JP4254988B2 - Security diagnostic system and security diagnostic method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a technique for diagnosing a security weakness of a computer connected to a network. In particular, the present invention relates to a technology for diagnosing weaknesses in security of computers connected to the Internet and an intranet.
[0002]
[Prior art]
According to the document Unix Review's PERFORMANCE COMPUTING, April 1999 VOL.17 NO.4, pp60-61, "NETWORK SECURITY" , SATA (the Security Administrator's Tool for Analyzing Networks) is introduced. Also, according to the document Data Communications International, November 1998 Vol.27 No.16, pp108, "Hackershield for Windows NT", a security diagnostic tool for finding security weaknesses in Windows NT computers is introduced.
[0003]
These security diagnostic tools apply diagnostics to Web servers, DNS servers, routers, firewalls, etc. connected to the network. After conducting hundreds of types of inspection items, such as checking for security holes and checking for incomplete settings. , Output a result report including enumeration of discovered problems, risk from the perspective of impact, security countermeasure information, etc.
[0004]
Security managers and security consulting workers use these security diagnostic tools to grasp the security weaknesses of the computers to be inspected from the result reports that are output from the tools, and to apply security such as applying patches. Consider implementing measures. In addition, in order to verify security measures, security managers conduct security measures again after taking measures against problems that have been discovered once, and check whether the problems have been corrected.
[0005]
[Problems to be solved by the invention]
According to the two documents listed above, the security diagnostic tool of the prior art has only a function to output a result report regarding only the diagnosis immediately after performing the diagnosis, and security measures to be taken after the security diagnosis are not yet implemented. It was not possible to analyze the time series change of the security diagnosis result that grasps whether it is left or completed. The security administrator had to manually perform the task of grasping the difference between the previous inspection range and the current inspection range, or grasping the difference between the previous inspection result and the current inspection result.
[0006]
An object of the present invention is to perform security diagnosis continuously and automatically analyze a time-series change of the diagnosis result.
[0007]
[Means for Solving the Problems]
In order to solve the above problems, in the present invention,
In the security diagnostic system that checks the security weaknesses of computers,
A scheduling means for providing a plurality of timings for performing the inspection;
An inspection unit for performing an inspection of a weak point in security of each computer at a plurality of timings given from the schedule unit;
Analyzing means for analyzing, in a time series, the transition of the inspection result accompanying the transition of the inspection time, with respect to the inspection results at a plurality of timings carried out by the inspection means;
Interface means for displaying an analysis result by the analysis means;
And a security diagnosis system characterized by continuously performing security diagnosis.
[0008]
In the present invention,
A sequence unit for designating a processing operation per test, a parameter unit for designating transmission data to the computer corresponding to the sequence unit, and a filter unit for designating a method for confirming whether there is a problem in the computer Storage means for storing at least one inspection data can be provided.
[0009]
Then, the inspection unit transmits the transmission data specified by the parameter unit to the computer in accordance with the processing operation specified by the sequence unit based on the inspection data, and a response from the computer The data can be inspected by confirming whether or not there is a problem by the confirmation method specified by the filter unit.
[0010]
Thus, a security diagnosis system is configured in which inspection data suitable for the environment of the computer can be easily customized.
[0011]
Furthermore, in the present invention,
A storage means for storing an inspection tool including inspection contents common to a plurality of computers is provided.
An inspection tool executing means for executing the inspection tool and inspecting the computer for a security weak point;
A conversion means for converting the result of the inspection by the inspection tool execution means into a format that can be analyzed by the analysis means;
The analysis means can also analyze the inspection result in the format converted by the conversion means.
[0012]
As a result, a security diagnosis system characterized in that comprehensive and systematic security diagnosis can be implemented.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail.
[0014]
FIG. 1 is a schematic block diagram of a security diagnosis system to which the first embodiment of the present invention is applied. The security diagnosis system 201 includes a CPU 11, a memory 12, an external storage device 13 such as a hard disk, a communication device 14 connected to a network, an input device 15 such as a keyboard and a mouse, a display device 16 such as a display, It can be constructed on an electronic computer including a reading device 17 that reads data from a portable storage medium such as an FD and a bus 18 that controls data transmission / reception between the above-described components.
[0015]
Here, the external storage device 13 stores a schedule program 121, an inspection engine program 122, an analysis engine program 123, and an interface program 124 for constructing the security diagnosis system 201 on an electronic computer. By executing the schedule program 121 loaded on the memory 12 by the CPU 11, the process of the schedule control 111 for starting the inspection engine program 122 periodically and at the timing requested by the operator is realized. In addition, the CPU 11 executes the inspection engine program 122 loaded on the memory 12 to search the inspection item database 132 in which a plurality of inspection items are stored, perform security diagnosis via the network through the communication device 14, and The process of the inspection engine control 112 for outputting the diagnosis result to the result storage database 133 is realized. In addition, the CPU 11 executes the analysis engine program 123 loaded on the memory 12, thereby processing the data stored in the result storage database 133, searching the countermeasure information database 134 for necessary data, and controlling the interface. The process of the analysis engine control 113 for outputting the result to the display device 16 through 114 is realized. In addition, the CPU 11 executes the interface program 124 loaded on the memory 12 to display the input interface on the display device 16, accept the operator's input from the input device 15, and input the operator to the setting information database 131. The interface control 114 process for saving the contents is realized.
[0016]
FIG. 2 is a diagram showing the relationship between the security diagnosis system according to the present invention and the network connection of the computer to be inspected. The security diagnosis system 201 constructed as described above is connected via a network 202 to a plurality of electronic computers 203 to be inspected for finding weak points in security. The inspection target 203 is a Web server, DNS server, router, firewall, or the like. The network 202 is a network constructed using the TCP / IP protocol such as the Internet or a LAN (Local Area Network).
[0017]
In FIG. 1, the database and the program constructed on the external storage device 13 can be distributed as a single package as software.
[0018]
In FIG. 2, the security diagnosis system 201 can also be constructed on the computer of the inspection target 203 itself. Hereinafter, a case where the security diagnosis system 201 and the inspection target 203 are different computers will be described.
[0019]
3 and 4 show an example of a database used in the security diagnostic system.
[0020]
FIG. 3 shows an inspection item database 132 in which information on inspection items for examining security weaknesses used in security diagnosis is stored. A column 301 stores an inspection ID for uniquely identifying an inspection item. The column 302 stores the description of the inspection content such as the purpose of performing the inspection item, the description of the inspection content, and the description of the security weakness discovered by this inspection, corresponding to the inspection ID in the same row. In column 303, inspection data corresponding to the inspection ID of the same row and transferred to the inspection engine control 112 and storing data necessary for inspection and arguments are stored. A column 304 stores a memo corresponding to the inspection ID in the same row, such as the date when the corresponding inspection item was created, the copyright information of the creator, information about the information source, and the related inspection ID.
[0021]
In FIG. 3, in the present embodiment, an inspection item database is constructed by describing the above data using one text file for each inspection ID. In this case, the examination ID 311 is used as the name of the text file, and the contents of the file are divided into individual fields delimited by labels surrounded by “[” and “]”, the examination description 312, the examination data 313, and the memo column 314. Is described respectively. This text file is called an inspection item file 310.
[0022]
FIG. 4 shows a countermeasure information database 134 in which information on countermeasures against security weak points discovered as a result of security diagnosis is stored. A column 401 stores a countermeasure ID for uniquely identifying the countermeasure information. A column 402 stores an inspection ID 301 corresponding to the countermeasure ID in the same row for identifying an inspection item that finds a security weak point in the inspection target. For example, if the countermeasure information corresponding to the examination ID “TEST1” is given by the countermeasure ID “INFO1”, “TEST1” is described in this column. Here, if necessary, a plurality of examination IDs may be stored. A column 403 stores a security countermeasure method to be executed when a security weakness corresponding to the countermeasure ID in the same row is found. The column 404 stores the date when the corresponding countermeasure information corresponding to the countermeasure ID in the same row is created, the copyright information of the creator, information about the information source, the associated countermeasure ID, and the like.
[0023]
In FIG. 4, in the present embodiment, a countermeasure information database is constructed by describing the above data using one text file for each countermeasure ID. In this case, the countermeasure ID 411 is the name of the text file, and the contents of the file include the corresponding inspection ID 412, countermeasure method 413, and memo column 414 in each field separated by a label surrounded by “[” and “]”. Describe each. This text file is called a countermeasure information file 410.
[0024]
The inspection item database 132 and the countermeasure information database 134 are used to display the security weaknesses and countermeasures newly announced by the CERT (Computer Emergency Response Team) etc. through the operation screen displayed on the display device 16 by the interface control 114 or the normal Using a text editor, the operator adds a text file in the format of the inspection item file 310 and the countermeasure information file 410, and the update is performed as appropriate.
[0025]
Next, the operation of the security diagnostic system having the above configuration will be described.
[0026]
5, FIG. 8, FIG. 9, and FIG. 13 are flowcharts for explaining the operation of the security diagnosis system.
[0027]
First, FIG. 5 is a flowchart for explaining the outline of the entire processing procedure of the security diagnosis system. In FIG. 5, the processing procedure of the entire system includes step 501 for registering information on the computer 203 to be inspected by the security diagnostic system 201, step 502 for the schedule control 111 to issue a continuous activation trigger, and inspection engine control. Step 503 in which 112 performs security diagnosis on the inspection target via the network and step 504 in which analysis engine control 113 performs analysis processing in accordance with past diagnosis results are executed in order, and a start trigger is issued again according to the schedule. This is realized by returning to step 502. Hereinafter, the processing operation of each step will be described.
[0028]
In step 501, the interface control 114 displays an input interface screen for registering an inspection object on the display device 16.
[0029]
A GUI (Graphical User Interface) shown in FIG. 6 is an embodiment of an input interface, and is mainly composed of three fields.
[0030]
(1) Designation of multiple inspection targets
As shown in FIG. 2, since the security diagnosis system 201 can diagnose a plurality of computers 203 connected to the network, this field provides an input box that provides a means for specifying one IP address or host name. 601, a button 602 for providing a means for adding the designated IP address or the like to the inspection target, a button 603 for providing a means for deleting the designated IP address or the like from the inspection target, and a currently registered IP address, etc. It comprises a display portion 604 that provides a means for displaying a list.
[0031]
(2) Specify inspection interval
It comprises a selection box 605 for designating an inspection interval for periodically performing security diagnosis.
[0032]
(3) Real-time inspection designation
In addition to the inspection interval (2), the button 606 can be used by an operator to request the execution of security diagnosis at an arbitrary timing. In addition, a button 607 for changing to a screen for specifying a setting parameter necessary for security diagnosis, which changes for each inspection target, is also included in the GUI.
[0033]
In FIG. 6, the IP address or host name designated by the operator in the input box 601 is resolved by the interface control 114 at the timing when the add button 602 is pressed, and is uniformly displayed as the IP address. 604 is displayed. In FIG. 6, information on the IP address to be inspected and the inspection interval input by the operator using the GUI is stored in the setting information database 131 by the interface control 114.
[0034]
FIG. 7 shows a configuration diagram of the setting information database 131. In the setting information database 131, there are a plurality of items in which the information to be inspected and the information on the inspection interval input by the operator through the GUI shown in FIG. 6 are described in a character string “(key) = (value)” per line. Store in lined text file format. For example, in FIG. 7, the information to be inspected is stored over a plurality of lines in the format “IPADDRESS = (IP address to be inspected)”. In addition, the inspection interval information is stored in a format of “INTERVAL = (specific character string)”. As a specific character string, “1perday” (once a day), “1perweek” (once a week), “1permonth” (once a month) or the like is set and stored.
[0035]
In step 502, the process for calling the inspection engine control 112 is executed by the schedule control 111 along the flowchart shown in FIG.
[0036]
In FIG. 8, when the button 606 in FIG. 6 is first pressed (step 701), the schedule control 111 immediately executes the inspection engine control 112 to execute the real-time inspection (step 706). If the selection box in FIG. 6 is designated, the schedule control 111 changes the inspection interval to the designated interval, stores the interval in the setting information database 131 (step 703), and if not, schedule control is performed. 111 designates a specified interval based on an inspection interval prepared by default (step 704). Thereafter, the schedule control 111 activates the inspection engine control 112 when the current time reaches the specified interval in the above (step 706). With the above processing operation, the security diagnosis can be performed automatically, continuously, and periodically, and further, the security diagnosis can be performed at an arbitrary timing requested by the operator.
[0037]
Note that Unix cron may be used as a program for realizing that the current time reaches the specified interval.
[0038]
In step 503, the security diagnosis process for the inspection target 203 is executed by the inspection engine control 112 according to the flowchart shown in FIG.
[0039]
In FIG. 9, the inspection engine control 112 starts to start after step 502 in FIG. 5 ends (step 801). First, the inspection engine control 112 searches the setting information database 131 and acquires all IP address information to be inspected (step 802). Next, the inspection engine control 112 searches the inspection item database 132 and reads the inspection item file 310 (step 803). Based on the information of the inspection data 313 in the inspection item file 310, whether there is a problem with the inspection object 203 or not. (Step 804). This operation is performed until all inspection items are completed (step 805) and diagnosis is completed for all inspection objects (step 806). These diagnosis results are stored in the result storage database 133 (step 807).
[0040]
FIG. 10 shows a more specific explanatory diagram regarding step 804 of the security diagnosis processing described above. Step 804 of performing security diagnosis on the inspection object 203 is realized by combining the following processing in the inspection engine program 122.
[0041]
(1) Interpreter processing 901
This processing includes a sequence unit 921 that specifies processing operations, a parameter unit 922 that specifies transmission data, and a filter unit 923 that specifies a method for determining whether there is a problem from the inspection item file 310 extracted in step 803. The part describing the inspection data 313 is read (process 911) and converted into data for internal processing for security diagnosis.
[0042]
Here, an example of inspection contents of the inspection data 313 shown in FIG. 10 will be described. An example of the inspection content of the inspection data 313 is to confirm whether or not the intruder can acquire the netmask information of the network used at the time of intrusion. The sequence unit 921 designates the entire schedule related to the inspection. In an example of the inspection data 313, first, packet 1 is transmitted, and then packet 2 that matches filter 2 is received. Also, a print display for confirming packet transmission / reception is performed. The parameter unit 922 specifies the content of the packet to be transmitted. In the example of the inspection data 313, an ICMP netmask request in which the transmission source IP address 192.168.0.1 is set is transmitted to the destination IP address 192.168.0.2. The filter unit 923 specifies the content of a packet to be received from the network. In the example of the inspection data 313, an ICMP net mask reply packet is received. The inspection data 313 is described in a unique language described in a format that can be interpreted by the inspection engine program 122.
[0043]
FIG. 11 shows a configuration diagram when the interpreter process 901 of the inspection engine control 112 in FIG. 10 converts the inspection data 313 into internal processing data. In the interpreter process 901, the inspection data 313 is read, from the information of the sequence unit 921 in which the inspection schedule is specified, the parameter unit 922 in which the content of the transmission packet is specified, and the filter unit 923 in which the content of the received packet is specified The transmission packet content 3001 and the reception packet content 3002 are stored in the memory 12. For example, when a transmission packet is viewed, information “ICMP” is set in the upper protocol area of the IP header from information “ip_p = ICMP”.
[0044]
(2) Diagnosis processing 902
In this processing, based on the internal processing data from the processing (1), the operation described in the sequence unit 921 for the inspection target 203 is transmitted through the communication device 14 along the parameter unit 922 via the network. Then, the response data from the inspection object 203 is analyzed along the filter unit 923 to determine whether there is a problem on the inspection object 203 side.
[0045]
That is, the inspection engine control 112 transmits the content of the content 3001 of the transmission packet to the network through the communication device 14. Further, the inspection engine control 112 receives a packet that matches the content 3002 of the received packet from the network through the communication device 14.
[0046]
A specific diagnosis example is shown based on FIG. The diagnosis determines that there is a problem when the communication device 14 receives a packet that matches filter2. The diagnosis determines that there is no problem when the packet received by the communication device 14 does not match the filter 2. In other words, in FIG. 11, when the packet 3001 of the ICMP net mask request is sent to the inspection target to the network, it is determined that there is a problem when the communication device 14 receives the packet 3002 of the ICMP net mask reply from the inspection target. .
[0047]
(3) Shaping process 903
In this process, the diagnosis result from the process (2) is stored in a single text file with the combination of the IP address information and time stamp information to be inspected as the file name, and the inspection result corresponding to the address information and time stamp information. Output sequentially.
[0048]
FIG. 12 shows an example of the output format in step 807. In Fig. 12, the output format is a pair of time stamp information indicating the date and time of diagnosis and the inspection target, and the pair is the name of one text file, and the contents of the file include all the inspections of the corresponding group. It is in the form of a text file group in which diagnosis results for items are recorded. This text file is called a result storage file. For example, in FIG. 12, TS1, TS2, and TS3 indicated by 1001 represent time stamp information, specifically 20000701 (July 1, 2000), etc., and WEB1 and WEB2 are IP addresses to be inspected, specifically 192.168. Represents .1.1 etc., and the expression of the pair is “20000701_192.168.1.1” connected with an underscore, and becomes the file name. The contents of this text file are separated by a blank, and the inspection ID 301 of the inspection item performed and “○” if there is no problem, and “×” if there is a problem form one line. The inspection results are arranged in the column direction over the entire inspection ID 301.
[0049]
In step 504, the analysis processing of the inspection result is executed by the analysis engine control 113 along the flowchart shown in FIG.
[0050]
In FIG. 13, the analysis engine control 113 is started to be executed as a process on the CPU 11 after step 503 in FIG. 5 ends (step 1101). Next, the analysis engine control 113 accesses the setting information database 131 and acquires the IP address information to be inspected (step 1102). For one of the acquired IP addresses, all the result storage files related to the inspection target corresponding to the IP address are extracted from the result storage database 134 (step 1103), and the time series change matrix is stored in memory based on the extracted inspection results. 12 is created (step 1104). An example of this time series change matrix is shown in FIG. The time-series change matrix 1201 in FIG. 14 has the examination ID 301 as a row and the time-stamped time stamp information 1202 as a column, and each element of the matrix is recorded in the result storage database 133 shown in FIG. Each inspection result is set. If the inspection result is not found in the result storage database 134, “-” is set as an element. Next, the analysis engine control 113 performs processing such as the following calculation based on the created time series change matrix 1201 (step 1105).
[0051]
(1) Row direction processing
For example, when looking at the test ID “TEST1” 1205, the processing along the row direction of the time-series change matrix 1201 is performed. From the first and last time stamps TS1 and TS2 in which the test result is “x”, Calculates the countermeasure non-implementation period RT1 indicating that the security countermeasure has not been implemented by RT1 = TS2-TS1. The same calculation process is performed for other inspection IDs, and the countermeasure non-implementation period 1203 is stored in the memory 12.
[0052]
(2) Column direction processing
The number of “x” marks in the same column direction for all time stamps is counted, and the number of unimplemented measures 1204 indicating the number of problems found as a result is stored in the memory 12.
[0053]
(3) Correlation with database
For example, when the examination ID “TEST1” 1205 is viewed, the examination item database 132 is searched to find the examination item file 310 having “TEST1” as the examination ID, and is associated with the examination content description 312 in the file 1206. I do. Further, the countermeasure information database 134 is searched to find the countermeasure information file 410 having “TEST1” as the corresponding examination ID, and the association 1207 with the countermeasure method 413 in the file is performed. These correspondences are stored in the memory 12.
[0054]
After performing the above processing, the analysis engine control 113 outputs a countermeasure report related to one inspection target to the display device 16 (step 1106), and thereafter performs the same processing for all the inspection targets (step 1107).
[0055]
An example of the countermeasure report is shown in FIGS.
[0056]
FIG. 15 is an example of a countermeasure report regarding the latest results. The operator can transition to the screen shown in FIG. 16 or FIG. 17 by selecting the tag 1301. In FIG. 15, the operator has the item number 1302 indicating the order of the problems found as a result of the latest security diagnosis performed on the inspection target Web server 1, and the correspondence 1206 with the inspection ID of the problem. Description 1303 of the problem that has been made, countermeasure method 1305 in which 1207 is associated with the inspection ID of the problem, countermeasure 1203 that is the result 1203 of the result of the row-direction calculation on the time series change matrix 1201 regarding the inspection ID of the problem A list listing the implementation period 1306 can be seen. Further, in the association 1207 between the inspection ID and the countermeasure method, when one countermeasure method corresponds to a plurality of inspection IDs, the related countermeasure methods are duplicated as shown by an arrow 1304 in FIG. The points are displayed in a grouped form. Through this screen, the operator can grasp the security problem, the countermeasure method associated with the problem, and the period during which the countermeasure has not been implemented.
[0057]
FIG. 16 is an example of a countermeasure report regarding the progress of security countermeasures. By selecting the tag 1401, the operator can see the time series change 1404 output based on the elements of the time series change matrix 1201 of the found problem 1403. In addition, the discovered problems may be colored in the time series change 1404 according to the degree of influence, and the operator can grasp the time series change of the security countermeasure status through this screen. it can.
[0058]
FIG. 17 is a transition graph regarding the number of security measures that have not been taken. By selecting the tag 1501, the operator selects the number of measures not taken as a result 1204 of the column direction calculation on the time series change matrix 1201 where the vertical axis 1502 represents the number of measures not taken and the horizontal axis 1503 represents the time axis. You can see a bar graph. Through this screen, the operator can grasp the progress of security measures and the remaining number.
[0059]
Furthermore, based on the data regarding these time-series changes, the analysis engine control 113 lists problems that have not been implemented for a period exceeding a certain threshold in the display device 16. It is also possible to output or notify the security administrator using means such as electronic mail.
[0060]
Further, the analysis engine control 113 outputs, to the display device 16, the content that confirms that the security measures have been completed when there is no problem in the subsequent diagnosis where the portion diagnosed once has a problem. It is also possible. Through this screen, the operator can confirm the completion of security measures.
[0061]
Using the above operations, the security diagnosis system 201 continuously performs follow-up of the security diagnosis to the computer 203 to be inspected, and the security administrator and the security consulting worker perform the inspection only once at the beginning. By simply registering the target, it is possible to continuously obtain FIGS. 15 to 17 of these countermeasure reports and easily grasp the progress of the security countermeasures. This achieves the object of the present invention.
[0062]
Furthermore, the operator grasps the time-series change of the diagnosis result, and about the items that should be enhanced the examination, through the database operation screen displayed on the display device 16 by the interface control 114 or using a normal text editor, Applicable fields such as the inspection data 313 of the inspection item file 310 can be added or edited. In addition, by adding or editing the corresponding fields such as the countermeasure method 413 of the countermeasure information file 410 required according to the inspection target that changes due to version upgrade, etc., the operator can have the inspection know-how appropriate for the target environment. Can be accumulated. This facilitates customization of the inspection items, configures inspection items suitable for the target environment, and enables efficient feedback from the inspection results.
[0063]
As a second embodiment of the present invention, in the security diagnosis system shown in FIG. 1, in place of the inspection item database 132 and the inspection engine program 122, existing commercial tools or free tools other than those described in the first embodiment are used. A case where software is used will be described. A configuration diagram in this case is shown in FIG. The schedule program 121 activates the other inspection tool 1601. The output result of the other inspection tool 1601 is converted into a format that can be processed by the analysis engine program 123 by providing the conversion adapter 1602. For example, when the output format of the inspection tool is an HTML file, the conversion adapter 1602 collects information on the diagnosis result from the content of the HTML file, and converts it into the result storage file format of FIG. 12 that can be processed by the analysis engine program 123. . The analysis engine control 113 analyzes time-series changes related to the inspection items by other inspection tools based on a plurality of diagnosis results passed through the conversion adapter.
[0064]
According to this embodiment, the operator can use the already obtained inspection tool or the already used inspection tool to realize continuous security diagnosis and automation of time series analysis according to the present invention. Yes, the object of the present invention can be achieved.
[0065]
Next, details of the second embodiment of the present invention will be described.
[0066]
The conversion adapter 1602 converts the output result file 2101 of the other inspection tool 1601 into a result storage file 1001 that is consistent with the result storage database 133, as shown in FIG.
[0067]
FIG. 20 shows an operation flowchart of the conversion adapter 1602.
[0068]
First, if there is an inspection item list file of the other inspection tool 1601, the conversion adapter 1602 associates the inspection item list file with the inspection item database 132 (step 2001, step 2002). Here, for the inspection item file whose association is confirmed, “O” is associated with the inspection ID and stored in the memory 12 (step 2003).
[0069]
Next, the output result file 2101 after the inspection by the other inspection tool 1601 is associated with the inspection item database 132 (step 2004). Here, for the inspection item file whose association has been confirmed, “×” is associated with the inspection ID and stored in the memory 12 (step 2005). When the above processing is completed, the examination ID and “O” and “X” stored in the memory 12 are output to the result saving file 1001 (step 2006).
[0070]
Next, the association in step 2002 and the association in step 2004 will be described in detail.
[0071]
First, as shown in FIG. 21, a “keyword” column in which words related to the inspection contents are collected is added to the inspection item file 310.
[0072]
FIG. 22 is a flowchart showing an operation when the association in step 2002 and the association in step 2004 are performed.
[0073]
In the flowchart of FIG. 22, first, titles and explanations are extracted from the format of the input file (step 2201). Here, “input file” refers to “list of inspection items of other inspection tool 1601” in step 2002, and “output result file 2101 of other inspection tool 1601” in step 2004.
[0074]
Next, pattern matching is performed between the title and description and the character string in the keyword column of the inspection item file 310 in the inspection item database 132, the number of matching keywords is counted, and stored in the memory 12 (step 2202).
[0075]
Next, it is determined that the inspection ID of the inspection item file 310 having the largest number of matched keywords can be associated, and the inspection ID is stored in the memory 12 (step 2203).
[0076]
Here, a specific example of the association in step 2002 is shown in FIG. FIG. 23 shows a case where the inspection item list of the other inspection tool 1601 is an HTML file 3101. In the inspection item list file 3101 of the other inspection tool 1601 in FIG. 23, the keyword of the inspection item file with the inspection ID “TEST3” matches most with the second inspection item. In this case, it is determined that the inspection ID “TEST3” can be handled for the second inspection item in the inspection item list file 3101 of the other inspection tool 1601, and “○” is assigned to the inspection ID “TEST3”. Make it correspond. Note that, as a result of such association, it may be possible to correspond to a plurality of examination IDs. In addition, if it does not match any of the inspection item files, the display device 16 displays that the association could not be performed.
[0077]
Next, a specific example of the association in step 2004 is shown in FIG. In FIG. 24, the keyword of the inspection item file with the inspection ID “TEST3” most closely matches the second problem of the output result file 2301 of the other inspection tool 1601. In this case, it is determined that the inspection ID “TEST3” has been able to cope with the second problem in the output result file 2301 of the other inspection tool 1601, and “×” is associated with the inspection ID “TEST3”. Note that, as a result of such association, it may be possible to correspond to a plurality of examination IDs. In addition, if it does not match any of the inspection item files, the display device 16 displays that the association could not be performed.
[0078]
As a third embodiment of the present invention, in the security diagnosis system shown in FIG. 1, in combination with the inspection item database 132 and the inspection engine program 122, existing commercial tools and free tools other than those described in the first embodiment are used. A case where software is used will be described. A configuration diagram in this case is shown in FIG. The schedule program 121 activates the other inspection tool 1601 together with the inspection engine program 122 described in the embodiment shown in FIG. The output result of the other inspection tool 1601 is converted into a format that can be processed by the analysis engine program 123 via the conversion adapter 1602 described in the second embodiment. The analysis engine control 113 analyzes time series changes regarding the inspection items by other inspection tools together with the inspection items by the inspection item database 132 shown in FIG.
[0079]
According to this embodiment, the operator has a diagnostic system having a feature that performs individual diagnostic items corresponding to the target environment shown in FIG. 1 and a feature that performs common diagnostic items for a general target environment. By combining with an inspection tool having, a more comprehensive and systematic security diagnosis can be performed on the inspection object.
[0080]
Next, details of the third embodiment of the present invention will be described.
[0081]
First, the operation in the third embodiment of the present invention will be described using the flowchart shown in FIG.
[0082]
In FIG. 26, first, the schedule program 121 issues an activation trigger at regular intervals (step 2401), and the other inspection tools 1601 and the inspection engine program 122 are activated at least once (step 2402). First, another inspection tool 1601 is activated to perform a security inspection (step 2403). With respect to the output result after the security check, the conversion adapter 1602 converts the format into a result storage file that is consistent with the result storage database 133 as shown in FIG. 19 (step 2404) and stores it in the result storage database 133. (Step 2405). Thereafter, the analysis engine program 123 analyzes all the result storage files and displays the first report (step 2408).
[0083]
The operator who has seen this display is instructed whether or not the inspection item file 310 in the inspection item database 132 and the countermeasure information file 410 in the countermeasure information database 134 need to be customized, and accepts this instruction (step 2408.5). If customization is not necessary, the process returns to step 2401. When customization is required, the operator customizes the inspection item file 310 in the inspection item database 132 and the countermeasure information file 410 in the countermeasure information database 134. For example, a portion corresponding to the inspection data 313 in FIG. 10 is added or modified, and a portion corresponding to the corresponding inspection ID 402 in FIG. 4 is added or modified (step 2409). Here, when the operator presses the button 606 for executing the real-time inspection shown in FIG. 6, the process returns to step 2402, and the inspection engine program 122 is executed. The inspection engine program 122 performs inspection including the inspection added by the operator (step 2406), and outputs the inspection result to the result storage database 133 as a result storage file 1001 (step 2407). Thereafter, the analysis engine program 123 analyzes the result again and displays a report (step 2408).
[0084]
Next, FIGS. 27 and 28 show an example of the output format in steps 2405 and 2407 in FIG. That is, FIG. 27 shows the format of the result storage file in the third embodiment of the present invention. FIG. 28 shows a configuration diagram of a result storage database according to the third embodiment of the present invention.
[0085]
27 and 28, the output format is a pair of time stamp information indicating the date and time of diagnosis and the IP address information to be inspected, and the pair is the name of one text file, The content is in the form of a text file in which the time stamp and all the diagnostic results for the examination performed on the examination object are recorded. However, in the case where there are already text files in which diagnosis results relating to the same time stamp and the same inspection object are recorded, in step 2405 and step 2407 where the file is output, the revision information is added to the end of the file and output.
[0086]
For example, FIG. 27 is an example of a test result performed by the operator following the procedure shown below.
[0087]
First, the time stamp “TS3” and the inspection target “WEB1” are inspected over the entire inspection items by using another inspection tool 1601 shown in FIG. 25, and a result storage file 2501 is obtained.
[0088]
Next, regarding “TEST2” in which a problem has been found in the inspection, inspections “TEST2.1”, “TEST2.2”, and “TEST2.3” in which the inspection contents are customized by the inspection engine program 122 shown in FIG. To obtain a result storage file 2502.
[0089]
Further, regarding “TEST2.2” in which a problem has been found in the inspection, inspections “TEST2.2.1”, “TEST2.2.2”, “TEST2.2.3” in which the inspection contents are customized by the inspection engine program 122 shown in FIG. To obtain a result saving file 2503.
[0090]
As described above, the present embodiment is characterized in that a part where a security problem is found in the immediately preceding inspection is further inspected and the result is stored in the above-described format.
[0091]
FIG. 28 shows a configuration diagram of a result storage database in which the result storage file 2501, the result storage file 2502, and the result storage file 2503 shown in FIG. 27 are stored. In a circle 2601 in FIG. 28, the result storage file 2501, the result storage file 2502, and the result storage file 2503 have a hierarchical relationship as described above.
[0092]
Thus, the present embodiment is characterized in that a plurality of result storage files having a hierarchical relationship can be stored in the result storage database.
[0093]
Next, FIG. 29 shows a flowchart of an operation in which the analysis engine program 123 analyzes the results step by step. FIG. 30 shows an example of a countermeasure report output by the analysis engine program 123. In FIG. 29, steps 2701 and 2702 are newly added to the operation flowchart of the analysis engine control 113 shown in FIG.
[0094]
First, step 2701 will be described. The analysis engine control 113 groups the result storage files having the same time stamp. If there are multiple inspection results per inspection ID within the grouped range, the result in the latest revision result storage file is used as the inspection result of this time stamp.
[0095]
For example, in the case of the result storage database shown in FIG. 28, the inspection target “WEB1” is subject to the time stamp “TS1” once, “TS2” once, and “TS3” three times. . In particular, the grouping of the result storage files of the time stamp “TS3” is indicated by a circle 2601. In this grouping, the analysis engine control 113 searches the latest revision test result for each test ID and sets it as the test result of “TS3”. As a result, exactly one inspection result of “TS3” corresponds to each inspection ID.
[0096]
Next, step 2702 will be described. Based on the revision information attached to the inspection ID, the analysis engine control 113 determines the relevance between inspections customized by the operator. For example, when focusing on the circled 2601 in FIG. 28, it is determined that “TEST2.2” is derived from “TEST2” and “TEST2.2.1” is derived from “TEST2.2”. The relationship thus determined is visualized and displayed as indicated by an arrow 2802 in FIG.
[0097]
The operator can easily understand the relevance of the inspection customized by the operator by looking at the countermeasure report 2801.
[0098]
As a fourth embodiment of the present invention, in the security diagnosis system shown in FIG. 1, the inspection item database 132 and the countermeasure information database 134 are stored on an external storage device of another computer via the network 202 using the communication device 14. The case of building is described. FIG. 31 shows a configuration diagram in this case. In the embodiment in this case, the plurality of security diagnosis systems 201 use the common databases 132 and 134. The security administrator only needs to update the database at one place when updating the database, and can improve the efficiency of the database update.
[0099]
As a fifth embodiment of the present invention, a case will be described in which, in the security diagnostic system shown in FIG. 1, the interface control 114 is built on the CPU of another computer via the network using the communication device 14. FIG. 32 shows a configuration diagram in this case. In this embodiment, the interface program 124 operates the security diagnostic system 201 via the network 202. The security administrator can remotely operate the security diagnostic system, so that even if the operator does not go to the place where the computer input device 15 for which the diagnostic system is built, the computer input device at the operator's hand can be used. The system can be operated, and the efficiency of system operation can be improved.
[0100]
For example, when the interface control 114 is provided by a Web interface using CGI (Common Gateway Interface), the operator side can remotely operate the diagnostic system according to the present invention only by preparing a Web browser. it can.
[0101]
As described above, according to the present invention, security diagnosis can be continuously performed, and a time-series change in the diagnosis result can be automatically analyzed. Specifically, in the embodiment of the present invention, the diagnosis system continuously performs security diagnosis using the schedule means, analyzes the time series change of the diagnosis results using the analysis means, and reports the countermeasures regarding the latest results. In addition, by presenting a countermeasure report on the progress compared to past results or a transition graph regarding the number of countermeasures not yet implemented using the interface means, the security administrator can check the progress of security countermeasures at a glance, It makes it possible to confirm the maintenance of security. For example, the security administrator can grasp that the inspection item diagnosed as having a problem last time is still a problem, or confirm that security has been secured without any problems in the previous time and this time. In addition, it is possible to verify a countermeasure that a problem was not found this time because there was a problem in the last time but a security countermeasure was taken.
[0102]
Further, according to the present invention, inspection items can be easily customized, inspection items suitable for the target environment can be configured, and efficient feedback from inspection results can be made possible. Specifically, in the embodiment of the present invention, the inspection item file used in the security diagnosis process includes a sequence part for specifying a processing operation, a parameter part for specifying transmission data, and a filter part for specifying a problem presence / absence screening method. Since it is a format that makes it easy for the operator to perform operations such as addition, the operator can efficiently modify inspection items suitable for the target environment or add inspection items required from time-series analysis. It can be performed well and allows the operator to accumulate and learn the know-how of security diagnosis.
[0103]
Further, the present invention covers a combination of a diagnostic tool having a characteristic of performing a common inspection item for a general target environment and an inspection tool having the characteristic of easily customizing the inspection item according to the present invention. And systematic security diagnosis can be implemented. Specifically, in the embodiment of the present invention, the diagnostic system of the present invention having the feature of performing individual diagnostic items according to the target environment, and the feature of performing the common diagnostic items for the environment By combining with other inspection tools using schedule means and processing each diagnosis result uniformly using analysis means, it is possible for security managers to carry out more comprehensive and systematic security diagnosis To.
[0104]
【The invention's effect】
As described above, according to the present invention, security diagnosis can be continuously performed, and time-series changes in the diagnosis result can be automatically analyzed.
[Brief description of the drawings]
FIG. 1 is a schematic block diagram of a security diagnosis system.
FIG. 2 is a network connection diagram of a security diagnosis system and a diagnosis target.
FIG. 3 is a configuration diagram of an inspection item database.
FIG. 4 is a configuration diagram of a countermeasure information database.
FIG. 5 is an operation flowchart that gives an overview of the overall processing procedure;
FIG. 6 is a screen view of an input interface.
FIG. 7 is a data diagram of a setting information database.
FIG. 8 is an operation flowchart of schedule control.
FIG. 9 is an operation flowchart of inspection engine control.
FIG. 10 is a block diagram of security diagnosis processing.
FIG. 11 is a configuration diagram of internal processing data.
FIG. 12 is a configuration diagram of a result storage database.
FIG. 13 is an operation flowchart of analysis engine control.
FIG. 14 is an explanatory diagram illustrating a data table of a time series change matrix.
FIG. 15 is a screen view of a countermeasure report (latest result).
FIG. 16 is a screen view of a countermeasure report (progress status).
FIG. 17 is a screen view of a countermeasure report (transition graph).
FIG. 18 is a block diagram showing a case where another inspection tool is used instead of the inspection program according to the present invention.
FIG. 19 is an explanatory diagram showing a specific example of format conversion by a conversion adapter.
FIG. 20 is an operation flowchart of the conversion adapter.
FIG. 21 is a configuration diagram of an inspection item database.
FIG. 22 is a flowchart for associating with an inspection item database.
FIG. 23 is an explanatory diagram showing a specific example of association with an inspection item database.
FIG. 24 is an explanatory diagram showing a specific example of mapping by a conversion adapter.
FIG. 25 is a block diagram showing a case where another inspection tool is used in combination with the inspection program according to the present invention.
FIG. 26 is a flowchart showing the processing operation of the third embodiment;
FIG. 27 is an explanatory diagram showing a format of a result saving file according to the third embodiment.
FIG. 28 is a configuration diagram of a result storage database according to the third embodiment.
FIG. 29 is an operational flowchart of an analysis engine program according to the third embodiment.
FIG. 30 is an explanatory diagram showing a specific example of a countermeasure report in the third embodiment.
FIG. 31 is a network connection diagram showing a case where an inspection item database and a countermeasure information database are shared.
FIG. 32 is a network connection diagram showing a case where the interface program uses the diagnostic system remotely.
[Explanation of symbols]
11 CPU
111 Schedule control
112 Inspection engine control
113 Analysis engine control
114 Interface control
12 memory
121 Schedule program
122 inspection engine program
123 Analysis engine program
124 Interface program
13 External storage device
131 Setting information database
132 Inspection Item Database
133 Results database
134 Countermeasure information database
14 Communication equipment
15 Input device
16 Display device
17 Reader
18 Bus

Claims (15)

In the security diagnostic system that checks the security weaknesses of computers,
A scheduling means for providing a plurality of timings for performing the inspection;
An inspection unit for performing an inspection of a weak point in security of each computer at a plurality of timings given from the schedule unit;
Analyzing means for analyzing, in a time series, the transition of the inspection result accompanying the transition of the inspection time, with respect to the inspection results at a plurality of timings carried out by the inspection means;
Interface means for displaying an analysis result by the analysis means;
A security diagnostic system characterized by continuously performing security diagnostics. In claim 1,
The analysis means calculates a period during which countermeasures for security weaknesses of the computer discovered by the inspection have not been performed from the inspection times by the plurality of timings,
The said interface means displays the period when the countermeasure about the weak point on the security of the said computer was not implemented, The security diagnostic system characterized by the above-mentioned. In claim 1,
The analysis means calculates a change in the number of security weak points of the computer discovered by the inspection along with the change in the inspection time,
The interface means displays a transition of the number of security weak points of the computer discovered by the inspection, along with the transition of the inspection time. In claim 1,
A sequence unit for designating a processing operation per test, a parameter unit for designating transmission data to the computer corresponding to the sequence unit, and a filter unit for designating a method for confirming whether there is a problem in the computer A storage means for storing at least one inspection data;
The inspection means transmits the transmission data specified by the parameter unit to the computer in accordance with the processing operation specified by the sequence unit based on the inspection data, and sends response data from the computer to the response data. On the other hand, the security diagnosis system is characterized in that the inspection is performed by confirming the presence or absence of a problem by the confirmation method specified by the filter unit, and the inspection data suitable for the environment of the computer can be easily customized. In claim 1, there are a plurality of computers to be inspected,
Storage means for storing an inspection tool including inspection contents to be executed for each of the plurality of computers;
In place of the inspection means, the inspection tool execution means for executing the inspection tool to inspect the computer for security weaknesses,
A conversion means for converting the result of the inspection by the inspection tool execution means into a format that can be analyzed by the analysis means;
The security diagnosis system, wherein the analysis unit analyzes the inspection result in the format converted by the conversion unit. In claim 4, there are a plurality of computers to be inspected,
Storage means for storing an inspection tool including inspection contents to be executed for each of the plurality of computers;
An inspection tool executing means for executing the inspection tool and inspecting the computer for a security weak point;
A conversion means for converting the result of the inspection by the inspection tool execution means into a format that can be analyzed by the analysis means;
The security diagnosis system characterized in that the analysis means also analyzes an inspection result in a format converted by the conversion means. In claim 1,
Storage means for storing countermeasure information data in which the inspection item of the inspection is associated with a countermeasure method when there is a problem in the inspection of the inspection item,
The analysis means acquires a countermeasure method corresponding to an inspection item having a problem in the inspection from the countermeasure information data, and combines the result of analysis in time series as a result of the analysis based on the analysis result. Create a report,
The security diagnostic system, wherein the interface means displays the countermeasure report.   8. The analysis means according to claim 7, wherein when the countermeasure methods corresponding to a plurality of inspection items having a problem in the inspection are the same, the analysis means creates a countermeasure report by combining the overlapping countermeasure methods. Security diagnostic system characterized by In the case of constructing a plurality of security diagnosis systems according to claim 1 via a network,
Inspection item storage means for storing inspection data for performing inspection of security weak points of the computer to be inspected is provided so as to be accessible from the plurality of systems via a network,
The inspection unit of the plurality of systems stores, in the plurality of timings given from the schedule unit of the own system, an inspection of a weak point in terms of security of the computer to be inspected by each system is stored in the inspection item storage unit A security diagnostic system characterized in that the inspection item storage means is efficiently updated by performing the inspection based on inspection data. The system of claim 1, wherein the system comprises:
A receiving means for receiving the timing designation from outside is provided via a network,
The schedule means gives the timing to the inspection means based on the designation of the timing accepted by the acceptance means. The system of claim 1, wherein the system comprises:
An accepting means for accepting designation of a computer to be inspected by the inspecting means from outside is provided via a network.
The security diagnostic system according to claim 1, wherein the inspection unit performs a computer inspection based on the designation received by the reception unit. 5. The system of claim 4, wherein the system is
An editing means for editing the inspection data is provided via a network,
The security diagnosis system, wherein the storage unit stores inspection data edited by the editing unit. In the security diagnosis method that checks the security weakness of the computer by the security diagnosis system ,
The arithmetic unit of the security diagnostic system is
Give multiple timings to perform the inspection,
At each of the given timings, the computer is checked for security weaknesses,
With respect to the results of the inspections conducted at a plurality of timings, the transition of the inspection results accompanying the transition of the inspection time is analyzed in time series
Display the analysis results,
A security diagnosis method characterized by continuously performing security diagnosis. A program for causing a computer to execute a security diagnostic method for inspecting a security weakness of a computer,
The ability to give multiple timings to perform inspections;
A function of performing a security weakness check on each computer at the given timings;
A function of analyzing the results of the inspections performed at a plurality of timings in a time series with respect to the transition of the inspection results accompanying the transition of the inspection time;
A function to display the analysis results;
A program characterized by causing a computer to execute. A computer-readable recording medium recording a program for causing a computer to execute a security diagnosis method for inspecting a computer security weakness,
The program is
The ability to give multiple timings to perform inspections;
A function of performing a security weakness check on each computer at the given timings;
A function of analyzing the results of the inspections performed at a plurality of timings in a time series with respect to the transition of the inspection results accompanying the transition of the inspection time;
A function to display the analysis results;
Is a computer-readable recording medium characterized by causing a computer to execute the above.

Images