KR102202108B1 - System and method to automatically diagnose vulnerabilities in cloud infrastructure assets - Google Patents

Abstract

The present invention relates to a system for automatically diagnosing vulnerabilities in cloud infrastructure assets to reduce time and costs required for information protection and a method thereof. According to one embodiment of the present invention, the method comprises: a first step of allowing a cloud infrastructure asset diagnosis server to provide a remote channel for receiving the type and asset of a cloud infrastructure target and vulnerability diagnosis command to a user terminal; a second step of allowing the user terminal to provide the type and asset of the cloud infrastructure target and the vulnerability diagnosis command of the infrastructure target to the remote channel; a third step of allowing the cloud infrastructure asset diagnosis server to parse and output the diagnosis status and analysis result back data of diagnostic items for which vulnerability of the infrastructure target is diagnosed based on the vulnerability diagnosis command of the infrastructure target in a preset format; and a fourth step of allowing the cloud infrastructure asset diagnosis server to use the parsing data and a report template to process the diagnosis status and analysis result back data into a document file in a form specified by the user terminal and provide the document file to the user terminal.

Description

System and method to automatically diagnose vulnerabilities in cloud infrastructure assets}

The present invention relates to a system and method for automatically diagnosing vulnerabilities of cloud infrastructure assets.

In the existing consulting business, manpower is directly input to perform management diagnosis and technical diagnosis, and report preparation, so there is a problem that manpower cost and time are consumed. In addition, companies are increasingly interested in work automation tools in a situation where the need to reduce the workload of employees at the corporate level, such as the implementation of the 52-hour working week system, is raised. Therefore, when performing the current infrastructure vulnerability diagnosis, the automation tool (script) file to perform tasks more easily is moved to the asset and executed to obtain the result value. It is more convenient than manual diagnosis, but there are still several problems with the current method.

First, since the file must be transferred directly to the asset and executed, there is a risk that an error in the script may occur from the asset manager's point of view, resulting in a problem with the service running on the asset. Also, I don't like to keep installing files like scripts. Personnel who perform vulnerability diagnosis are also sending their scripts to the asset manager by attaching them to an e-mail in order to execute their own scripts on the assets. If the script is opened with an editor, it is possible to read and modify the source code as it is, so there is a possibility that the contents of the source code that can be considered an asset of a consulting company may be leaked or the file itself is leaked and reused. Therefore, there is a need for a way to automatically diagnose vulnerabilities without installing scripts directly.

Second, with the commercialization of cloud technology, the composition of infrastructure assets of companies and public institutions that use information processing systems is gradually changing from the form of physically deployed in existing data centers and in-house server rooms (on-premises method) to cloud-based. In the commercial cloud, the corresponding infrastructure resource can be accessed through a dedicated portal website, and this difference causes a problem that the existing infrastructure diagnosis automation script is not executed on cloud-based assets. It is necessary to study a diagnostic automation tool that can be used by expanding scalability in consideration of the on-premises environment to the cloud environment.

Finally, in the field of development, a development methodology called DevOps has emerged that improves software through rapid release and small, constant iterations to meet the rapid changes of users in the mobile era. Since the software development environment is also changing from the existing on-premises to cloud-based DevOps, rapid development work from the development stage to the deployment stage is performed within the cloud service.

In accordance with the development security, if secure coding and vulnerability checks are automated in small units such as unit tests and deployment, the security of the source code and development environment can be easily increased from the developer's point of view.

It is urgent to research and develop a method for automating vulnerability diagnosis for cloud infrastructure assets for the following reasons.

Unexamined Patent Publication No. 10-2018-0060616

An object of the present invention is to provide a system and method for automatically diagnosing vulnerabilities of cloud infrastructure assets that can solve the conventional problems.

A method for diagnosing a vulnerability of an asset targeting a cloud infrastructure according to an embodiment of the present invention for solving the above problem includes a remote channel for receiving the type and asset of the cloud infrastructure target from the cloud infrastructure asset diagnosis server to a user terminal, and A first step of providing a vulnerability diagnosis command; A second step of setting a diagnosis range and detection level of the cloud infrastructure target in the user terminal, and providing a type of the cloud infrastructure target, an asset, and a vulnerability diagnosis command of the infrastructure target through the remote channel; A third step of generating and parsing the diagnosis status and analysis result back data for the diagnosis items diagnosed with the infrastructure target based on the vulnerability diagnosis command of the infrastructure target in the cloud infrastructure asset diagnosis server; And a fourth step of providing a vulnerability diagnosis result report to the user terminal in a document file of a format designated by the user terminal by using the parsed data and report template in the cloud infrastructure asset diagnosis server. When the fourth step is completed, the source code of the document file is registered and stored, and a fifth step of periodically monitoring whether or not the source code is changed. When a change of the source code is detected, in the changed source code It further includes diagnosing whether secure coding has been applied, and determining whether to record log information on a history of generation, change, movement, or deletion of the changed source code.

In the system for diagnosing the vulnerability of an asset targeting cloud infrastructure according to an embodiment of the present invention to solve the above problem, the type and asset of the cloud infrastructure target are input, and the result of diagnosis on the asset vulnerability of the cloud infrastructure target A user terminal requesting a document file; And a remote channel and a vulnerability diagnosis command for receiving the type and asset of a cloud infrastructure target to the user terminal, and a diagnosis range and detection level of the cloud infrastructure target input from the user terminal, and a vulnerability diagnosis command for the cloud infrastructure target. After parsing the diagnosis status and analysis result back data for the diagnostic item that diagnosed the vulnerability of the infrastructure target in a preset format, the parsed data and report template are used to display the document file in the format designated by the user terminal. It includes a cloud infrastructure asset diagnosis server that processes the diagnosis status and analysis result back data to the user terminal, and the cloud infrastructure asset diagnosis server diagnoses each asset according to the diagnosis items in the cloud infrastructure facility input from the user terminal. A diagnostic reference and command providing unit that provides a reference and diagnostic command; A vulnerability diagnosis unit that generates a diagnosis status and analysis result back data for a diagnosis item that diagnoses an asset vulnerability of a corresponding cloud infrastructure facility based on the diagnosis command input from the user terminal, and provides an analysis result value; A parsing processing unit for generating parsed data by parsing only data to be employed in a vulnerability diagnosis report to be provided to the user terminal among the analysis result values analyzed by the vulnerability diagnosis unit; A report generation unit generating a vulnerability diagnosis report based on the parsed data and report template; And a source code monitoring unit that registers and stores the source code of the vulnerability diagnosis report file generated or extracted by the report generation unit, and periodically monitors whether the source code is changed, and the source code monitoring unit changes the source code. And, when the source code change is detected, diagnosing whether secure coding is applied in the changed source code, and determining whether to record log information on the generation, change, movement, or deletion history of the changed source code. It is characterized.

According to the present invention, there is an advantage of being able to sufficiently replace existing script errors and manual diagnosis tasks by improving the automatic vulnerability diagnosis for cloud infrastructure assets that could not be applied in the existing diagnosis.

In addition, there is an advantage in that it is possible to save time and cost of information security work by making it possible to easily perform cloud infrastructure diagnosis even if you are not an information security expert by using the invented system.

Lastly, it has the advantage of maintaining a very high level of development security without the help of expert personnel by automatically performing customized source diagnosis and development security tasks according to the development and deployment stages according to the DevOps development methodology in the cloud environment.

1 is a network configuration diagram of a system for diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention.
2 is a block diagram showing the detailed configuration of the cloud infrastructure asset diagnosis server shown in FIG.
FIG. 3 is a diagram showing an execution result of the vulnerability diagnosis unit shown in FIG. 2.
4 is a flowchart illustrating a method for diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention.
5 is a flowchart illustrating an additional embodiment of a method for diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention.
6 is a diagram illustrating an exemplary computing environment in which one or more embodiments disclosed herein may be implemented.

Hereinafter, embodiments of the present specification will be described with reference to the accompanying drawings. However, this is not intended to limit the technology described herein to a specific embodiment, it should be understood to include various modifications, equivalents, and/or alternatives of the embodiments herein. . In connection with the description of the drawings, similar reference numerals may be used for similar elements. In the present specification, expressions such as "have," "may have," "include," or "may include" are the presence of corresponding features (eg, elements such as numbers, functions, actions, or parts). And does not exclude the presence of additional features.

In this specification, expressions such as "A or B," "at least one of A or/and B," or "one or more of A or/and B" may include all possible combinations of items listed together. . For example, "A or B," "at least one of A and B," or "at least one of A or B" includes (1) at least one A, (2) at least one B, Or (3) it may refer to all cases including both at least one A and at least one B.

Expressions such as "first," "second," "first," or "second," as used herein may modify various elements regardless of their order and/or importance, and one element It is used to distinguish it from other components and does not limit the components. For example, a first user device and a second user device may represent different user devices regardless of order or importance. For example, without departing from the scope of the rights described in the present specification, a first component may be referred to as a second component, and similarly, a second component may be renamed to a first component.

Some component (eg, a first component) is "(functionally or communicatively) coupled with/to)" to another component (eg, a second component) or " When referred to as "connected to", it should be understood that the certain component may be directly connected to the other component, or may be connected through another component (eg, a third component). On the other hand, when a component (eg, a first component) is referred to as being “directly connected” or “directly connected” to another component (eg, a second component), the component and the It may be understood that no other component (eg, a third component) exists between the different components.

The expression "configured to (configured to)" used in this specification is, for example, "suitable for," "having the capacity to" depending on the situation. ," "designed to," "adapted to," "made to," or "capable of." The term "configured to (or set)" may not necessarily mean only "specifically designed to" in hardware. Instead, in some situations, the expression "a device configured to" may mean that the device "can" along with other devices or parts.

For example, the phrase “a processor configured (or configured) to perform A, B, and C” means a dedicated processor (eg, an embedded processor) for performing the operation, or by executing one or more software programs stored in a memory device. , May mean a generic-purpose processor (eg, a CPU or an application processor) capable of performing corresponding operations.

Terms used in the present specification are only used to describe a specific embodiment, and may not be intended to limit the scope of other embodiments. Singular expressions may include plural expressions unless the context clearly indicates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by a person of ordinary skill in the technical field described herein. Among the terms used in this specification, terms defined in a general dictionary may be interpreted as having the same or similar meaning as the meaning in the context of the related technology, and unless explicitly defined in the present specification, an ideal or excessively formal meaning Is not interpreted as. In some cases, even terms defined herein cannot be interpreted to exclude embodiments of the present specification.

Hereinafter, a system and method for automatically diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention will be described in more detail based on the accompanying drawings.

1 is a network configuration diagram of a system for diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention, and FIG. 2 is a block diagram showing a detailed configuration of a cloud infrastructure asset diagnosis server shown in FIG. 3 is a diagram showing an execution result of the vulnerability diagnosis unit shown in FIG. 1.

As shown in FIG. 1, the system 100 for automatically diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention includes a user terminal 200 and a cloud infrastructure asset diagnosis server 300.

The user terminal 200 may be a terminal that inputs the type and asset of a cloud infrastructure target, and requests a diagnosis result of the inputted cloud infrastructure target asset vulnerability as a document file.

For reference, the infrastructure asset referred to in the present invention refers to an information asset subject to vulnerability diagnosis according to the vulnerability diagnosis criteria.

For example, in the Information and Communication Network Act or the Electronic Financial Supervisory Regulations Act and the information protection management system certification examination items, vulnerability assessment is required for identified information assets. Among them, servers, networks, information protection systems, DBMS, etc. excluding web & mobile applications. The information assets of Korea are collectively referred to as infrastructure assets, and detailed versions for each field are as follows.

1) Server (Unix series, Windows Server series)

2) Network (CISCO, JUNIPER, Alteon, Nortel, Piolink)

3) Information protection system (firewall, IPS, IDS, VPN, etc.)

4) DBMS (Oracle, MsSQL, MySQL, Tibero)

In addition, the user terminal 200 generates a diagnostic criteria for each asset (main information communication infrastructure, electronic financial infrastructure vulnerability analysis and evaluation criteria, etc.) and a vulnerability diagnosis script for each diagnostic criteria from the cloud infrastructure asset diagnosis server 300 to be described later. It may be a terminal that is all provided.

In addition, the user terminal 200 may request access to back data as a result of analysis on the diagnostic item that diagnoses the vulnerability of the cloud infrastructure asset input by the user from the cloud infrastructure asset diagnosis server to be described later.

In addition, the user terminal 200 may be a terminal that sets the diagnosis range and detection level of the cloud infrastructure target.

On the other hand, the user terminal 200 is a smart phone (Smart Phone), a portable terminal (Portable Terminal), a mobile terminal (Mobile Terminal), a foldable terminal (Foldable Terminal), a personal digital assistant (PDA), a PMP (Portable Multimedia Player) terminal, telematics terminal, navigation terminal, personal computer, notebook computer, slate PC, tablet PC, ultrabook, wearable Device (Wearable Device, for example, Smartwatch, Smart Glass, HMD (Head Mounted Display), etc.), Wibro terminal, IPTV (Internet Protocol Television) terminal, Smart TV , Digital broadcasting terminals, AVN (Audio Video Navigation) terminals, A/V (Audio/Video) systems, flexible terminals, digital signage devices, and the like.

The user terminal 200 communicates with an internal component or at least one external terminal (video cam, console operation unit, etc.) through a wired/wireless communication network. Here, as the wireless Internet technology, wireless LAN (WLAN), DLNA (Digital Living Network Alliance), Wibro (Wireless Broadband: Wibro), Wimax (World Interoperability for Microwave Access: Wimax), HSDPA (High Speed Downlink Packet Access) ), High Speed Uplink Packet Access (HSUPA), IEEE 802.16, Long Term Evolution (LTE), Long Term Evolution-Advanced (LTE-A), Wireless Mobile Broadband Service (WMBS), etc. In addition, data is transmitted and received according to at least one wireless Internet technology in a range including Internet technologies not listed above. In addition, short-range communication technologies include Bluetooth, Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wideband (UWB), ZigBee, and Near Field Communication (NFC). , Ultra Sound Communication (USC), Visible Light Communication (VLC), Wi-Fi, Wi-Fi Direct, and the like may be included. In addition, wired communication technologies may include power line communication (PLC), USB communication, Ethernet, serial communication, optical/coaxial cable, and the like.

In addition, the user terminal 200 may mutually transmit information with an arbitrary terminal through a universal serial bus (USB).

In addition, the user terminal 200 includes technical standards or communication methods for mobile communication (for example, GSM (Global System for Mobile communication), CDMA (Code Division Multi Access), CDMA2000 (Code Division Multi Access 2000)), EV -DO (Enhanced Voice-Data Optimized or Enhanced Voice-Data Only), WCDMA (Wideband CDMA), HSDPA (High Speed Downlink Packet Access), HSUPA (High Speed Uplink Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution-Advanced), etc.), transmits and receives wireless signals to and from the base station, the cloud infrastructure asset diagnosis server 300, and the like on the mobile communication network.

Next, the cloud infrastructure asset diagnosis server 300 provides a remote channel and a vulnerability diagnosis command for inputting the type and asset of a cloud infrastructure target to the user terminal 200, and the input from the user terminal 200 After parsing the diagnosis status and analysis result back data for the diagnostic items that diagnosed the vulnerability of the infrastructure target in a preset form based on the vulnerability diagnosis command of the infrastructure target, the parsing data and report template are used to specify the user terminal. It performs a function of processing the diagnosis status and analysis result back data into a document file in a form and providing it to the user terminal.

More specifically, the cloud infrastructure asset diagnosis server 300 includes an input/output unit 310, a channel generation unit 320, an infrastructure selection unit 330, a diagnostic criteria and command providing unit 340, and a vulnerability diagnosis unit ( 350), a parsing processing unit 360, a report generation unit 370, and a source code monitoring unit 380.

The input/output unit 310 may be configured to receive the cloud infrastructure asset information provided by the user terminal 200 and transmit a diagnostic result report for diagnosing the vulnerability of the input cloud infrastructure asset information to the user terminal.

In addition, the input/output unit 310 provides the diagnostic criteria and diagnostic commands transmitted from the diagnostic criteria and command providing unit 340 to the user terminal 200.

The channel generation unit 320 generates a communication channel to remotely transmit a diagnosis command to a diagnosis target among the cloud infrastructure asset facilities when accessing the cloud infrastructure asset facility provided by the user terminal.

The diagnostic criteria and command providing unit 340 provides diagnostic criteria and diagnostic commands for each asset according to diagnostic items in a cloud infrastructure facility input from the user terminal 200.

The vulnerability diagnosis unit 350 diagnoses an asset vulnerability of a corresponding cloud infrastructure facility based on a diagnosis command input from the user terminal 200. More specifically, after analyzing whether the vulnerability diagnosis item is good or weak, the diagnosis status and analysis result back data for the diagnosis item is generated and provided as an analysis result value.

The parsing processing unit 360 parses only data to be employed in the vulnerability diagnosis report to be provided to the user terminal among the analysis result values analyzed by the vulnerability diagnosis unit 350 to generate parsed data. Here, the parsed data is used when extracting a vulnerability diagnosis report to be described later.

The report generation unit 370 generates a vulnerability diagnosis report based on the parsed data and a report template. Here, when generating the vulnerability diagnosis report, it can be modified/supplemented based on the analysis result back data.

The source code monitoring unit 380 may be configured to register and store the source code of the vulnerability diagnosis report file generated (extracted) by the report generation unit 370 and periodically monitor whether the source code is changed.

More specifically, the source code monitoring unit 380 may detect a change of the source code and, when the change of the source code is detected, diagnose whether secure coding is applied in the changed source code.

In addition, when the source code change is detected, it is possible to determine whether to record log information on the generation, change, movement, or deletion history of the changed source code.

4 is a flowchart illustrating a method for automatically diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention, and FIG. 5 is an addition of a method for diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention. It is a flowchart explaining an embodiment.

4 and 5, the method for automatically diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention (S700) is, first, a user terminal 200 in the cloud infrastructure asset diagnosis server 300. As such, it may be a step of providing a remote channel and a vulnerability diagnosis command for receiving the type of cloud infrastructure facility (target) and asset information.

More specifically, in the S710 process, when the cloud-based infrastructure asset information operated by the user terminal 200 is transferred to the cloud infrastructure asset diagnosis server, the cloud infrastructure asset diagnosis server 300 provides diagnosis items and diagnosis of the corresponding infrastructure asset. Deliver diagnostic criteria for each item. Thereafter, when the user terminal 200 transmits the diagnostic items, the cloud infrastructure asset diagnosis server 300 generates a remote diagnosis channel to provide a diagnosis command and a vulnerability diagnosis report for diagnosing the vulnerability of the corresponding infrastructure asset. It may include a series of processes provided by

Thereafter, when the process S710 is completed, the user terminal 200 transmits the diagnostic command desired by the user to the cloud infrastructure asset diagnosis server 300 through a remote diagnosis channel (S720), and the cloud infrastructure asset diagnosis server 300 In the cloud infrastructure asset diagnosis server, based on the vulnerability diagnosis command of the infrastructure target, the diagnosis status and analysis result of the diagnosis item for the diagnosis item and the analysis result back data are generated and parsed, and then parsed data and report template are based. The vulnerability diagnosis result report is generated (S730).

Thereafter, the cloud infrastructure asset diagnosis server 300 provides a vulnerability diagnosis result report to the user terminal (S740).

Meanwhile, referring to FIG. 5, the method for automatically diagnosing a vulnerability of a cloud infrastructure asset according to an embodiment of the present invention (S700) includes registering and storing the source code of the vulnerability diagnosis report after the process S730 is completed, and periodically As such, it may include a process of monitoring whether the source code is changed.

In this case, when the source code change is detected, the process of diagnosing whether secure (security) coding is applied in the changed source code may be further included. When the source code change is detected, the changed source code is generated and changed. , It may further include a process of determining whether to record log information on the movement or deletion history.

On the other hand, the method (S700) for automatically diagnosing the vulnerability of a cloud infrastructure asset according to an embodiment of the present invention is a cloud infrastructure asset based on setting information that sets the diagnosis range and detection level of the cloud infrastructure target in the user terminal. The diagnosis server may further include a process of changing the diagnosis range and the detection range.

Therefore, according to an embodiment of the present invention, by improving the vulnerability diagnosis for cloud infrastructure assets that could not be applied in the existing diagnosis to be automated, it is possible to sufficiently replace the existing script error and manual diagnosis tasks. There is this.

In addition, by using the system disclosed herein, it is possible to easily perform cloud infrastructure diagnosis even if you are not an information security expert, so you can save time and cost of information protection work, and finally, development and distribution according to the DevOps development methodology of the cloud environment. It has the advantage of maintaining a very high level of development security without the help of expert personnel by automatically performing customized source diagnosis and development security tasks according to stages.

6 is a diagram illustrating an exemplary computing environment in which one or more embodiments disclosed herein may be implemented, an illustration of a system 1000 including a computing device 1100 configured to implement one or more embodiments described above. Shows. For example, the computing device 1100 may be a personal computer, a server computer, a handheld or laptop device, a mobile device (mobile phone, PDA, media player, etc.), a multiprocessor system, a consumer electronic device, a mini computer, a mainframe computer, Distributed computing environments including, but not limited to, any of the aforementioned systems or devices.

The computing device 1100 may include at least one processing unit 1110 and a memory 1120. Here, the processing unit 1110 may include, for example, a central processing unit (CPU), a graphic processing unit (GPU), a microprocessor, an application specific integrated circuit (ASIC), Field Programmable Gate Arrays (FPGA), and the like. Can have a plurality of cores. The memory 1120 may be a volatile memory (eg, RAM, etc.), a nonvolatile memory (eg, ROM, flash memory, etc.), or a combination thereof. Further, the computing device 1100 may include an additional storage 1130. Storage 1130 includes, but is not limited to, magnetic storage, optical storage, and the like. The storage 1130 may store computer-readable instructions for implementing one or more embodiments disclosed herein, and other computer-readable instructions for implementing an operating system, an application program, and the like. Computer-readable instructions stored in storage 1130 may be loaded into memory 1120 for execution by processing unit 1110. Further, the computing device 1100 may include an input device(s) 1140 and an output device(s) 1150.

Here, the input device(s) 1140 may include, for example, a keyboard, a mouse, a pen, a voice input device, a touch input device, an infrared camera, a video input device, or any other input device. Further, the output device(s) 1150 may include, for example, one or more displays, speakers, printers or any other output device or the like. Further, the computing device 1100 may use an input device or an output device provided in another computing device as the input device(s) 1140 or the output device(s) 1150.

In addition, computing device 1100 may include communication connection(s) 1160 that enable computing device 1100 to communicate with other devices (eg, computing device 1300 ).

Here, the communication connection(s) 1160 is a modem, a network interface card (NIC), an integrated network interface, a radio frequency transmitter/receiver, an infrared port, a USB connection, or other computing device for connecting the computing device 1100 to another computing device May contain interfaces. Further, the communication connection(s) 1160 may include a wired connection or a wireless connection. Each component of the computing device 1100 described above may be connected by various interconnections such as a bus (eg, peripheral component interconnection (PCI), USB, firmware (IEEE 1394), optical bus structure, etc.). And may be interconnected by network 1200. Terms such as "component" and "system" as used herein generally refer to a computer-related entity that is hardware, a combination of hardware and software, software, or software in execution.

For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program and/or a computer. For example, both the controller and the application running on the controller may be components. One or more components may reside within a process and/or thread of execution, and a component may be localized on one computer or distributed between two or more computers.

Until now, specific embodiments according to the present invention have been described, but, of course, various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be defined by being limited to the described embodiments, and should be defined not only by the claims to be described later, but also by the claims and their equivalents.

As described above, although the present invention has been described by the limited embodiments and drawings, the present invention is not limited to the above embodiments, which is various modifications and variations from these descriptions to those of ordinary skill in the field to which the present invention belongs. Transformation is possible. Accordingly, the idea of the present invention should be grasped only by the scope of the claims set forth below, and all equivalent or equivalent modifications thereof will be said to belong to the scope of the idea of the present invention.

100: system
200: user terminal
300: Cloud infrastructure asset diagnosis server
310: input/output unit
320: channel generation unit
330: infrastructure selection unit
340: diagnostic criteria and command providing unit
350: Vulnerable diagnostic unit
360: parsing processing unit
370: report generation unit
380: source code monitoring unit

Claims (9)

A first step of providing a remote channel and a vulnerability diagnosis command for receiving the type and asset of a cloud infrastructure target from the cloud infrastructure asset diagnosis server to the user terminal;
A second step of setting a diagnosis range and detection level of the cloud infrastructure target in the user terminal, and providing a type of the cloud infrastructure target, an asset, and a vulnerability diagnosis command of the infrastructure target through the remote channel;
A third step of generating and parsing the diagnosis status and analysis result back data for the diagnosis items diagnosed with the infrastructure target based on the vulnerability diagnosis command of the infrastructure target in the cloud infrastructure asset diagnosis server; And
A fourth step of providing a vulnerability diagnosis result report to the user terminal in a document file of a format designated by the user terminal by using the parsed data and report template in the cloud infrastructure asset diagnosis server;
When the fourth step is completed, a fifth step of registering and storing the source code of the document file, and periodically monitoring whether the source code is changed,
When the change of the source code is detected, diagnosing whether secure coding has been applied to the changed source code, and determining whether to record log information on the generation, change, movement, or deletion history of the changed source code. A method for diagnosing vulnerabilities of assets targeted to cloud infrastructure. delete delete delete delete A user terminal for inputting a type and asset of a cloud infrastructure target, and requesting a diagnosis result of the inputted cloud infrastructure target asset vulnerability as a document file; And
Provides a remote channel and a vulnerability diagnosis command for receiving the type and asset of the cloud infrastructure target to the user terminal, and the diagnosis range and detection level of the cloud infrastructure target input from the user terminal, and the vulnerability diagnosis command of the cloud infrastructure target. After parsing the diagnosis status and analysis result back data for the diagnosis item that diagnosed the vulnerability of the infrastructure target in a preset format, the diagnosis is made as a document file in the form designated by the user terminal using the parsed data and report template. It includes a cloud infrastructure asset diagnosis server that processes the status and analysis result back data and provides it to the user terminal,
The cloud infrastructure asset diagnosis server
A diagnostic criteria and command providing unit for providing diagnostic criteria and diagnostic commands for each asset according to diagnostic items in the cloud infrastructure facility input from the user terminal;
A vulnerability diagnosis unit that generates a diagnosis status and analysis result back data for a diagnosis item that diagnoses an asset vulnerability of a corresponding cloud infrastructure facility based on the diagnosis command input from the user terminal, and provides an analysis result value;
A parsing processing unit for generating parsed data by parsing only data to be employed in a vulnerability diagnosis report to be provided to the user terminal among the analysis result values analyzed by the vulnerability diagnosis unit;
A report generation unit generating a vulnerability diagnosis report based on the parsed data and report template; And
A source code monitoring unit that registers and stores the source code of the vulnerability diagnosis report file generated or extracted by the report generation unit, and periodically monitors whether the source code is changed,
The source code monitoring unit
Detects the change of the source code, and if the change of the source code is detected, diagnoses whether secure coding has been applied in the changed source code, and records log information on the history of creation, change, movement, and deletion of the changed source code A system for diagnosing the vulnerability of assets targeting cloud infrastructure to determine whether or not.
delete delete delete

Images