JP2012093804A - Security monitoring device, security monitoring method and security monitoring program based on security policy - Google Patents

Abstract

PROBLEM TO BE SOLVED: To monitor occurence of even items which are not covered by security policy and properly notify an administrator of monitoring results so that the administrator can recognize a threat and take a countermeasure in proper timing in administration based on security policy.SOLUTION: An administrative server monitors occurrence of even items which are not covered by security policy, and evaluates transitions of monitoring results to perform specific output as required.

Description

  The present invention relates to a security monitoring apparatus, a security monitoring method, and a security monitoring program for performing security monitoring of an information system based on a security policy, and is particularly suitable for analyzing security threats and their causes. .

  In recent years, with the development of the information industry, the importance of security management has increased as the role played by information systems has become more important. In security management related to such information systems, security risks are analyzed based on the detection of threats and vulnerabilities, the probability of their occurrence, etc., a security policy is established, and necessary countermeasures are implemented. As for the implementation of security measures, there is a method of analyzing risks based on the presence or absence of vulnerabilities, the frequency of occurrence of vulnerabilities, and the asset value as the state of the operating system, and presenting candidate countermeasures with priorities. (See Patent Document 1). In addition, there is a method to update the risk value based on the asset value of the information and file access information, and to perform countermeasure processing such as access restriction when the risk value exceeds a specified threshold (patent) Reference 2).

International Publication No. 2008-004498 JP 2005-190066 A

  In the conventional information system, when the countermeasure proposal candidate is presented as described above, it is the administrator who finally determines the countermeasure to be actually performed and the security policy in the information system. Such information system security threats may be caused by user behavior as well as user behavior, such as information leakage. When formulating a security policy, an administrator may make settings for suppressing operations on a terminal device such as a computer, for example, as a countermeasure against user behavior that may be a cause. However, in the conventional information system, when the setting for suppressing the operation is not performed in consideration of convenience, or the setting to the terminal device such as taking out the terminal device, the user's action itself cannot be suppressed. There are cases.

  Also in the conventional security management tool, when an administrator sets a certain item as a security policy, it is generally performed to monitor and evaluate whether or not the corresponding item is observed. However, when a security policy is formulated, items that are not set as a security policy as described above are not monitored.

  The present invention has been made in consideration of the above points, and monitors the occurrence of policies that are not subject to security policy development, and outputs the monitoring results at an appropriate timing, so that the administrator recognizes the threat. Therefore, it is intended to propose a security monitoring apparatus, a security monitoring method, and a security monitoring program that can take measures.

  In order to solve such a problem, in the present invention, in a security monitoring device that manages at least one terminal device, when applying a security policy to each of the terminal devices, setting items set as items of the security policy; A management program that manages the security policy separately from non-set items that are not set as items of the security policy, and occurrence of a causal event that may cause a threat to the non-set items in each terminal device A collection program that collects information on the occurrence of the causal event, and evaluates changes in the causal event based on the information on the causal event, and outputs a specific output when the change in the causal event exceeds a reference And a non-target policy monitoring program.

  According to the present invention, in the security monitoring method for managing a system including at least one terminal device, when the management program sets a security policy for each of the terminal devices, the security policy is set as an item of the security policy. A management step for managing the security policy separately from the set items that have been set and non-set items that are not set as the items of the security policy, and a collection program generates a threat for the non-set items in each terminal device A collection step for monitoring the occurrence of a possible cause event and collecting information about the occurrence of the cause event, and a non-target policy monitoring program evaluates the change of the cause event based on the information about the cause event. When a change in the causal event is above the standard, Characterized in that it comprises a non-target policy monitoring step of performing.

  In the present invention, when each security policy is applied to at least one terminal device, the setting item set as the security policy item and the non-setting item not set as the security policy item A management program that separately manages the security policy, and a collection program that monitors the occurrence of a causal event that may cause a threat to the non-setting item in each terminal device, and collects information related to the occurrence of the causal event And a non-target policy monitoring program that evaluates a change in the cause event based on information on the cause event and performs a specific output when the change in the cause event is equal to or greater than a reference. And

  In the present invention, in the security monitoring method in a system including at least one terminal device, the monitoring module monitors the occurrence of a causal event that may cause a security threat, and the calculation module , Calculating the occurrence probability, calculating the occurrence probability of the affected threat based on the occurrence probability of the causal event, the evaluation module evaluates the change of the calculated value over time, and the change A specific output is performed when the reference value is exceeded.

  According to the present invention, it is possible to provide information on a threat that is not subject to a security policy that is not recognized by an administrator, a threat that is likely to be revealed, a cause thereof, and a countermeasure for the threat. Administrators can recognize threats and take countermeasures at appropriate times.

It is a figure which shows the hardware and logic structure of the system in 1st Embodiment. It is a module block diagram which shows the relationship between the program and table which are performed in a management server. It is a block diagram which shows the function module structure of a security policy management program. It is a block diagram which shows the functional module structure of a non-target policy monitoring program. It is a flowchart which shows an example of the procedure which a security policy management program performs. It is a figure which shows the table structure of a policy management table. It is a figure which shows the table structure of a monitoring item management table. It is a figure which shows the table structure of a propagation rule management table. It is a figure which shows the example of the tree which shows the mechanism of the combination of the threat of a propagation rule, and its causal event. It is a flowchart which shows an example of the procedure which a non-target policy monitoring program performs. It is a flowchart which shows an example of the procedure which the non-target policy monitoring program in the modification of 1st Embodiment performs. It is a flowchart which shows an example of the procedure which the non-target policy monitoring program in the modification of 1st Embodiment performs. It is a flowchart which shows an example of the procedure which the non-target policy monitoring program in 2nd Embodiment performs.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) Concept of this embodiment In this embodiment, when a security policy is set for each terminal device in a system including at least one terminal device, items that are set as security policies and items that are not set The security policy is managed separately. In normal security policy management, only set items (hereinafter referred to as “set items”) are monitored, and items that are not set (hereinafter referred to as “non-set items”) are not monitored. .

  However, in the present embodiment, such non-setting items are also subject to monitoring due to the following circumstances. That is, for example, even if the settings are made by the administrator, these non-set items (corresponding to the monitor items to be described later) are based on the idea that if they are not set at all, if they are not monitored at all, they are too vulnerable to potential threats. This is to notify the administrator that a potential security risk may occur in the future as a specific output if necessary, as a precautionary measure.

  In the present embodiment, a user terminal is given as an example of a terminal device, but other electronic devices such as a computer may be used. Hereinafter, this embodiment will be specifically described. In the following description, the term “propagation rule” is used. This propagation rule refers to a combination of events (corresponding to cause events described later) that may cause a certain threat to occur. The monitoring items are defined for each cause event as will be described later. The same causal event may be included in different threat propagation rules.

(2) First Embodiment (2-1) Hardware and Logical Configuration (2-1-1) Overall System FIG. 1 shows a hardware and logical configuration of a system 100 according to the first embodiment. The system 100 includes a management server 101, at least one user terminal 102, and a network 1108. The management server 101 is an example of a security risk visualization device. For example, there are a plurality of user terminals 102, which are operated and used directly by the user, and are managed according to the security policy.

  The management server 101 and the user terminal 102 each include one or more central processing units (hereinafter referred to as “CPU”) 103, a memory 104, a secondary storage device 105 such as a hard disk drive, an input / output interface 106, and a network interface 107. I have. Among these, the input / output interface 106 has a function of controlling input information from the keyboard and mouse and output information to the display. The network interface 107 is an interface for connecting to the network 108.

  On the memory 104 of the management server 101, a security policy management program 109, a non-target policy monitoring program 110, and a collection program 111 are loaded. Programs such as the security policy management program 109, the non-target policy monitoring program 110, and the collection program 111 are executed by the CPU 103. The disk device 105 stores information on the policy management table 112 and the propagation rule management table 113.

  Each user terminal 102 includes a CPU 122, a memory 121, a disk device 123, a network interface (hereinafter abbreviated as “I / F”) 125, and an input / output interface 124. Of these, the agent program 114 is loaded into the memory 121 and executed by the CPU 122. As will be described later, the agent program 114 has a normal function of acquiring operation logs and configuration information by the user of the user terminal 102.

(2-1-2) Relationship between Program and Table in Management Server FIG. 2 shows the relationship between each program and table in the management server 101. The security policy management program 109 corresponds to an example of a management program, performs input / output from the user, registration to the policy management table 112, reading, and the like, and further transmits a security policy to the agent program 114. The non-target policy monitoring program 110 corresponds to an example of a monitoring program, and refers to the policy management table 112 and the propagation rule management table 113 and outputs to the user. In addition, the security policy management program 109 and the non-target policy monitoring program 110 each use information collected by the collection program 111 to evaluate changes in the probability of occurrence of threats over time for the above-described non-set items. This collection program 111 collects information from the agent program 114 of the user terminal 102.

(2-1-3) Definition of Security Policy Here, the security policy (hereinafter also abbreviated as “policy”) indicates the security policy of the entire system 100 such as the management server 101, the network device, and the user terminal 102. Here, as an example, a policy regarding at least one of operation and setting on the user terminal 102 is shown. Such policies include, for example, items related to software installation such as essential software and prohibited software, items related to OS settings such as screen saver enable and firewall enable, control related to terminal devices such as connection inhibition of external storage media and application activation. There are items that stipulate user actions such as items, prohibition of transmission of mail addressed to external addresses, and prohibition of taking out terminal devices.

(2-1-4) Functional Module Configuration of Excluded Policy Monitoring Program FIG. 3 shows a functional module configuration of the security policy management program 109. The security policy management program 109 includes an input reception module 301, a policy creation module 302, a policy setting module 303, and a policy compliance status evaluation module 304.

  The input reception module 301 receives input related to policy setting from the user. The policy creation module 302 creates a policy to be applied to at least one of the user terminal 102 and the system. The policy setting module 303 distributes and sets a policy to the user terminal 102 to be managed. The created policy is registered and managed in the policy management table 112. The policy compliance status evaluation module 304 monitors and evaluates whether or not the set policy is observed in each user terminal 102. The policy compliance status evaluation module 304 reads the contents of the policy management table 112 and performs the above-described evaluation based on the contents.

  Further, the collection program 111 of the management server 101 includes an operation log collection unit 305 and a configuration information acquisition module 306. The operation log collection unit 305 collects operation logs at the user terminal 102 from the agent program 114 of the user terminal 102. On the other hand, the configuration information collection module 306 collects configuration information of the user terminal 102.

(2-1-5) Functional Module Configuration of Excluded Policy Monitoring Program FIG. 4 shows a functional module configuration of the excluded policy monitoring program 110. The non-target policy monitoring program 110 includes a cause event extraction module 404, an occurrence probability calculation module 403, a history database 405 (probability history DB shown in the figure), a probability variation evaluation module 402, and an output processing module 401.

  The causal event extraction module 404 extracts whether or not there is a causal event based on the user operation log and configuration information collected from each agent program 114. The occurrence probability calculation module 403 reads the propagation rule from the propagation rule management table 113, and calculates the probability of occurrence of a threat based on the propagation rule based on the occurrence probability of the cause event. The history database 405 is a database for holding the calculated probability. The probability variation evaluation module 402 has a function of evaluating a history of probability. The output processing module 401 has a function of outputting an evaluation result.

(2-2) Security Monitoring Method The system according to the first embodiment is configured as described above. Next, an example of a security monitoring method that is a part of the operation example will be described.

(2-2-1) Processing of Security Policy Management Program FIG. 5 shows a flowchart of the security policy management program 109 of the management server 101. In this management server 101, the CPU 103 executes each command of the security policy management program 109, and the security policy management program 109 executes the following steps under the control of the CPU 311. In the following description, When the security policy management program 109 executes each step, it is expressed in a simplified manner.

  The management server 101 displays items that can be set as policies. On the other hand, the user selects using an input interface (not shown) (S501) and performs input. The security policy management program 109 receives input from the above-described user (S502), determines a policy to be set, and registers it in the policy management table 112 (S503). Further, the security policy management program 109 distributes the policy set in this way to the agent program 114 of the management server 101 (S504). Note that the input from the user may be in a description format that defines a description method instead of the selection format as described above.

  In addition, the propagation rule management table 113 used by the non-target policy monitoring program 110 holds monitoring items corresponding to the propagation rules. The security policy management program 109 compares the monitoring item in the determined policy with the monitoring item in the propagation rule (S505), and for the matching item, evaluates the status of whether or not the policy is observed ( (Hereinafter referred to as “policy compliance status evaluation”), it is determined that it is not a target item of the non-target policy monitoring program 110 (S506). The security policy management program 109 applies such determination to the monitoring items of all policies to be set (S507).

  Here, as another method for the administrator to determine the policy, the security policy management program 109 searches the policy management table 112 for a policy corresponding to the monitoring item included in the propagation rule, and outputs it as a selectable policy. May be presented to the administrator. The security policy management program 109 may apply a policy selected by the administrator from the policies output in this way, and manage other policies as exclusion policies. The monitoring item corresponding to this exclusion policy is a target item of the non-target policy monitoring program 110.

  The security policy management program 109 monitors and evaluates the compliance status for the set policy. The security policy management program 109 evaluates the compliance status by extracting information according to the item from the operation log and configuration information collected from the user terminal 102 (S508) and totaling information on all target terminals. The security policy management program 109 evaluates periodically or when requested by the user, and outputs an evaluation result (S509).

  The agent program 114 in the user terminal 102 receives a policy from the management server 101, and sets items that need to be set according to the received policy in the OS and registry. This agent program 114 monitors not only policy setting items but also all monitoring items as monitoring targets. At the same time, the agent program 114 records user operations. Further, the agent program 114 transmits the monitoring information to the management server 101 periodically or according to a request from the management server 101.

(2-2-2) Table Configuration of Security Policy Management Table FIG. 6 shows a table configuration of the security policy management table 112 managed by the management server 101. The security policy management table 112 is a table for managing policies, and includes a policy ID field 601, a content field 602, a target field 603, and a monitoring item field 604.

  The policy ID field 601 is an identifier for identifying a policy. The content field 602 describes the content of the policy corresponding to the policy ID field 601. A target field 603 indicates whether to apply as a policy. The monitoring item field 604 describes the contents of the monitoring item corresponding to the policy.

  One or more monitoring items are defined in the policy, and the compliance status is evaluated by monitoring the monitoring items. There may be two or more monitoring items for one policy, and one monitoring item may be a monitoring item for different policies.

(2-2-3) Table Configuration of Monitoring Item Table FIG. 7 shows a configuration example of the monitoring item table 108 for managing monitoring items. This monitoring item table 108 has a monitoring content 702 for a monitoring item ID 701 and a target field 703 for managing whether it is a monitoring target as a policy. Monitoring results of policy target items (corresponding to setting items) are subject to policy compliance status evaluation, and items not corresponding to policy (corresponding to non-setting items) are subject to the non-target policy monitoring program 110 described later.

(2-2-4) Table Configuration of Propagation Rule Management Table 113 FIG. 8 shows the configuration of the propagation rule management table 113 managed by the management server 101. The propagation table management table 113 includes a rule ID field 801, a threat field 802, a propagation rule field 803, and a monitoring item field 804.

  The rule ID field 801 is a field for identifying each propagation rule. The threat field 802 is a field for identifying a plurality of threats from each other. A propagation rule field 803 is a field indicating a propagation rule calculation formula. A monitoring item field 804 is a field indicating a monitoring item corresponding to the propagation rule.

  Here, the propagation rule is represented by a combination of cause events, and the monitoring items are defined for each cause event. The same causal event may be included in different threat propagation rules. The monitoring items are managed by the monitoring item ID shown in the monitoring item table 108 shown in FIG.

(2-3) Combination of Causal Events FIG. 9 shows an example of a tree showing a mechanism of a combination of a threat and its causal event as a propagation rule. In this embodiment, a cause event is defined for an event that is a security threat, and propagation from a combination of cause events to occurrence is defined. In this example, not all of the cause events for the threat are shown, but a part is shown.

・ Threat Event 1 [The user takes the user terminal and is stolen and information is leaked] (901)
・ Cause event A [user terminal is portable] (902)
・ Cause event B [Save file in user terminal] (903)
Cause event C [the user takes out the user terminal] (904)
Cause event D [HDD password is not set on user terminal] (905)
Cause event E [HDD password is not set on user terminal] (906)
Cause event F [HDD of user terminal is not encrypted] (907)

  Note that events 908 to 910 other than the cause event and the threat event indicate states, but are not related to the propagation rule, and thus description thereof is omitted. An HDD (Hard Disk Drive) is an example of the disk device 123 described above.

  In this case, the propagation rule is threat event = [cause event A] * [cause event B] * [cause event C] * {([cause event D] + [cause event E]) + [cause event F]}. expressed. Here, “*” represents a logical product (corresponding to AND in the drawing), and “+” represents a logical sum (corresponding to OR in the drawing). In this embodiment, the non-target policy monitoring program 110 calculates the occurrence probability of a threat using a logical product or a combination of logical sums of the occurrence probabilities of one or more causal events. That is, the non-target policy monitoring program 110 calculates the occurrence probability of the threat event by obtaining the occurrence probability of each cause event and applying it to the propagation rule.

(2-4) Processing of Excluded Policy Monitoring Program FIG. 10 shows a flowchart of the excluded policy monitoring program 110 of the management server 101. In this management server 101, the CPU 103 executes each instruction of the excluded policy monitoring program 110, and the excluded policy monitoring program 110 executes the following steps under the control of the CPU 311. In the following description, Is expressed in a simplified manner when the excluded policy monitoring program 110 executes each step. Similarly, the collection program 111 is expressed in a simplified manner.

  The non-target policy monitoring program 110 extracts items necessary for monitoring a cause event that is a monitoring target item from the operation log and configuration information collected from the user terminal 102 by the collection program 111 (S1001). For example, for the cause event B, the non-target policy monitoring program 110 extracts the record “save the file” from the operation log.

  The non-target policy monitoring program 110 performs such extraction processing on the collected information from all the agent programs 114 (corresponding to the illustrated agent) (S1002), and totals the extraction results for each monitoring item (S1003). ). Further, the non-target policy monitoring program 110 calculates the occurrence probability of the cause event corresponding to the monitoring item (S1004). For example, when the non-target policy monitoring program 110 monitors the HDD password based on the configuration information from 1000 user terminals 102, if there are 10 user terminals 102 for which no HDD password is set, the cause event The occurrence probability of D is calculated as 10/1000 = 0.01.

  The non-target policy monitoring program 110 stores the calculated value in the history database 405. Thereby, in the history database 405, the monitoring item and its occurrence probability, the threat event and its occurrence probability are stored together with the calculation time. The non-target policy monitoring program 110 performs such processing for all monitoring items (S1005).

  Next, the non-target policy monitoring program 110 searches for the occurrence probability of each cause event for each propagation rule, applies the occurrence probability value of the calculated cause event, and calculates the occurrence probability of the threat (S1006). Here, there is a case where a monitoring item related to the cause event of the propagation rule is a policy setting target. In this case, the non-target policy monitoring program 110 reads the result monitored by the security policy management program 109 and uses it as the threat occurrence probability. The non-target policy monitoring program 110 stores the calculated threat occurrence probability in the history database 405.

  Furthermore, whether the non-target policy monitoring program 110 needs to evaluate the occurrence probability history regarding the propagation rule based on the probability history database 405 and perform a specific output to the user based on the evaluation result. It is determined whether or not the output criterion is satisfied (S1007). The output standard is, for example, a predefined threshold value, and a specific output is performed when the occurrence probability is equal to or greater than the threshold value.

  As another example, the non-target policy monitoring program 110 determines a difference in change with time of the calculated value as described above, that is, a difference from the previous time, and the difference is larger than a specific value. Or, when the calculated high value continues for a certain period, a specific output is performed. As another example, the non-target policy monitoring program 110 may create a prediction history graph and use it as a reference for performing a specific output even when the prediction history graph does not tend to match the prediction history graph. For these output standards, which standard is used in the program and its standard value are set in advance. A plurality of output standards such as a threshold value and a difference may be used at the same time.

  The non-target policy monitoring program 110 executes a specific output when the result of the determination is that the standard is satisfied (S1008). This excluded policy monitoring program 110 reduces, as a specific output, for example, a specific cause event having a large change in occurrence probability among events that can be a cause, and the occurrence probability for this specific cause event. Output the countermeasures. More specifically, the non-target policy monitoring program 110 displays information on the cause event that is the cause of the change in the threat event and its probability, and the occurrence probability of the threat event, as output information. Note that the numerical value of the occurrence probability may be displayed as it is as illustrated, or may be displayed at a level defined in several stages, for example.

  Further, the non-target policy monitoring program 110 may retrieve a policy corresponding to the monitoring item from the policy management table 109 and output it together as a countermeasure against the corresponding cause event. On the other hand, the non-target policy monitoring program 110 manages a countermeasure target candidate (for example, a server or a network device) with a propagation rule table (not shown) for a threat that cannot be taken by the user terminal 102 and its cause, In addition, a specific output may be performed.

  Here, the management server 101 may include a countermeasure implementation module (not shown) that implements the countermeasure output as described above on the user terminal 102 that may cause a cause event. In this case, the countermeasure implementation module may implement the countermeasure in another device other than the user terminal 102, such as a mail server or a file server (not shown).

  The non-target policy monitoring program 110 determines whether or not calculation has been performed for all propagation rules. If there is a propagation rule that has not been calculated, the processing ends when the calculation has been performed in step S1006 described above. (S1009).

  As described above, even if an item other than the item set as a policy (corresponding to the non-setting item above) is managed, an event that can cause a threat (corresponding to the causal event described above) is managed, and the administrator generates a threat. Can be notified at an appropriate timing. Therefore, even for potential threats that are not subject to security policies that are not recognized by the administrator, the administrator can provide information on the threats that are likely to be revealed, their causes, and countermeasures. You will be able to recognize threats and take measures at the right time.

(2-5) Modified example of the first embodiment (2-5-1) First modified example Next, by evaluating the fluctuation of the monitoring item, the cause of the occurrence of the threat is appropriately determined to the administrator. Shows how to inform. Here, a method will be described in which the non-target policy monitoring program 110 evaluates variation for each monitoring item and calculates the occurrence probability of a threat event when the occurrence probability of the monitoring item varies.

  FIG. 11 shows a flowchart of the non-target policy monitoring program 110. The process in the flowchart is the same as the flowchart described in FIG. 10 up to the process of calculating the occurrence probability of the cause event (corresponding to steps S1001 to S1004).

  The non-target policy monitoring program 110 stores the calculated result as a history and evaluates the history of the result. It is determined whether the history matches the output standard (S1101). As the output standard here, a pre-defined standard is used, for example, when the latest calculated value is compared with the previous calculated value and the difference is a certain value or more, or when the threshold value or more continues for a certain period. The same standard for all items or the standard for each monitoring item may be used.

  When the output criterion is satisfied, the non-target policy monitoring program 110 may output the result of the corresponding monitoring item (S1102). Further, the non-target policy monitoring program 110 may calculate the probability of occurrence of a threat event including the corresponding monitoring item, and output it according to the result evaluated in the same manner as described above in the description of FIG. According to this method, a threat whose probability of a causal event does not change can be simplified without being calculated.

  Further, in the first modified example, where the change in the occurrence probability of the monitoring item is evaluated, the value used for the evaluation of the change may be evaluated not by the occurrence probability but by the number of extracted total results. In this case, an output criterion for the number of extractions is defined in advance, and it is determined whether or not the output criterion is met.

(2-5-2) Second Modification As a result of the cause event monitoring shown in the first embodiment, the cause event occurrence probability may be “0” (for example, the HDD password is specified). It is set for all user terminals 102 at the time). Here, a method for evaluating whether a change in other cause events affects the probability of occurrence of a threat even when the occurrence probability of a certain cause event is “0” is shown.

  FIG. 12 shows a flowchart of a part of the processing of the non-target policy monitoring program 110. In the flowchart, the same processing is performed until the occurrence probability (S1001 to S1005) for each monitoring item in the flowchart shown in FIG. In the method described in the first embodiment, even if “0” is one of the monitoring items, “0” is applied to the propagation rule as it is. The same applies to S1201 to S1203 in the flowchart shown in FIG. Here, two history databases 405 are held, and the first history database 405 stores the calculated values as they are. For example, if all HDD passwords are set, the probability of occurrence of a threat calculated by a combination of logical products is “0”, and is stored in the first history database 405.

  When the cause event occurrence probability is “0”, the threat occurrence probability is “0” and does not change even if the other cause event probability changes. Therefore, the non-target policy monitoring program 110 confirms whether there is a cause event having an occurrence probability of “0” (S1204), and then sets the item of “0” so that the influence of other cause fluctuations can be confirmed. The value is changed to a specific value greater than “0” and less than or equal to “1” (for example, 0.01). The non-target policy monitoring program 110 calculates the probability of occurrence of a threat using the specific value and stores it in the second history database 405 (S1205). In addition, it is managed in a table (not shown) that the probability of the corresponding cause event is a specific value. Then, the non-target policy monitoring program 110 compares the output criteria (S1206), and outputs information about the cause events that have changed and the probability of occurrence of the threat, except for the cause events that use specific values when outputting. (S1207).

  According to the second modified example, even if there is no possibility of occurrence of a plurality of causes at a specific time (even if the occurrence probability is “0”), other cause events are not detected. It is possible to determine whether it affects the change in the probability of occurrence of a threat.

(3) Second Embodiment Next, as a second embodiment of the present invention, a method for automatically changing a policy when the occurrence probability of a threat event is increasing will be described. Since the second embodiment is almost the same as the first embodiment, the following description will focus on the differences.

(3-1) Processing of Excluded Policy Monitoring Program FIG. 13 shows a flowchart of the excluded policy monitoring program 110 according to the second embodiment. In the second embodiment, the processing up to the evaluation of the probability of occurrence of a threat event (corresponding to steps S1001 to S1008) is the same as that in the first embodiment described above. Omitted.

  As a result of the evaluation, the non-target policy monitoring program 110 determines an item that causes a change in the occurrence probability of the threat event among the occurrence probability of the cause event. Such a determination may include, for example, the occurrence probability of the causal event itself, a large difference from the previous time, or exceeding a threshold value. Specifically, after the execution of step S1008, the non-target policy monitoring program 110 determines, for example, a policy for an item whose occurrence probability of a causal event is larger than a specified value among non-set items with the passage of time. With reference to the management table 112, for example, the policy setting is automatically changed according to a specific countermeasure (S1301). Note that the command for this automatic setting is represented by an arrow from the non-target policy monitoring program 110 to the security policy management program 109 in FIG.

  The policy setting change by the excluded policy monitoring program 110 is notified to the security policy management program 109, and the security policy management program 109 distributes the changed policy to the agent program 114. Further, the non-target policy monitoring program 110 outputs to notify the administrator when the policy is automatically changed. In this way, if the potential of a potential threat outside the scope of a policy that the administrator does not recognize has increased, the security risk is constantly ignored even if the administrator is unaware. It becomes possible to suppress.

  Here, the non-target policy monitoring program 110 may output an interface for selecting whether or not the policy can be changed before automatically changing the policy according to the result of the evaluation described above. In this way, the administrator can be given the opportunity to decide whether or not the policy can really be changed, and can be secured with respect to an action that has a large security impact of changing the policy. . In accordance with the input from the administrator, the non-target policy monitoring program 110 changes the policy when “changeable” is selected, and does not change the policy when “deny” is selected.

(3-2) Another method As another proposal of this method, there is a method of excluding the set policy when the reference value when the occurrence probability of the threat event is small (lower than the threshold value) is satisfied. As a result, even when operation starts with the minimum policy settings, the operation status is monitored, and policy settings such as operation suppression required when the probability of occurrence of a threat is high can be set according to the operation status. Policy can be set.

  According to the above-described embodiment, information is output when the occurrence of an item that is not the target of the security policy is detected by monitoring and the output condition is satisfied. Items that are not covered by the security policy may not be managed by the administrator, and notification to the administrator every time an occurrence is detected may increase the burden on the administrator. By outputting when the occurrence frequency is increased or the probability of threat manifestation is high as in the present invention, the burden on the administrator can be reduced.

  In addition, items that are determined to be unnecessary by the administrator at the time of policy formulation, such as an increase in the weight of portable PCs and the number of users who take them out, may increase due to changes in user usage. In the present embodiment, by monitoring and outputting such changes, it is possible for the administrator to determine whether the policy should be set.

(4) Other Embodiments The above embodiment is an example for explaining the present invention, and is not intended to limit the present invention only to these embodiments. The present invention can be implemented in various forms without departing from the spirit of the present invention. For example, in the above-described embodiment, the processing of various programs is described sequentially, but this is not particularly concerned. Therefore, as long as there is no contradiction in the processing result, the processing order may be changed or the operation may be performed in parallel.

  DESCRIPTION OF SYMBOLS 100 ... System, 101 ... Management server, 102 ... User terminal, 108 ... Monitoring item table, 109 ... Security policy management program, 110 ... Exclusion policy monitoring program, 111 ... Collection program, 112 ... Policy management table, 113 …… Propagation rule management table, 114 …… Agent program

Claims (18)

In a security monitoring device that manages at least one terminal device,
A management program for managing the security policy separately for setting items set as the security policy items and non-setting items not set as the security policy items when applying a security policy to each terminal device When,
A collection program for monitoring the occurrence of a causal event that may cause a threat for the non-setting items in each of the terminal devices, and collecting information relating to the occurrence of the causal event;
A security monitoring apparatus comprising: a non-target policy monitoring program that evaluates a change in the cause event based on information on the cause event and performs a specific output when the change in the cause event is equal to or greater than a reference. . The collection program is
The security monitoring apparatus according to claim 1, wherein an operation log corresponding to an operation by a user and configuration information regarding a configuration of each terminal device are acquired from each terminal device. The non-target policy monitoring program calculates the occurrence probability of the cause event related to the non-set item as an evaluation as to whether or not the change in the cause event is equal to or higher than a reference, and determines the occurrence probability of the cause event related to the non-set item. Based on the threat occurrence probability calculated based on
The specific output is performed when a difference in change with time of the calculated value is larger than a specific value, or when the calculated value is a predetermined threshold or more. 2. The security monitoring device according to 2. The excluded policy monitoring program is:
The security monitoring apparatus according to claim 3, wherein the threat occurrence probability is calculated using a logical product or a combination of logical sums of one or more cause event occurrence probabilities. The excluded policy monitoring program is:
A specific causal event having a large change in the probability of occurrence among the above-mentioned events that may be the cause;
The security monitoring apparatus according to claim 4, wherein a countermeasure for reducing the probability of occurrence of the specific cause event is output as the specific output. The excluded policy monitoring program is:
The security monitoring apparatus according to claim 5, wherein the security policy is automatically changed for an item in which a variation in the occurrence probability of the cause event is larger than a specified value among the non-set items. The security monitoring apparatus according to claim 6, further comprising a countermeasure implementation module that implements the output countermeasure on the terminal apparatus in which the cause event may occur. The countermeasure implementation module is
The security monitoring apparatus according to claim 7, wherein the countermeasure is executed by another device other than the terminal device. In a security monitoring method for managing a system including at least one terminal device,
When the management program sets a security policy for each terminal device, the security policy is divided into setting items set as items of the security policy and non-setting items not set as items of the security policy. Administrative steps to manage,
A collection step in which a collection program monitors occurrence of a cause event that may cause a threat to the non-setting item in each terminal device, and collects information related to the occurrence of the cause event;
A non-target policy monitoring program includes a non-target policy monitoring step of evaluating a change in the cause event based on information on the cause event and performing a specific output when the change in the cause event is equal to or greater than a reference. A security monitoring method characterized by the above. The collection program is
The security monitoring method according to claim 9, wherein an operation log corresponding to an operation by a user from each of the terminal devices and configuration information regarding a configuration of each of the terminal devices are acquired. The excluded policy monitoring program is
As an evaluation of whether or not the change in the cause event is greater than or equal to a reference, the occurrence probability of the cause event related to the non-set item is calculated, and the occurrence of the threat calculated based on the occurrence probability of the cause event related to the non-set item Calculate the probability,
The specific output is performed when a difference in change with time of the calculated value is larger than a specific value, or when the calculated value is a predetermined threshold or more. 10. The security monitoring method according to 10. The excluded policy monitoring program is
The security monitoring method according to claim 11, wherein the threat occurrence probability is calculated using a logical product or a combination of logical sums of one or more cause event occurrence probabilities. The excluded policy monitoring program is
A specific causal event having a large change in the probability of occurrence among the above-mentioned events that may be the cause;
The security monitoring method according to claim 12, wherein a countermeasure for reducing the probability of occurrence of the specific cause event is output as the specific output. The excluded policy monitoring program is:
The security monitoring apparatus according to claim 13, wherein the security policy is automatically changed for an item in which a change in the occurrence probability of the cause event is larger than a specified value among the non-set items. The security monitoring method according to claim 15, wherein the countermeasure execution module performs the output countermeasure on the terminal device in which the cause event may occur. The countermeasure implementation module is
The security measure method according to claim 15, wherein the countermeasure is executed by another device other than the terminal device. When each security policy is applied to at least one terminal device, the security policy is divided into setting items set as the security policy items and non-setting items not set as the security policy items. A management program to
A collection program for monitoring the occurrence of a causal event that may cause a threat for the non-setting items in each of the terminal devices, and collecting information relating to the occurrence of the causal event;
A computer that executes a non-target policy monitoring program that evaluates a change in the cause event based on information on the cause event and performs a specific output when the change in the cause event is equal to or greater than a reference. Security monitoring program. In a security monitoring method in a system including at least one terminal device,
The monitoring module monitors the occurrence of causal events that can cause security threats,
The calculation module calculates the occurrence probability, calculates the occurrence probability of the affected threat based on the occurrence probability of the cause event,
A security monitoring method, wherein the evaluation module evaluates a change of the calculated value over time, and performs a specific output when the change is equal to or greater than a reference value.

Images