WO2021070216A1

WO2021070216A1 - Vulnerability management equipment, vulnerability management method, and program

Info

Publication number: WO2021070216A1
Application number: PCT/JP2019/039457
Authority: WO
Inventors: 朋治中村; 哲也出村; 齋藤　直樹
Original assignee: 株式会社Pfu
Priority date: 2019-10-07
Filing date: 2019-10-07
Publication date: 2021-04-15
Also published as: JPWO2021070216A1; JP7198991B2

Abstract

Vulnerability management equipment 5 comprises: a configuration information acquisition unit 500 which acquires configuration information about devices connected to a prescribed network; a vulnerability information collection unit 502 which collects vulnerability information indicating applicable security measures; and an assessment unit 506 which assesses the vulnerability of each device connected to the network, on the basis of the configuration information acquired by the configuration information acquisition unit 500 and the vulnerability information collected by the vulnerability information collection unit 502. The vulnerability management equipment 5 further comprises a display unit 508 which indicates the vulnerability of each device using symbols that have sizes corresponding to the results of the assessment by the assessment unit 506.

Description

Vulnerability management equipment, vulnerability management methods, and programs

The present invention relates to a vulnerability management device, a vulnerability management method, and a program.

For example, in Patent Document 1, in an information processing method for processing input information input to an information processing apparatus having a control unit, the control unit acquires danger increase / decrease information, and the danger acquired by the control unit. Whether or not the value based on the input information by the control unit exceeds the first threshold range by correcting the first threshold range stored in the storage unit or the second threshold range stored in the storage unit based on the sex increase / decrease information. When the control unit determines that the first threshold range is exceeded, the control unit determines whether the number of times the determination is exceeded or the time exceeded exceeds the second threshold range, and the control unit determines that the second threshold range is exceeded. An information processing method for outputting abnormal information when it is determined that the threshold range is exceeded is disclosed.

Further, in Patent Document 2, information on a cyber attack detected with respect to a device targeted for a cyber attack is acquired, and an image showing the earth and an image showing the device arranged around the image showing the earth are described. , Image information that is placed between the surface of the image showing the earth and the image showing the device, and includes an image showing the level of the cyber attack detected with respect to the device based on the acquired information on the cyber attack. A display method is disclosed, wherein a computer executes a process of generating the generated image information and outputting the generated image information.

In addition, Non-Patent Document 3 discloses software that integrates proactive prevention and post-response, realizes simple and quick incident response, and integrates and manages the cycle of detection, investigation, and response.

Patent 5691539 JP 2015-216549

The purpose is to provide a vulnerability management device that can visually grasp and manage the risk level of a vulnerability.

The vulnerability management device according to the present invention includes a configuration information acquisition unit that acquires configuration information of a device connected to a predetermined network, an information collection unit that collects vulnerability information indicating applicable security measures, and the above. It has an evaluation unit that evaluates the vulnerability of each device connected to the network based on the configuration information acquired by the configuration information acquisition unit and the vulnerability information collected by the information collection unit.

Preferably, it further has a display unit that displays the vulnerability of each device with a symbol having a size corresponding to the evaluation result by the evaluation unit.

Preferably, the information collecting unit collects information on an applicable patch or update program and information on an updatable virus definition file as the vulnerability information, and the configuration information acquisition unit is a device for each device. The identification information for identifying the patch or update program applied to the device and the information regarding the update of the virus definition file in each device are acquired as the configuration information.

Preferably, the display unit displays a list of evaluation results by the evaluation unit for a plurality of devices connected to the default network.

Preferably, the evaluation unit has an evaluation value calculated based on whether or not an applicable patch or update program has been applied to the device, and whether or not the updateable virus definition file has been updated on the device. The evaluation value of each device is calculated by adding up the evaluation value calculated based on the above, and the display unit switches and displays the evaluation value before and after the total for each device.

Preferably, the display unit superimposes a symbol having a size corresponding to the evaluation result of each device on the floor diagram in which each device is arranged or the network configuration diagram in which each device is connected. To display.

Preferably, the display unit displays the evaluation results of the devices connected to the network in different display modes depending on whether or not the network is connected to the Internet.

Preferably, a plurality of warning lights arranged around the place where the equipment is installed, and a warning installed around the equipment when the evaluation result by the evaluation unit for any of the equipments meets the predetermined conditions. It further has a detection unit for turning on the light.

The vulnerability management method according to the present invention includes a configuration information acquisition step for acquiring the configuration information of a device connected to a predetermined network, an information collection step for collecting vulnerability information indicating applicable security measures, and the above. It has an evaluation step for evaluating the vulnerability of each device connected to the network based on the configuration information acquired by the configuration information acquisition step and the vulnerability information collected by the information collection step.

The program according to the present invention includes a configuration information acquisition step for acquiring configuration information of a device connected to a predetermined network, an information collection step for collecting vulnerability information indicating applicable security measures, and the configuration information acquisition. Based on the configuration information acquired by the step and the vulnerability information collected by the information gathering step, the computer is made to execute an evaluation step for evaluating the vulnerability of each device connected to the network.

It is possible to visually grasp and manage the risk of vulnerability.

It is a figure which illustrates the whole structure of the vulnerability management system 1. It is a figure which illustrates the hardware configuration of the vulnerability management apparatus 5. It is a figure which illustrates the functional structure of the vulnerability management apparatus 5. (A) is a diagram illustrating the vulnerability information stored in the vulnerability information DB 600, (b) is a diagram illustrating the configuration information stored in the configuration information DB 610, and (c) is a diagram illustrating the configuration information stored in the configuration information DB 610. It is a figure which illustrates the configuration information of the software stored in the information DB 610. It is a flowchart explaining the vulnerability visualization process (S10) by the vulnerability management apparatus 5. (A) exemplifies the display method of the evaluation value of the vulnerability origin, (b) exemplifies the display method of the evaluation value of the terminal origin, and (c) exemplifies the display method of the evaluation value of the user origin. To do. (A) is an evaluation value map exemplifying a totaling mode in which the evaluation values for each user terminal 3 are totaled and displayed, and (b) is a "circle" for the number of vulnerabilities and the evaluation value for each user terminal 3. It is an evaluation value map which exemplifies the detailed mode which displays by the number and size of. It is a figure which illustrates the visualization of the evaluation value of the user terminal 3 between a company, a floor, and a department.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating the overall configuration of the vulnerability management system 1.
As illustrated in FIG. 1, the vulnerability management system 1 includes a plurality of user terminals 3a, user terminals 3b, user terminals 3c, user terminals 3d, vulnerability management device 5, and warning light 7, via a network 9. Are connected to each other. The user terminal 3a, the user terminal 3b, the user terminal 3c, and the user terminal 3d are collectively referred to as the user terminal 3. The user terminal 3 is an example of the device according to the present invention.
The user terminal 3 is a computer terminal or a network device operated by the user, and is a target device for vulnerability management by the vulnerability management device 5. Specifically, the user terminal 3 is a business server, a business PC, a router, or an IoT device.
The vulnerability management device 5 is a computer terminal, and manages and displays the vulnerabilities of each user terminal 3. The vulnerability in the present invention refers to an information security defect caused by a program defect or a design error, and includes a risk due to unpatching and a risk due to a virus. Here, the patch means a patch, an update program, and a virus definition file. Specifically, the vulnerability management device 5 represents the influence of the vulnerability of the user terminal 3 connected to the network 9 based on the vulnerability information acquired from the external website and the configuration information of the user terminal 3. The evaluation value is quantified, and the symbol corresponding to the evaluation value of the vulnerability is displayed.
The warning light 7 is a rotating light that is arranged around the installation location of the user terminal 3 and informs the surroundings of the vulnerability.

FIG. 2 is a diagram illustrating a hardware configuration of the vulnerability management device 5.
As illustrated in FIG. 2, the vulnerability management device 5 includes a CPU 200, a memory 202, an HDD 204, a network interface 206 (network IF206), a display device 208, and an input device 210, and these configurations include a bus 212. They are connected to each other via.
The CPU 200 is, for example, a central arithmetic unit.
The memory 202 is, for example, a volatile memory and functions as a main storage device.
The HDD 204 is, for example, a hard disk drive device, and is a computer program (for example, the vulnerability management program 50 in FIG. 3) and other data files (for example, the vulnerability information database 600 in FIG. 3) and a configuration as a non-volatile recording device. The information database 610) is stored.
The network IF206 is an interface for wired or wireless communication, and realizes communication in the internal network 9, for example.
The display device 208 is, for example, a liquid crystal display.
The input device 210 is, for example, a keyboard and a mouse.

FIG. 3 is a diagram illustrating the functional configuration of the vulnerability management device 5.
As illustrated in FIG. 3, the vulnerability management program 50 is installed in the vulnerability management device 5 of this example, and the vulnerability information database 600 (vulnerability information DB 600) and the configuration information database 610 (configuration information) are installed. DB610) is configured.
The vulnerability management program 50 includes a configuration information acquisition unit 500, a vulnerability information collection unit 502, a search unit 504, an evaluation unit 506, a display unit 508, and a detection unit 510.
A part or all of the vulnerability management program 50 may be realized by hardware such as an ASIC, or may be realized by borrowing a part of the functions of the OS (Operating System).
In the vulnerability management program 50, the configuration information acquisition unit 500 acquires the configuration information of the user terminal 3 connected to the network 9. Specifically, the configuration information acquisition unit 500 configures identification information for identifying a patch or update program applied to each user terminal 3 and information related to updating a virus definition file in each user terminal 3. Get as information. More specifically, the configuration information acquisition unit 500 acquires the latest OS (VL) information, user information, installed software information, and patch application status of the user terminal 3 connected to the network 9. It is stored in the configuration information DB 610. For example, the configuration information acquisition unit 500 acquires OS information, user information, and patch application status from the business server and business PC, acquires a communication path from network 9, acquires setting information from a router, and is an IoT device. Obtain Bluetooth Version, Sensor Version, Firmware Version, and Wifi Level from. When the user terminal 3 is a PC or an IoT device, the configuration information acquisition unit 500 acquires configuration information by using the API of the OS.

Vulnerability information collection unit 502 collects vulnerability information indicating applicable information security measures. Specifically, the vulnerability information collection unit 502 collects information on applicable patches or updates and information on updatable virus definition files as vulnerability information. More specifically, the vulnerability information collection unit 502 constantly monitors an external website that publishes vulnerability information, and when new vulnerability information is posted, collects new vulnerability information. It is stored in the vulnerability information DB 600. More specifically, the vulnerability information collection unit 502 collects software, the degree of risk, and the presence or absence of patches as vulnerability information from an external website. External websites refer to, for example, JVN (vulnerability information), IPA, ESET, Trend Micro, SOURCENEXT (virus information), Microsoft (patch information), and McAfee (definition information) sites. Vulnerability information collection unit 502 acquires vulnerability information by analyzing the contents of APIs and Web pages published on these websites. The risk level of the vulnerability that can be obtained from an external website is the standardized value CVSSv2 or CVSSv3. The vulnerability information collecting unit 502 is an example of the information collecting unit according to the present invention.
When new vulnerability information is added by the vulnerability information collecting unit 502, the search unit 504 searches for the user terminal 3 that is the target of the new vulnerability information. Specifically, the search unit 504 searches the configuration information DB 610 for the user terminal 3 that needs to be dealt with based on the vulnerability information collected by the vulnerability information collecting unit 502.

The evaluation unit 506 is vulnerable to each of the user terminals 3 connected to the network 9 based on the configuration information acquired by the configuration information acquisition unit 500 and the vulnerability information collected by the vulnerability information collection unit 502. To evaluate. Specifically, the evaluation unit 506 calculates the evaluation value based on the application status of the patch of the target user terminal 3 searched by the search unit 504 and the vulnerability remaining in the user terminal 3. More specifically, in the evaluation unit 506, the evaluation value calculated based on whether or not the applicable patch or update program is applied to the user terminal 3 and the updateable virus definition file are provided in the user terminal 3. The evaluation value of each user terminal 3 is calculated by adding up the evaluation value calculated based on whether or not it is updated in. The evaluation value is evaluation value = Σ (risk of vulnerability i (program defect i) x patch application (0 or 1)) + Σ (virus j risk x definition file application (0 or 1)) ) Is calculated.

The display unit 508 is a symbol having a size corresponding to the evaluation result by the evaluation unit 506, and displays the vulnerabilities of each of the user terminals 3. Specifically, the display unit 508 displays a symbol having a size corresponding to the evaluation value calculated by the evaluation unit 506 in association with the user terminal 3. Also,
The display unit 508 displays a list of evaluation results by the evaluation unit 506 for a plurality of user terminals 3 connected to the network 9.
Further, the display unit 508 switches and displays the evaluation values before and after the summation for each user terminal 3. Specifically, the display unit 508 switches between a total mode for displaying the total evaluation value for each user terminal 3 and a detailed mode for displaying the evaluation value in the user terminal 3 separately.
Then, the display unit 508 has a size corresponding to the evaluation result of each user terminal 3 with respect to the floor diagram in which each user terminal 3 is arranged or the network configuration diagram to which each user terminal 3 is connected. The symbols are superimposed and displayed. Specifically, the display unit 508 superimposes the user terminal 3 having the evaluation value calculated by the evaluation unit 506 on the layout diagram or the floor diagram of the user terminal 3 to generate an evaluation value map. Further, the display unit 508 displays the evaluation result of the user terminal 3 connected to the network in a different display mode depending on whether or not the network is connected to the Internet.
When the evaluation result by the evaluation unit 506 for any of the user terminals 3 meets the predetermined conditions, the detection unit 510 turns on the warning light installed around the user terminal 3.

Here, the vulnerability information DB 600 and the configuration information DB 610 will be described.
FIG. 4A is a diagram illustrating vulnerability information stored in the vulnerability information DB 600, FIG. 4B is a diagram illustrating configuration information stored in the configuration information DB610, and FIG. 4C is a diagram illustrating the configuration information stored in the configuration information DB610. , Is a diagram illustrating the configuration information of software stored in the configuration information DB 610.
As illustrated in FIG. 4A, the vulnerability information DB 600 includes a vulnerability ID that identifies the vulnerability, the target software that the vulnerability affects, and the degree of risk that quantifies the risk of the vulnerability. The patch name corresponding to the vulnerability is stored.
As illustrated in FIG. 4B, the configuration information DB 610 contains a terminal ID that identifies the user terminal 3, OS information of the user terminal 3, user identification information of the user terminal 3, and a patch application status. It is stored.
As illustrated in FIG. 4C, the configuration information DB 610 further stores the terminal ID that identifies the user terminal 3, the software of the user terminal 3, and the patch application status as software configuration information. To.

FIG. 5 is a flowchart illustrating the vulnerability visualization process (S10) by the vulnerability management device 5.
As illustrated in FIG. 5, in step 100 (S100), the vulnerability information collecting unit 502 constantly monitors an external website that discloses the vulnerability information.
In step 105 (S105), when the vulnerability information collection unit 502 detects that new vulnerability information has been posted on an external website, it proceeds to S110 and does not detect new vulnerability information. Then, move to S100 and continue monitoring.
In step 110 (S110), the vulnerability information collecting unit 502 collects the newly posted vulnerability information. Specifically, the vulnerability information collection unit 502 collects the target software, the degree of risk, and the presence / absence of patches of the newly posted vulnerability information, and stores them in the vulnerability information DB 600. Further, the vulnerability information collecting unit 502 notifies the search unit 504 of the collected vulnerability information.
In step 115 (S115), the configuration information acquisition unit 500 acquires the latest configuration information of the user terminal 3 connected to the network 9. Specifically, the configuration information acquisition unit 500 acquires the OS information, user information, installed software information, and patch application status of the user terminal 3 and stores them in the configuration information DB 610.

In step 120 (S120), the search unit 504 searches the configuration information stored in the configuration information DB 610 for whether or not the user terminal 3 corresponding to the vulnerability information notified by the vulnerability information collection unit 502 exists. ..
In step 125 (S125), when the corresponding user terminal 3 exists as a result of the search by the search unit 504, the vulnerability visualization process (S10) shifts to S130, and when the corresponding user terminal 3 does not exist. , S100.
In step 130 (S130), the evaluation unit 506 calculates an evaluation value based on the application status of the patch of the user terminal 3 corresponding to the new vulnerability information and the vulnerability remaining in the user terminal 3.
In step 135 (S135), the display unit 508 displays the evaluation value calculated by the evaluation unit 506 on the vulnerability management device 5. Further, the display unit 508 displays the evaluation value of the user terminal 3 on the vulnerability management device 5 with a symbol (for example, the size of a “circle”) corresponding to the evaluation value.

FIG. 6 is a diagram illustrating a method of displaying the evaluation value. FIG. 6A exemplifies a method of displaying an evaluation value of a vulnerability origin, FIG. 6B exemplifies a method of displaying an evaluation value of a terminal origin, and FIG. 6C exemplifies a method of displaying an evaluation value of a user origin. Is illustrated.
The display unit 508 displays the evaluation value from the vulnerability origin, the terminal origin, and the user origin. As illustrated in FIG. 6A, in the method of displaying the starting point of a vulnerability, a list of terminals affected by a certain vulnerability and an evaluation value is displayed. Further, in the method of displaying the starting point of the vulnerability, the evaluation value of the user terminal 3 for each vulnerability can be displayed in a list by using the target software of the vulnerability information as a key.
As illustrated in FIG. 6B, in the terminal starting point display method, the evaluation values for each terminal are displayed in a list using the terminal ID of the configuration information as a key. In the terminal-based display method, the risk indicating the risk of not applying the patch, the risk indicating the risk of the virus, and the evaluation value which is the total of these are displayed by numerical values and symbols.
Further, at the terminal starting point, by setting the importance of the user terminal 3, it is possible to change the notification method to the user when the vulnerability is not addressed. Specifically, a mailing list can be set for notifications that are not vulnerable to the user terminal 3, which has a high degree of importance. By contacting using a preset mailing list, the vulnerability can be dealt with systematically. As a result, it is possible to immediately respond to the vulnerabilities of the file server, compiler, etc., which have a large business impact when the user terminal 3 is stopped.

As illustrated in FIG. 6C, in the user-origin display method, a user's responsible terminal is obtained by acquiring a list of terminals operated by the same user based on the configuration information and calculating an evaluation value for each terminal. List the evaluation values of. In addition, the vulnerability management device 5 notifies a preset mailing list to which the user belongs when the user's response is delayed. As a result, not only the user but also the organization can deal with the vulnerabilities, which can lead to enlightenment of raising the security awareness of the entire organization.
By displaying each starting point, when a vulnerability that requires urgent countermeasures occurs, all affected terminals can be identified and monitored until the countermeasures are completed. Further, by displaying the evaluation value of the user terminal 3 for each user, it is possible to identify a user who is less conscious of the vulnerability. Furthermore, by defining the user's department information, it is possible to analyze by department.

FIG. 7A is an evaluation value map exemplifying a totaling mode in which evaluation values for each terminal are totaled and displayed, and FIG. 7B is a number of “circles” for the number of vulnerabilities and evaluation values for each terminal. It is an evaluation value map which exemplifies the detailed mode which displays by the size.
The display unit 508 calculates evaluation values for all user terminals 3 and generates an evaluation value map by combining the evaluation values with the layout of the user terminals 3. As illustrated in FIG. 7A, the display unit 508 displays the evaluation value for each user terminal 3 in the size of one symbol “circle” in the total mode. As illustrated in FIG. 7B, in the detailed mode, the display unit 508 displays the number of vulnerabilities and the evaluation value for each user terminal 3 by the number and size of “circles”. Further, the user can display the information of the user terminal origin and the information of the vulnerability origin by selecting the user terminal 3 on the evaluation value map.
The evaluation value map can immediately identify the physical position of the user terminal 3 having a high evaluation value of vulnerability. In addition, by referring to the information on the origin of the vulnerability from the detailed mode, the content of the vulnerability can be understood, and the necessary countermeasures can be specified.

FIG. 8 is a diagram illustrating visualization of the evaluation value of the user terminal 3 between companies, floors, and departments.
As illustrated in FIG. 8, the display unit 508 represents the relevance on the network based on the amount of communication between the user terminals 3. The thickness of the line in the figure is proportional to the amount of communication. The security administrator can view the evaluation value map on the "floor" of the "4F" by selecting "4F" of "company-wide" in FIG. 8, and further select "B" of the "floor". This makes it possible to browse the evaluation value map in the "department" corresponding to "B". Displaying the traffic volume and the evaluation value of the vulnerability together makes it possible to identify the range affected by the vulnerability. In addition, by defining the aggregation unit, it is possible to visualize the impact of vulnerabilities between floors and departments. Further, the display unit 508 makes it possible to distinguish the closed environment, which is generally not patchable and always tends to have a high risk, by displaying the closed environment in different colors.

As described above, according to the vulnerability management device 5, the evaluation value is calculated based on the vulnerability information collected from the external website and the configuration information of the user terminal 3, and the calculated evaluation value is used as a symbol. Represent. By displaying the evaluation value in the size of the symbol, the security administrator can intuitively grasp the danger. In addition, as an evaluation value display method, it is possible to display based on different starting points, so that it is possible to grasp the danger from multiple aspects. Furthermore, by displaying the evaluation value symbol according to the relationship between the user terminals on the network, the range of impact of the vulnerability can be visually grasped, and the priority of response to the vulnerability can be set. It will be possible.

1 ... Vulnerability management system 3 ... User terminal 5 ... Vulnerability management device 7 ... Warning light 9 ... Network 50 ... Vulnerability management program 500 ... Configuration information acquisition unit 502 ... Vulnerability information collection unit 504 ... Search unit 506 ... Evaluation unit 508 ... Display unit 510 ... Detection unit 600 ... Vulnerability information database 610 ... Configuration information database

Claims

A configuration information acquisition unit that acquires configuration information of devices connected to a predetermined network,
An information gathering department that collects vulnerability information that indicates applicable security measures,
Vulnerability with an evaluation unit that evaluates the vulnerabilities of each device connected to the network based on the configuration information acquired by the configuration information acquisition unit and the vulnerability information collected by the information collection unit. Sex management device.
The vulnerability management device according to claim 1, further comprising a display unit that displays the vulnerabilities of each device with a symbol having a size corresponding to the evaluation result by the evaluation unit.
The information gathering unit collects information on applicable patches or updates and information on updatable virus definition files as the vulnerability information.
According to claim 1, the configuration information acquisition unit acquires identification information for identifying a patch or update program applied to each device and information on updating a virus definition file in each device as the configuration information. Vulnerability management device described.
The vulnerability management device according to claim 3, wherein the display unit displays a list of evaluation results by the evaluation unit for a plurality of devices connected to a default network.
The evaluation unit is based on an evaluation value calculated based on whether or not an applicable patch or update program is applied to the device, and whether or not the updateable virus definition file is updated on the device. Calculate the evaluation value of each device by adding up the calculated evaluation value.
The vulnerability management device according to claim 3, wherein the display unit switches and displays evaluation values before and after totaling for each device.
The display unit displays a floor diagram in which each device is arranged or a network configuration diagram to which each device is connected by superimposing a symbol having a size corresponding to the evaluation result of each device. Vulnerability management device according to item 3.
The vulnerability management device according to claim 3, wherein the display unit displays evaluation results of devices connected to the network in different display modes depending on whether or not the network is connected to the Internet.
Multiple warning lights placed around the equipment installation location,
The vulnerability management device according to claim 1, further comprising a detection unit that lights a warning light installed around the device when the evaluation result by the evaluation unit matches a predetermined condition for any of the devices. ..
A configuration information acquisition step to acquire configuration information of devices connected to a predetermined network, and
Information gathering steps to collect vulnerability information indicating applicable security measures,
Vulnerability having an evaluation step for evaluating the vulnerability of each device connected to the network based on the configuration information acquired by the configuration information acquisition step and the vulnerability information collected by the information collection step. Gender management method.
A configuration information acquisition step to acquire configuration information of devices connected to a predetermined network, and
Information gathering steps to collect vulnerability information indicating applicable security measures,
Based on the configuration information acquired by the configuration information acquisition step and the vulnerability information collected by the information collection step, an evaluation step for evaluating the vulnerability of each device connected to the network is provided to the computer. The program to be executed.