG. In step S718, assuming that a plurality of pieces of patch information are added, the difference information on the security information list page 303 is searched again, and it is determined whether or not there is a URL of patch information that has not been analyzed. If there is an unanalyzed URL (Yes in step S718), the process returns to step S709 in FIG. 7 to newly download the patch information page 103 and perform an analysis process on the patch information page 103. Then, when the analysis is completed for all the patch information pages 103 (No in step S718 in FIG. 9), the process ends.

  Next, processing procedures of the port opening / closing determination unit 109 and the port opening / closing control unit 111 of the security management server 104 will be described using FIGS. 10 and 11 with reference to FIGS. 1 to 9 as appropriate. FIG. 10 is a flowchart showing a flow of port closing of the router of FIG. 1, and FIG. 11 is a flowchart showing a flow of opening the port of the router of FIG.

First, the flow of closing the port of the router 113 will be described with reference to FIG.
The port open / close determining unit 109 of the security management server 104 in FIG. 1 uses the patch name added to the management target patch list table 209, for example, “By the vulnerability of ZZZ indicated by reference numeral 305 in FIG. 3 (333333). ”” (Step S801), and the affected software name (for example, “aaaXP Service Pack 1”) of this patch is acquired (step S802). Then, the port open / close determining unit 109 searches the installed software information table 211 for the client 115 in which the affected software acquired in step S802 is installed (step S803), and whether or not there is a client 115 in which the affected software has been installed. Is determined (step S804). If there is no client 115 in which the affected software has already been installed (No in step S804), it is determined that there is no client 115 that is vulnerable to the patch, and the process ends.

  On the other hand, if there is the client 115 in which the affected software is already installed (Yes in step S804), there is a possibility that the vulnerability of the corresponding patch exists. Therefore, the port open / close determining unit 109 searches the applied patch list table 212 using the name (host name) of the client 115 in which the affected software searched in step S803 is installed and the patch name acquired in step S801 as keys. (Step S805).

  Here, in the applied patch list table 212, if there is a client 115 in which the corresponding patch is not installed, that is, if the corresponding patch is not installed in each client 115 (No in step S806), the process proceeds to step S807. move on. On the other hand, when there is no client 115 in which the corresponding patch is not installed (Yes in step S806), the processing is ended as it is.

In step S807, the port opening / closing determination unit 109 determines that the client 115 is vulnerable, and the port opening / closing control unit 111 receives this, and performs port closing control processing of the router 113 to which the client 115 is connected. Specifically, the port open / close determining unit 109 first outputs a signal instructing the port open / close control unit 111 to close the port. In response to this signal, the port opening / closing control unit 111 of the security management server 104 acquires information on the TCP / IP port and protocol of the patch from the management target patch list table 209 and the security keyword list 107. For example, the information of the TCP / IP port “135” and the protocol “TCP” of the patch “333333” is acquired.
It is assumed that the signal for instructing the closing of the port includes the name of the patch that has not been installed, the host name and the IP address of the client 115 in which this patch has not been installed.

  In addition, the port opening / closing control unit 111 identifies the router 113 that performs security enhancement (port closing) from the managed router table 207. The identification of the router 113 here is assumed based on, for example, the IP address of the client 115 and the IP address of the router 113. Then, the port opening / closing control unit 111 performs a port closing control process on the router 113 so as to cut off the communication of the acquired TCP / IP port and protocol. For example, a control signal for changing the filtering table of the router 113 is output.

  Further, the port opening / closing control unit 111 adds the information of the router 113 that has closed the port to the port state management table 208 that manages the port opening / closing state in accordance with the port closing control process of the router 113 (step S808). For example, the name of the router that executed the closing control process, the closed TCP / IP port, the protocol, the patch name, the port status, and the like are added.

  When the security management server 104 performs such processing, when the patch information page 103 is newly released, the router 113 can quickly close a port that needs countermeasures, so that the security of the client 115 can be strengthened quickly. It can be carried out. In addition, it is possible to reduce the trouble of security measures for the system administrator.

  After the port opening / closing determining unit 109 and the port opening / closing control unit 111 perform the port closing process as described above, ports that need not be closed may be opened. The port opening flow of the router 113 will be described with reference to FIG.

  First, the port open / close determining unit 109 of the security management server 104 in FIG. 1 extracts a patch name from a record in the port state management table 208 (step S901). Next, the port open / close determination unit 109 searches the applied patch list table 212 for the client 115 in which the corresponding patch is not installed, using the patch name extracted in step S901 as a key (step S902). Here, if there is a client 115 in which the corresponding patch is not installed (No in step S903), it is determined that the vulnerability of the corresponding patch exists, the port related to the corresponding patch is kept closed, and the process proceeds to step S906. .

  On the other hand, if there is no client 115 in which the corresponding patch is not installed (Yes in step S903), the port opening / closing determination unit 109 determines that the entire system is not vulnerable, and the port opening / closing control unit 111 determines that the port opening / closing control unit 111 A signal for instructing opening of the port is output to 111. In response to this, the port opening / closing control unit 111 acquires information (such as the IP address of the router 113) of the router 113 whose port has been closed by the corresponding patch from the port state management table 208, and performs port opening control of this router 113. Processing is performed (step S904). That is, the filtering table of the router 113 is rewritten.

  With the port opening control of the router 113, the port open / close determining unit 109 updates the port state management table 208 (step S905). Specifically, the description in the port opening / closing state column of the patch in the record of the port state management table 208 is rewritten from blocking to opening. Then, when the search is completed for all patch names described in the port state management table 208 (Yes in step S906), the processing is ended as it is. If there is a patch that has not yet been searched in the port state management table 208 (No in step S906), the process returns to step S901.

  As described above, the security management server 104 opens ports for which it is no longer necessary to close the ports, so that countermeasures against viruses and unauthorized access are taken while minimizing the influence on the communication performed by the client 115. be able to.

  FIG. 12 is a flowchart showing the operation of the inventory information management unit of FIG. The flow of inventory information collection of the client 115 by the inventory information management unit 112 will be described with reference to FIGS.

  First, the inventory information management unit 112 of the security management server 104 in FIG. 1 notifies the inventory collection agent 116 of each client 115 existing in the management target client table 210 of the execution of inventory information acquisition (step S1001).

Upon receiving this notification, the inventory collection agent 116 of each client 115 collects inventory information of the client 115 installed in itself and uploads (transmits) the acquired inventory information to the security management server 104.
The inventory information uploaded here is, for example, the host name, IP address, installed OS, software, applied patch name, and the like of the client 115. The OS and software information may include information such as the service pack name and version.

  The inventory information management unit 112 receives the inventory information uploaded from each inventory collection agent 116 (step S1002), and based on the received information, the managed client table 210, the installed software information table 211, and the applied patch list table 212 is updated (step S1003).

After updating the table, the inventory information management unit 112 determines whether there is a client 115 in which the patch is not installed in the applied patch list table 212 (step S1004). Here, if there is no client 115 in which the patch is not installed, the processing is ended as it is.
On the other hand, when there is the client 115 in which the patch is not installed (Yes in step S1004), the inventory information management unit 112 acquires the host name and the patch name of the client 115 from the applied patch list table 212. Further, referring to the management target patch list table 209 from the acquired patch name, the affected software of the patch is acquired. Then, based on the acquired affected software name and the host name of the client 115 from the installed software information table 211, it is determined whether or not the affected software is installed in the corresponding client 115 (step S1005).
That is, for the client 115 in which the patch is not installed, it is determined whether this patch is not installed although it is necessary for the client 115 or whether the patch is not installed because it is unnecessary.

  Here, if the affected software is not installed in the corresponding client 115 (No in step S1005), the inventory information management unit 112 determines that the corresponding client in the applied patch list table 212 is not affected by the vulnerability. The corresponding patch record 115 is changed from “not installed” to “not applicable” (step S1006). Thereafter, the process returns to step S1004, and the processes in and after step S1005 are repeated for each client 115 in which the patch is not installed in the applied patch list table 212.

  In this way, the security management server 104 can rewrite the patch application state in each client 115 to the latest one.

  According to the above-described embodiment, when new security information is disclosed on the Web server 101, the security management server 104 promptly controls the opening / closing of the port of the router 113. Can do. In addition, it is possible to reduce the burden of system administrators and users who check security information via the Internet every day. Furthermore, since the security management server 104 analyzes the contents of the released security information (patch information) and controls opening / closing of ports that are vulnerable to the client 115, the influence on the communication performed by the client 115 is minimized. , Virus and unauthorized access can be protected.

  In addition, the system administrator includes the severity level countermeasure setting list 108 and the security keyword list 107 (see FIG. 4) as to which level of severity the security measures are taken in the disclosed security information, and which keywords are included. Since it can be set whether to take security measures if it is done, a flexible security policy can be set.

  The security management server 104 according to the present embodiment can be realized by a security management program that executes the processing as described above, and stores the program in a computer-readable storage medium (CD-ROM or the like). Can be provided. It is also possible to provide the program through a network.

It is a block diagram which shows the structure of the system containing the security management server of the 1st Embodiment of this invention. It is a figure explaining operation | movement of each component of FIG. It is a figure explaining the acquisition method of the patch information page published by the Web server of FIG. It is a figure explaining the analysis method of the patch information page acquired in FIG. FIG. 3 is a diagram illustrating an example of a management target client table, an installed software information table, and an applied patch table in FIG. 2. FIG. 3 is a diagram illustrating a managed router table and a port state management table in FIG. 2. It is a flowchart which shows the acquisition and analysis procedure of the patch information page of the page acquisition analysis part of FIG. It is a flowchart which shows the acquisition and analysis procedure of the patch information page of the page acquisition analysis part of FIG. It is a flowchart which shows the acquisition and analysis procedure of the patch information page of the page acquisition analysis part of FIG. It is a flowchart which shows the flow of the port closing of the router of FIG. It is a flowchart which shows the flow of the port opening of the router of FIG. It is a flowchart which shows operation | movement of the inventory information management part of FIG.

Explanation of symbols

100 Storage Unit 101 Web Server 103 Patch Information Page (Security Information)
104 Security management server (security management device)
105 Page acquisition and analysis unit 107 Security keyword list 109 Port open / close determination unit 110 Internet (network)
111 Port Open / Close Control Unit 112 Inventory Information Management Unit 113 Router 114 Database 115 Client

Claims (5)

A security management method using a security management device that performs TCP / IP port opening / closing control of a router connected to a client based on the latest security information acquired via a network and performs security management,
The security management device is
Obtaining inventory information of each client from each client and storing it in a database;
Obtaining the latest security information via the network;
Analyzing the acquired security information;
With reference to a security keyword list indicating a predetermined keyword and a TCP / IP port related to an application indicated by the keyword, it is determined whether or not the keyword indicated in the security keyword list is included in the analyzed security information. A determining step;
Storing the security information in the database when it is determined that the keyword shown in the security keyword list is included in the security information;
Determining whether there is a client that needs security measures based on the security information with reference to the database; and
When there is a client requiring the security measure, referring to the database, and identifying a router connected to the client requiring the security measure;
Outputting to the identified router a control signal for closing a TCP / IP port associated with the patch;
The security management method characterized by performing. The step of obtaining the latest security information via the network includes:
Downloading the latest security information page from the Web device that publishes the security information via the network,
The step of analyzing the acquired security information includes:
The security management method according to claim 1, wherein security information newly added in the latest security information page is extracted and analyzed from difference information from the previously acquired security information page. Clients that need the security measures
3. The security management method according to claim 1 or 2, wherein the affected software indicated by the security information is a client installed, and the affected software patch is not applied. A security management device that performs TCP / IP port opening / closing control of a router connected to a client based on the latest security information acquired via a network and performs security management,
Related to the inventory information including the software name installed on each client and the name of the applied patch, the database storing the security information and the identification information of the router, the predetermined keyword and the application indicated by the keyword A storage unit for storing a security keyword list indicating a TCP / IP port;
An inventory information management unit that acquires inventory information of each client from each of the clients and stores it in the database;
Obtaining the latest security information via the network, analyzing the security information, and obtaining a page for storing the security information in the database when the security information includes a keyword shown in the security keyword list An analysis unit;
A port open / close determining unit that refers to the database and determines whether or not there is a client that requires security measures based on the security information;
When there is a client requiring the security measure, the control signal for closing the TCP / IP port related to the patch is output to the router connected to the client requiring the security measure with reference to the database. A port opening / closing control unit,
A security management device comprising:   A security management program for causing a computer to execute the security management method according to any one of claims 1 to 3.

Images