JP2009146260A - Security evaluating method, and information processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security evaluating method and an information processor for calculating, for each terminal, a security evaluation value reflecting damage when protection target assets are illegally acquired by a terminal on a path that accesses a terminal storing the protection target assets. <P>SOLUTION: The security evaluating method includes: a normal access probability inputting process for inputting a normal access probability; an illegal acquisition probability inputting process for inputting an illegal acquisition probability; an assets damage degree inputting process; a countermeasure break damage degree calculating process for calculating a countermeasure break damage degree in the case of breaking countermeasure on the basis of the illegal acquisition probability, the normal access probability and the assets damage degree; a threat occurrence frequency inputting process for inputting a threat occurrence frequency; a prevention performance inputting process for inputting prevention performance; and a security evaluation value calculating process for calculating a security evaluation value in the case of breaking the countermeasure on the basis of the countermeasure break damage degree or the assets damage degree, the threat occurrence frequency and the prevention performance. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a security evaluation method and an information processing apparatus.

  In recent years, security measures for protecting electronic information assets from hackers and other threats are becoming increasingly important. Such security measures are more desirable as they are taken, and the security level becomes better.

  On the other hand, it is generally considered that there is no need to take security measures when there is almost no risk of infringement of electronic information even if no security measures are taken (when rare threats that can lead to asset infringements occur). It is done. The same applies to the case where the damage caused is small even if there is an infringement.

  Thus, when security evaluation is performed when introducing security measures, it is necessary to compare the introduction cost and the effect of the security measures. For easy comparison, it is preferable to calculate a quantitative value for the introduction cost and to calculate a quantitative value for the introduction effect.

  As a generally used quantitative security evaluation method, for example, Non-Patent Document 1 discloses a method in which a product of an asset infringement probability and a damage degree at the time of infringement is used as a security evaluation value (Non-Patent Document 1). Patent Document 1).

  In the method disclosed in Non-Patent Document 1, when the infringement probability is a probability value for each year and the damage level is a damage amount, the security evaluation value can be calculated as an expected value of the damage amount for each year. . Therefore, if compared with the average security cost per year, it is possible to determine the appropriateness of security measures from the viewpoint of cost.

  However, the method disclosed in Non-Patent Document 1 cannot determine the appropriateness of security measures for each component constituting the target system.

  Therefore, there is a method to calculate the ratio of threat reduction effect by each component that constitutes the target system as a contribution rate, quantify the security importance of each component as a total, and display the cost of each component together. It has been proposed (see, for example, Patent Document 1).

  In the security evaluation method disclosed in Patent Document 1, the degree of damage is calculated only when the electronic information in the server storing the assets to be protected is infringed. For example, assuming that personal information data stored in a document server is an asset to be protected, it is evaluated from the defense performance of this server and the probability of unauthorized access to this server.

The server's defense performance is, for example, login authentication when logging in to a terminal accessible to this server, device authentication as to whether or not the terminal is permitted to access the server, and entering a room where a terminal accessible to the server is placed. It is calculated by personal authentication.
ISO / IEC TR13335 "The Guideline for the management IT Security" JP 2006-331383 A

  However, in reality, if the personal authentication of the entrance / exit management of the room in which the server storing the assets to be protected is installed, it is possible to look into the terminal that is accessing the assets to be protected. Furthermore, when a terminal that is accessing the asset to be protected is accessed from a remote terminal, the data of the asset to be protected that the accessing terminal temporarily downloaded at hand can be viewed.

  The degree to which the security of assets is breached by peeping depends on the regular access frequency for the terminal to be peeped. Therefore, it can be said that the security evaluation is preferably performed in consideration of how often regular access occurs on the evaluation target system.

  In the method disclosed in Patent Document 1, only the infringement of the terminal storing the asset to be protected is considered, and the case of illegally acquiring the asset to be protected from the terminal on the route is not considered. Therefore, the security evaluation value is the same regardless of the probability that a user with legitimate authority can access the protected asset to the terminal normally, and security measures are applied before and after each terminal on the route based on the evaluation result. It cannot be set properly.

  The present invention has been made in view of the above problems, and reflects security in the case where a protected asset is illegally acquired from a terminal on a path for accessing the terminal in which the protected asset is stored. It is an object of the present invention to provide a security evaluation method and an information processing apparatus for calculating an evaluation value for each countermeasure.

  The object of the present invention can be achieved by the following constitution.

1.
In a security evaluation method for evaluating the security level of an information system in which a plurality of measures for preventing infringement by a threat to the asset are provided in a path to access a main information processing apparatus in which the asset to be protected is stored,
An unauthorized acquisition probability input step of inputting an unauthorized acquisition probability that the threat illegally acquires the asset accessed by a user having a legitimate authority after the threat breaks through the countermeasure;
A normal access probability input step of inputting a normal access probability which is a probability that the user is accessing the asset;
An asset damage level input step of inputting an asset damage level when the asset is infringed;
A countermeasure breakage damage degree calculating step for calculating a countermeasure breakage damage degree when the countermeasure is broken based on the unauthorized acquisition probability, the regular access probability, and the asset damage degree;
A threat occurrence frequency input step of inputting a threat occurrence frequency at which the threat infringes the asset; and
A defensive performance input step of inputting the defensive performance of the countermeasure to prevent the infringement;
A security evaluation value calculating step of calculating a security evaluation value based on the countermeasure damage damage degree, the threat occurrence frequency, and the defense performance;
A security evaluation method characterized by comprising:

2.
The security evaluation value calculating step includes a step of calculating a security evaluation value when all the countermeasures are broken based on the asset damage level, the threat occurrence frequency, and the defense performance. Security evaluation method described in 1.

3.
3. The security evaluation method according to 2, further comprising a system security evaluation value calculation step of calculating a system security evaluation value from the sum of the security evaluation values calculated in the security evaluation value calculation step.

4).
Before the fraud acquisition probability input step,
4. The security evaluation method according to any one of claims 1 to 3, further comprising a correspondence table display step of displaying a correspondence table in which a factor related to the unauthorized acquisition probability is associated with the unauthorized acquisition probability.

5).
In an information processing apparatus that calculates an evaluation value related to a security level of an information system in which a plurality of measures for preventing infringement by a threat to the asset are provided in a path to access a main information processing apparatus in which assets to be protected are stored,
An unauthorized acquisition probability input means for inputting an unauthorized acquisition probability that the threat illegally acquires the asset accessed by a user having a legitimate authority after the threat has broken through the countermeasure;
Normal access probability input means for inputting a normal access probability that is a probability that the user is accessing the asset;
Asset damage level input means for inputting the asset damage level when the asset is infringed;
Countermeasure damage damage degree calculating means for calculating a countermeasure damage damage degree when the countermeasure is broken based on the unauthorized acquisition probability, the regular access probability, and the asset damage degree;
A threat occurrence frequency input means for inputting a threat occurrence frequency at which the threat infringes the asset;
Defensive performance input means for inputting the defensive performance of the countermeasure to prevent the infringement;
Security evaluation value calculating means for calculating a security evaluation value based on the countermeasure damage damage degree, the threat occurrence frequency, and the defense performance;
An information processing apparatus comprising:

6).
6. The information according to 5, wherein the security evaluation value calculating means calculates a security evaluation value when all the countermeasures are broken based on the asset damage level, the threat occurrence frequency, and the defense performance. Processing equipment.

7).
7. The information processing apparatus according to claim 6, further comprising a system security evaluation value calculating unit that calculates a system security evaluation value from a sum of the security evaluation values calculated by the security evaluation value calculating unit.

8).
8. The information processing apparatus according to claim 5, further comprising: a correspondence table display unit configured to display a correspondence table in which a factor related to the fraud acquisition probability is associated with the fraud acquisition probability.

  According to the present invention, the protection target asset accessed by a user having a legitimate authority is detected by a threat that broke through a countermeasure applied to a route for accessing the information processing apparatus in which the protection target asset is stored. Is calculated as a security evaluation value for each measure. Accordingly, a security evaluation method for calculating for each terminal a security evaluation value that reflects damage in the case where the protected asset is illegally acquired from a terminal on the path to access the terminal where the protected asset is stored, An information processing apparatus can be provided.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, an embodiment of the present invention will be described with reference to FIG.

  FIG. 1 is a block diagram showing an example of the internal configuration of the information processing apparatus 2 according to the embodiment of the present invention.

  The information processing apparatus 2 includes a CPU 211 that controls the entire system, an input unit 218 that a user inputs and operates, a communication unit 210 that includes a transmission unit 224 and a reception unit 225 that communicate via Ethernet (registered trademark) and the like. ing. The information processing apparatus 2 includes a display unit 219 that displays images and characters, and a storage unit 213 including a RAM (Random Access Memory), a ROM (Read Only Memory), an HDD (Hard Disk Drive), and the like (not shown). It has.

  The storage unit 213 stores, for example, an OS (Operating System), a security evaluation program according to the present invention, and the like, and the CPU 211 executes these programs. In the present embodiment, an example in which the information processing apparatus 2 is used stand-alone will be described. For example, a security evaluation program installed in the information processing apparatus 2 may be executed from a remote terminal via a network. .

  The CPU 211 includes an unauthorized acquisition probability input unit 250, a regular access probability input unit 251, an asset damage degree input unit 252, a threat occurrence frequency input unit 253, a defense performance input unit 254, a countermeasure sudden damage degree calculation unit 255, and a security evaluation value calculation unit. 256, a system security evaluation value calculation unit 257, and a correspondence table display unit 258.

  The unauthorized acquisition probability input unit 250 is an unauthorized acquisition probability input unit of the present invention, the normal access probability input unit 251 is a normal access probability input unit of the present invention, and the asset damage level input unit 252 is an asset damage level input unit of the present invention. The threat occurrence frequency input unit 253 is the threat occurrence frequency input unit of the present invention, the defense performance input unit 254 is the defense performance input unit of the present invention, and the countermeasure sudden damage degree calculation unit 255 is the countermeasure sudden damage degree calculation unit of the present invention. The security evaluation value calculation unit 256 is the security evaluation value calculation unit of the present invention, the system security evaluation value calculation unit 257 is the system security evaluation value calculation unit of the present invention, and the correspondence table display unit 258 is the correspondence table display unit of the present invention.

  Before describing each functional element of the CPU 211, the security evaluation method of the present invention will be described using a configuration example of an information system to be subjected to security evaluation shown in FIGS. FIG. 7 is an explanatory diagram of an information system used as a specific example for explaining the embodiment of the present invention.

  In the information system 220 illustrated in FIG. 7, the server 1, the terminal 10, and the terminal 11 are connected to the server room 200 via the intranet 5. Reference numeral 20 denotes a user having regular authority. The server 1 stores assets to be protected such as a customer information database.

  The server room 200 is provided with an entrance / exit management device 201 that authenticates the user 20 by biometric authentication or password authentication, and the door 202 is not opened and closed when authentication is not possible.

  FIG. 8 is an explanatory diagram for explaining, for each step, a path for accessing the server 1 that is the main information processing apparatus in which the asset to be protected is stored in the information system 220 shown in FIG. 7 as an example.

  The route r in which the threat T enters from the outside of the server room 200 and infringes on the protected assets of the server 1 will be described in order.

  The threat T gives an opportunity to enter from the outside of the server room 200 in step S50, but the server room 200 is provided with the entrance / exit management device 201 as described above, and the entrance / exit management authentication is performed. In FIG. 8, this entrance / exit management authentication is indicated as measure A. Step S51 is a countermeasure A. In order for the threat T to enter the server room 200, the countermeasure A must first be broken.

  When the measure A is broken, the threat T reaches the server room 200 as the next step S52. In the server room 200, a terminal 10 and a terminal 11 that are accessible to the server 1 are installed as shown in FIG. However, for example, an authentication password for login is set in the terminal 10 and the terminal 11 and cannot be used unless the login is authenticated. In FIG. 8, this PC login authentication is described as countermeasure B. Step S53 is Countermeasure B. In order for the threat T to infringe on the asset to be protected, an authentication password for login must be acquired.

  When the measure B is broken, in the next step S54, the threat T can use the terminal 10, for example. However, in order to access the server 1 from the terminal 10 and the terminal 11, measures are taken to input an authentication password or the like set for a regular service user. In FIG. 8, this service user authentication is indicated as countermeasure C. Step S55 is Countermeasure C. In order for the threat T to infringe on the asset to be protected, a service user authentication password or the like must be acquired.

  If the countermeasure C is broken, the threat T can use the server 1 in the next step S56, and all the assets to be protected can be accessed. As described above, if the infringement is performed up to step S56, the damage is enormous. In the present invention, the damage when the threat T reaches step S56 and the protected asset is infringed is referred to as an asset damage degree D. In the present embodiment, the asset loss degree D is assumed to be 4 million yen for explanation.

  As described above, unless the threat T breaks through the countermeasure A, the countermeasure B, and the countermeasure C, the protected asset cannot be directly accessed. However, when the threat T breaks through the countermeasure A and enters the room of the server room 200, if the user 20 having the proper authority has accessed the assets to be protected from the terminal 10, for example, the threat T You can peek. When the threat T peeks, for example, some information in the customer database may be acquired, and this information may be misused.

  Furthermore, even if the threat T breaks through the countermeasure B and the terminal 10 or the terminal 11 can be used, the server 1 cannot be accessed unless the countermeasure C is broken. However, if a screen or data in which a user 20 having a legitimate authority is working using, for example, a customer database of the server 1 is left on a terminal where the threat T can be used, the threat T acquires this information. This information can be abused as well.

  In the present invention, after the threat T breaks through the countermeasure in this way, the damage when the threat T illegally acquires the asset accessed by the user 20 having the authorized authority is called the countermeasure sudden damage degree L. . By calculating the countermeasure breakage damage degree L, it is possible to quantitatively evaluate the damage when the countermeasure is broken for each countermeasure. Therefore, it is possible to invest in appropriate security measures in consideration of the cost required for the security measures.

  The countermeasure damage damage degree L is considered to be a part of the asset damage degree D that is a damage when the threat T enters the step S56 and the protected asset is infringed. In the present invention, the countermeasure T breakage damage degree L is calculated from the probability that the threat T that broke through the countermeasures acquires the asset accessed by the user 20 having the proper authority and the asset damage degree D.

  For example, the probability that the threat T that broke through the countermeasure A acquires the asset accessed by the user 20 having the proper authority is considered as follows.

  As a first condition, when the threat T enters the room of the server room 200, the user 20 having the proper authority must access the assets to be protected. As a next condition, even if a user 20 with a legitimate authority has accessed the assets to be protected, the threat T cannot always be seen or information cannot be acquired. For example, when the server room 200 is bright and there are many people, the threat T cannot be easily peeped.

The probability that the user 20 is accessing the asset to be protected is called a normal access probability Z, and the probability that the threat T is illegally acquired by the threat T is called an unauthorized acquisition probability Y. The countermeasure breakage damage degree L _m when the m-th countermeasure excluding the third countermeasure C closest to the asset to be protected on the route is obtained by the equation (1).

Countermeasure damage damage degree L _m = regular access probability Z _m × unauthorized acquisition probability Y _m × asset damage degree D _m (1)
For example, when the threat T that broke through the countermeasure A enters the server room 200, the normal access probability Z ₁ is 0.5, the unauthorized acquisition probability Y ₁ is 0.4, the asset damage degree D is 4 million yen, and the countermeasure damage damage When the degree is L ₁ , the countermeasure damage damage degree L ₁ is 800,000 yen by substituting it into the equation (1).

In addition, for example, when the threat T that breaks out of the countermeasure B enters the terminal 10, the normal access probability Z ₂ is 0.2, the unauthorized acquisition probability Y ₂ is 0.5, the asset damage degree D is 4 million yen, and the countermeasure is broken. Assuming that the damage degree is L ₂ , the countermeasure sudden damage damage degree L ₂ is 400,000 yen by substituting it into the equation (1).

  The degree of damage when the threat T breaks through each countermeasure has been calculated in the above procedure. However, in order to quantitatively evaluate the security level of the information system 220, it is necessary to consider the frequency with which such damage occurs. is there. In the present invention, the security evaluation value B considering the frequency with which the threat T breaks through each countermeasure is calculated, and the security of the information system 220 is quantitatively evaluated.

In the present invention, the frequency of occurrence of the threat T is called the threat occurrence frequency H, and the probability that each countermeasure can prevent the intrusion of the threat T is called the defense performance X. In the following description, the defense performance of measure A is called defense performance X ₁ , the defense performance of measure B is called defense performance X ₂ , and the defense performance of measure C is called defense performance X ₃ .

For example, a case will be described in which the threat T broke through the countermeasure A and entered the server room 200 but was prevented by the countermeasure B and could not enter the terminals 10 and 11. Here, as an example, the threat occurrence frequency H is 4 (times / year), the defense performance X ₁ is 0.5, the defense performance X ₂ is 0.8, and the defense performance X ₃ is 0.4.

The probability Q1 that the threat T breaks through the measure A is 0.5 because the defense performance X ₁ is 0.5, so the probability Q 1 = (1−defense performance X ₁ ) = (1−0.5) = 0.5. On the other hand, since the defense performance X ₂ is 0.8, 0.5 × 0.8 = 0.4 has passed the countermeasure A and has entered the server room 200, but the terminal 10 is blocked by the countermeasure B. , 11 is the probability Q2 when the intrusion cannot be made. Furthermore, when the probability Q2 is multiplied by the threat occurrence frequency H, the annual occurrence frequency is obtained. In this example, H × Q2 = 4 × 0.4 = 1.6 (times / year).

  As described above, when the threat occurrence frequency H and the annual occurrence frequency are multiplied by the countermeasure damage damage degree L when the threat T breaks through the countermeasure, an expected value of the annual damage degree is obtained. In the present invention, this value is called a security evaluation value B.

For example, when the threat T breaks through the countermeasure A and enters the server room 200 but is blocked by the countermeasure B and cannot enter the terminals 10 and 11, the security evaluation value B ₁ can be calculated by the equation (3). .

Security evaluation value B ₁ = Countermeasure damage severity L ₁ × Threat occurrence frequency H × (1-Defense performance X ₁ ) × Defense performance X ₂ (3)
(3) are substituted into equation to become a security evaluation value _{B 1 = 80 × 4 × (} 1-0.5) × 0.8 = 128 ( yen / year). The security evaluation value B is an expected value of the annual amount of damage, and in this example, it is assumed that damage of 1.28 million yen occurs annually.

Similarly, when the threat T broke through the countermeasure A and the countermeasure B and invaded the server room 200, but it was blocked by the countermeasure C and could not enter the server 1, the annual occurrence frequency is determined from the defense performance of each countermeasure. To calculate the security evaluation value. In this case, the security evaluation value B ₂ can be calculated by equation (4).

Security evaluation value B ₂ = Countermeasure damage severity L ₂ × Threat occurrence frequency H × (1-Defense performance X ₁ ) × (1-Defense performance X ₂ ) × Defense performance X ₃ (4)
When substituted into the equation (4), the security evaluation value B ₂ = 40 × 4 × (1-0.5) × (1-0.8) × 0.4 = 6.4 (10,000 yen / year) It is assumed that it will occur.

Further, even when the threat T breaks through the countermeasure A, the countermeasure B, and the countermeasure C, and infringes the assets of the server 1, an annual occurrence frequency is obtained from the defense performance of each countermeasure, and a security evaluation value is calculated. In this case, the security evaluation value B ₃ can be calculated by equation (5).

Security evaluation value B ₃ = asset damage degree D × threat occurrence frequency H × (1−protection performance X ₁ ) × (1−protection performance X ₂ ) × (1−protection performance X ₃ ) 5)
Substituting into equation (5), security evaluation value B ₃ = 400 × 4 × (1-0.5) × (1-0.8) × (1-0.4) = 96 (10,000 yen / year) It is assumed that damage will occur.

  In this way, it is possible to calculate for each measure a security evaluation value that reflects the damage caused when a protected asset is illegally acquired from a terminal on the path that accesses the terminal that stores the protected asset. . Thus, the user can more firmly take a countermeasure with a large security evaluation value, that is, a large estimated loss amount as a result of the evaluation.

  For example, the length of the password for password authentication may be increased, or the authentication threshold value for biometric authentication may be re-set. Also, performance changes such as changing filtering rules, replacement with a firewall that can describe better-performing biometric authentication and more complicated filtering rules, and card authentication that requires only a password are also required. It is also possible to add measures such as multiple authentication such as changing.

  In FIG. 7 and FIG. 8, entrance / exit management authentication, PC login authentication, and service user authentication have been described as examples of security means. However, the application of the present invention is not limited to these, and encryption, antivirus software, An IPS (Intrusion Prevention System), a firewall, or the like may be used. For example, in the case of an infringement route in which encryption is canceled after passing through a firewall and authentication impersonation is performed, the security countermeasure method is only firewall A, countermeasure B encryption, and countermeasure C authentication. The invention can be applied. The present invention can also be applied to various threats such as eavesdropping, viruses, DOS attacks, and the like.

  The defense performance X of each security measure can be set from past statistics based on logs or the like, security means algorithms, and the like. For example, the number of successful cases when an employee was intentionally urged to gain unauthorized access experimentally, the number of threats protected by the target security measures, and the security measures at the later stage after passing through these security measures without being protected. The ratio of the number of detected threats can be used. Also, disclosure information by companies and public institutions that sell security measures as products (for example, if the security measure was anti-virus software, the total number of virus occurrences and the number of new virus damage may be disclosed. Can be set based on statistical values.

  Also, if the authentication is based on a simple four-digit password, even if there is no leakage of the password, the authentication succeeds with a probability of 1/10000 because there are only 10,000 password patterns. Therefore, this probability may be used as the defense performance X. In addition, if it is assumed that if the birthday is set as a personal identification number, it is easy to break through the countermeasures. X may be set.

  Similarly, the regular access means may be set based on the log or questionnaire survey results.

  Next, a method for calculating the system security evaluation value F for evaluating the entire information system 220 from the security evaluation value B thus obtained will be described.

7 and 8, the security evaluation value B ₁ is 128 (10,000 yen / year), the security evaluation value B ₂ is 6.4 (10,000 yen / year), and the security evaluation value B ₃ is 96 (10,000 yen / year). Year). The sum of the security evaluation values is 128 + 6.4 + 96 = 230.4 (10,000 yen / year), and this value is an expected value of damage that occurs in the information system 220 when measures A, B, and C are performed.

  On the other hand, in the examples of FIGS. 7 and 8, the threat occurrence frequency H when countermeasures are not taken is 4 (times / year), and the asset damage degree D is 4 million yen, so it occurs in the information system 220 when no countermeasures are taken. The expected value of damage is 4 × 400 = 1600 (10,000 yen / year).

  In this way, the expected value of damage caused in the information system 220 by taking measures A, B, and C is reduced from 1600 (10,000 yen / year) to 230.4 (10,000 yen / year). That is, the measure effect obtained by taking measures A, B, and C in this example is calculated as 1600−230.4 = 1396.6 (10,000 yen / year). The value calculated by subtracting the sum of the security evaluation values B of the countermeasures from the expected damage value obtained from the threat occurrence frequency H and the asset damage level D is referred to as a system security evaluation value F in the present invention.

  Assuming that the total cost incurred annually when taking measures A, B, and C is 1000 (10,000 yen / year), it will be 1000 (10,000 yen / year) from 1396.6 (10,000 yen / year) calculated as a measure effect. ) Minus 396.6 (10,000 yen / year) is considered to be the value of measures A, B, and C.

  When the system security evaluation value F is calculated, the security evaluation value B may be weighted and added for each terminal in consideration of some other factor such as usability.

  Returning to FIG. 1, each functional element of the CPU 211 will be described.

  The unauthorized acquisition probability input unit 250 displays a GUI (Graphical User Interface) that prompts an input of an unauthorized acquisition probability on the display unit 219, and temporarily stores the unauthorized acquisition probability input from the input unit 218 in the storage unit 213.

  The normal access probability input unit 251 displays a GUI that prompts the user to input the normal access probability on the display unit 219, and temporarily stores the normal access probability input from the input unit 218 in the storage unit 213.

  The asset damage level input unit 252 displays a GUI that prompts input of the asset damage level on the display unit 219, and temporarily stores the asset damage level input from the input unit 218 in the storage unit 213.

  The threat occurrence frequency input unit 253 displays a GUI for prompting input of the threat occurrence frequency on the display unit 219, and temporarily stores the threat occurrence frequency input from the input unit 218 in the storage unit 213.

  The defense performance input unit 254 displays a GUI that prompts input of defense performance on the display unit 219, and temporarily stores the defense performance input from the input unit 218 in the storage unit 213.

  The countermeasure damage damage degree calculation unit 255 calculates the countermeasure damage damage degree based on the fraud acquisition probability, the normal access probability, and the asset damage degree.

  The security evaluation value calculation unit 256 calculates a security evaluation value based on the countermeasure sudden damage damage degree or asset damage degree, the threat occurrence frequency, and the defense performance.

  The system security evaluation value calculation unit 257 calculates the sum of the plurality of security evaluation values calculated every time the countermeasure is broken.

  The correspondence table display unit 258 displays the correspondence table on the display unit 219 stored in the storage unit 213.

  Next, a procedure for the information processing apparatus 2 to calculate the security evaluation value and the system security evaluation value in the embodiment of the present invention will be described.

  FIG. 2 is a flowchart for explaining a procedure of a main routine for calculating a system security evaluation value in the embodiment of the present invention. FIG. 3 is a security for the information processing apparatus 2 to calculate a security evaluation value in the embodiment of the present invention. It is a flowchart explaining the procedure of an evaluation value calculation routine.

  First, the procedure of the main routine of FIG. 2 will be described. As a specific example, a case where the present invention is applied to the information system 220 described with reference to FIGS. 7 and 8 will be described.

  S10: This is a step of inputting the number n of security measures.

  In accordance with the GUI of the display unit 219, the user operates the input unit 218 to input the number n of security measures for the information system that performs security evaluation. The number n of security measures is a positive integer of 2 or more, and n = 3 in the example of the information system 220 in FIGS.

  S11: This is a step of displaying a correspondence table.

  The correspondence table display unit 258 displays a correspondence table on the display unit 219 as a guide when the user inputs the fraud acquisition probability Y. Examples of GUI displayed in step S11 are shown in FIGS. In the GUI examples illustrated in FIGS. 4, 5, and 6, correspondence tables 500, 501, and 502 having different contents are illustrated. For example, the correspondence table 500 shows the value of the fraud acquisition probability Y corresponding to the security patch application status. In addition, the correspondence table 501 shows the value of the unauthorized acquisition probability Y according to the situation of the room where the PC that can access the asset is placed, and the correspondence table 502 shows the unauthorized acquisition according to the case where the previous security measure is violated. The value of probability Y is shown.

  S12: It is a step which inputs the fraud acquisition probability Y.

  The user refers to the correspondence table displayed on the display unit 219 and inputs the fraud acquisition probability Y for each security measure by operating the input unit 218. The unauthorized acquisition probability input unit 250 temporarily stores the input unauthorized acquisition probability Y in the storage unit 213.

The fraud acquisition probability Y is the probability that the threat will illegally acquire an asset accessed by a user with a legitimate authority after the threat T breaks through the countermeasure, and breaks through the last countermeasure and infringes the asset. Does not include cases. In the example of the information system 220 in FIG. 7 and FIG. 8, the number of countermeasures n = 3. In this case, the unauthorized acquisition probability Y ₁ , Y when the user breaks through the first countermeasure A and the second countermeasure B Enter ₂ .

For example, in the example of the GUI in FIG. 4, when almost no security patch is applied, the user refers to the correspondence table 500, inputs 0.9 as the unauthorized acquisition probability Y ₁ in the input box 600, and presses the decision button 601. Push. Reference numeral 602 denotes a cancel button.

  S13: This is a step of inputting a normal access probability Z.

  The user inputs the normal access probability Z by operating the input unit 218 in accordance with the GUI of the display unit 219. The normal access probability input unit 251 temporarily stores the input normal access probability Z in the storage unit 213.

The regular access probability Z is the probability that the user 20 has accessed the assets to be protected after the threat T breaks through the countermeasure, and the user inputs an appropriate value in consideration of the usage status of the terminals 10 and 11. To do. In the example of the information system 220 described with reference to FIGS. 7 and 8, the normal access probability Z ₁ when the threat T that broke through the countermeasure A enters the terminal 10 is 0.5, and the threat T that broke through the countermeasure B is the terminal 10. The normal access probability Z ₂ when entering the network is 0.2.

  S14: This is a step of inputting the asset damage degree D.

  The user operates the input unit 218 to input the damage when the asset to be protected is infringed, that is, the asset damage degree D, according to the GUI of the display unit 219. The asset damage level input unit 252 temporarily stores the input asset damage level D in the storage unit 213. In the example of the information system 220 described with reference to FIGS. 7 and 8, the asset damage degree D is 4 million yen.

  S15: This step is m = n.

  The countermeasure crash damage degree calculation unit 255 substitutes n input in step S10 for the variable m.

  S16: This is a step of setting m = m-1.

  The countermeasure crash damage degree calculation unit 255 sets m = m−1.

  S17: A step of determining whether m = 0.

  The countermeasure crash damage degree calculation unit 255 determines whether m = 0.

  If m ≠ 0 (step S17; No), the process proceeds to step S18.

S18: a step of calculating the measures topped damage of L _m.

Measures topped damage calculation portion 255 calculates a measure break damage degree L _m based on equation (1).

In the case of the information system 220 described with reference to FIGS. 7 and 8, n = 3, and when this step is executed for the first time, the countermeasure crash damage degree L ₂ is calculated.

Countermeasure damage damage degree L ₂ = Regular access probability Z ₂ × Unauthorized acquisition probability Y ₂ × Asset damage degree D ₂ = 0.2 × 0.5 × 4 million yen = 400,000 yen.

When this step is executed for the second time, the countermeasure crash damage degree L ₁ is calculated.

Countermeasure damage damage degree L ₁ = Regular access probability Z ₁ × Unauthorized acquisition probability Y ₁ × Asset damage degree D ₁ = 0.5 × 0.4 × 4 million yen = 800,000 yen.

  When m = 0 (step S17; Yes), the process proceeds to step S19.

  S19: This is a step of inputting the threat occurrence frequency H.

  The user operates the input unit 218 to input the frequency of occurrence of the threat T, that is, the threat occurrence frequency H, in accordance with the GUI of the display unit 219. The threat occurrence frequency input unit 253 temporarily stores the input threat occurrence frequency H in the storage unit 213. In the example of the information system 220 described with reference to FIGS. 7 and 8, the threat occurrence frequency H is 4 (times / year).

  S20: This is a step of inputting the defense performance X.

The user operates the input unit 218 to input the probability that each countermeasure can prevent the intrusion of the threat T, that is, the defense performance X, according to the GUI of the display unit 219. The defense performance input unit 254 temporarily stores the input defense performance X in the storage unit 213. In the example of the information system 220 described with reference to FIGS. 7 and 8, the defense performance X ₁ of the countermeasure A is 0.5, the defense performance X ₂ of the countermeasure B is 0.8, and the defense performance X ₃ of the countermeasure C is 0. 4.

  S21: This is a step of calculating a security evaluation value B.

The security evaluation value calculation unit 256 calls a security evaluation value calculation routine to obtain security evaluation values B _{1 to} Bn calculated every time the threat T breaks through the _{1st to} nth countermeasures. Details of the security evaluation value calculation routine will be described later.

  S22: A system security evaluation value F is calculated.

The system security evaluation value calculation unit 257 calculates a system security evaluation value F by subtracting the sum of the security evaluation values B _{1 to} Bn calculated in step S 21 from the threat occurrence frequency H × the asset damage degree D.

In the example of the information system 220 described in FIG. 7 and FIG. 8, the threat occurrence frequency H is 4 (times / year), the asset damage degree D is 4 million yen, and the security evaluation value B ₁ is 128 (10,000 yen / year). The security evaluation value B ₂ is 6.4 (10,000 yen / year), and the security evaluation value B ₃ is 96 (10,000 yen / year). Therefore, the system security evaluation value F = 4 × 400− (128 + 6.4 + 96) = 396.6 (10,000 yen / year).

  The CPU 211 displays the calculated security evaluation value B and system security evaluation value F on the display unit 219.

  This is the end of the description of the main routine.

  Next, the procedure of the security evaluation value calculation routine of FIG. 3 will be described. As a specific example, a case where the information system 220 described with reference to FIGS. 7 and 8 is applied will be described.

  S100 is a step of setting m = n and c = n.

  The security evaluation value calculation unit 256 assigns the value of the number n of countermeasures to the variables m and c as initial values. In the example of FIGS. 7 and 8, m = c = 3.

  S101: This is a step of calculating the security evaluation value Bm = the asset damage degree D × the threat occurrence frequency H × (1−defense performance Xc).

The security evaluation value calculation unit 256 first calculates the security evaluation value Bm = the asset damage degree D × the threat occurrence frequency H × (1−protection performance Xc) in order to obtain the security evaluation value Bm when all countermeasures are broken. In the example of FIGS. 7 and 8, security evaluation value B ₃ = asset damage degree D × threat occurrence frequency H × (1-defense performance X ₃ ) = 4 million yen × 4 (times / year) × (1-0. 4) = 960 (10,000 yen / year).

  S102: A step of determining whether c = 1.

  The security evaluation value calculation unit 256 determines whether c = 1.

  When c ≠ 1, (step S102; No), the process proceeds to step S103.

  S103: This is a step of c = c-1.

  The security evaluation value calculation unit 256 sets c = c−1.

  S104: This is a step of calculating Bm = Bm × (1−Xc).

The security evaluation value calculation unit 256 calculates the security evaluation value Bm × (1−defense performance Xc) obtained in step S101. In the example of FIGS. 7 and 8, in the first processing of this step, a value obtained by multiplying the security evaluation value B ₃ calculated in step S101 by (1-defense performance X ₂ ) is calculated. That is, 960 (10,000 yen / year) × (1-0.8) = 192 (10,000 yen / year).

In the second processing of this step, a value obtained by multiplying the security evaluation value B ₃ calculated in the previous step S104 by (1-defense performance X ₁ ) is calculated. That is, 192 (10,000 yen / year) × (1-0.5) = 96 (10,000 yen / year).

  When c = 1 (step S102; Yes), the process proceeds to step S105.

  The calculation of the expression (5) is performed in the steps so far, and the security evaluation value Bm is calculated.

  S105: This is a step of setting m = n−1 and c = n.

  The security evaluation value calculation unit 256 substitutes n−1 for the variable m and n for the variable c. In the example of FIGS. 7 and 8, m = 2 and c = 3.

  S106: A step of determining whether m = 0.

  The security evaluation value calculation unit 256 determines whether m = 0.

  If m = 0 (step S106; Yes), the process ends and returns to the main routine.

  If m ≠ 0 (step S106; No), the process proceeds to step S107.

  S107: This is a step of calculating security evaluation value Bm = countermeasure damage severity Lm × threat occurrence frequency H × protection performance Xc.

  The security evaluation value calculation unit 256 first calculates the security evaluation value Bm when each of the measures provided up to the final countermeasure of the infringement route is broken through, first, security evaluation value Bm = countermeasure damage damage degree Lm × threat occurrence Frequency H × defense performance Xc is calculated.

In the example of FIGS. 7 and 8, since the number of countermeasures n = 3, the security evaluation value B ₂ is calculated when this step is executed for the first time. Security evaluation value B ₂ calculated in this step = Countermeasure damage severity L ₂ × Threat occurrence frequency H × Defense performance X ₃ = 400,000 yen × 4 (times / year) × 0.4 = 64 (10,000 yen / year) ).

  S108: A step of determining whether c = 1.

  The security evaluation value calculation unit 256 determines whether c = 1.

  When c ≠ 1, (step S102; No), the process proceeds to step S103.

  S109: This is the step of c = c-1.

  The security evaluation value calculation unit 256 sets c = c−1.

  S110: This is the step of Bm = Bm × (1−Xc).

  The security evaluation value calculation unit 256 multiplies the security evaluation value Bm obtained in step S101 by (1-defense performance Xc).

In the example of FIGS. 7 and 8, in the first processing of this step, a value obtained by multiplying the security evaluation value B ₂ calculated in step S107 by (1−defense performance X ₂ ) is calculated. That is, 64 (10,000 yen / year) × (1-0.8) = 12.8 (10,000 yen / year).

In the process of the second present step returns from step S108, a value obtained by multiplying (1-defense performance X ₁₎ to the security evaluation value B ₃ calculated in the previous step S110 is calculated. That is, the security evaluation value B ₂ = 1.28 (10,000 yen / year) × (1-0.5) = 6.4 (10,000 yen / year). Since the calculation of Expression (4) is performed in the second processing of this step, the security evaluation value B ₂ is obtained.

  S111: This is a step of setting m = m−1 and c = m + 1.

  The security evaluation value calculation unit 256 sets m = m−1 and c = m + 1. For example, m = 1 and c = 2.

  S112: A step of determining whether m = 0.

  The security evaluation value calculation unit 256 determines whether m = 0.

  If m ≠ 0 (step S112; No), the process returns to step S107.

For example, when m = 1, the process returns to step S107, and security evaluation value B ₁ = countermeasure damage damage degree L ₁ × threat occurrence frequency H × defense performance X ₂ is calculated. Perform step S108~ step S110, a value obtained by multiplying the security evaluation value B ₁ calculated (1-defense performance X ₁₎ at step S107 is calculated. That is, the security evaluation value B ₁ = 80 × 4 × (1-0.5) = 128 (10,000 yen / year). The calculation of Expression (3) is performed in a series of processes, and the security evaluation value B ₁ is obtained.

  If m = 0 (step S112; Yes), the process ends and returns to the main routine.

  This completes the description of the security evaluation value calculation routine.

  In the present embodiment, the security evaluation values B of all the countermeasures are calculated. However, for example, only the security evaluation value B of a specific countermeasure may be calculated.

  As described above, according to the present invention, each security evaluation value reflecting damage when a protected asset is illegally acquired from a terminal on a path for accessing the terminal in which the protected asset is stored, A security evaluation method and an information processing apparatus that are calculated for each terminal can be provided.

It is a block diagram which shows an example of the internal structure of the information processing apparatus 2 which concerns on embodiment of this invention. 6 is a flowchart illustrating a procedure of a security evaluation value calculation routine in which the information processing apparatus 2 calculates a security evaluation value in the embodiment of the present invention. 6 is a flowchart illustrating a procedure of a main routine for calculating a system security evaluation value in the embodiment of the present invention. In the embodiment of the present invention, it is an example of a GUI of a correspondence table that serves as a guide when a user inputs an unauthorized acquisition probability Y. In the embodiment of the present invention, it is an example of a GUI of a correspondence table that serves as a guide when a user inputs an unauthorized acquisition probability Y. In the embodiment of the present invention, it is an example of a GUI of a correspondence table that serves as a guide when a user inputs an unauthorized acquisition probability Y. It is explanatory drawing of an example of the information system used in order to demonstrate this embodiment. FIG. 8 is an explanatory diagram illustrating steps leading to a path for accessing a main information processing apparatus in which a threat is stored as an example of the information system 220 illustrated in FIG. 7.

Explanation of symbols

2 Information terminal device 5 Intranet 10 Terminal 11 Terminal 20 User 200 Server room 201 Entrance / exit management device 210 Communication unit 213 Storage unit 218 Input unit 219 Display unit 220 Information system 235 Paste button 250 Unauthorized acquisition probability input unit 251 Regular access probability input Section 252 Asset damage level input 253 Threat occurrence frequency input section 254 Defense performance input section 255 Countermeasure damage damage degree calculation section 256 Security evaluation value calculation section 257 System security evaluation value calculation section 258 Correspondence table display section

Claims (8)

In a security evaluation method for evaluating the security level of an information system in which a plurality of measures for preventing infringement by a threat to the asset are provided in a path to access a main information processing apparatus in which the asset to be protected is stored,
An unauthorized acquisition probability input step of inputting an unauthorized acquisition probability that the threat illegally acquires the asset accessed by a user having a legitimate authority after the threat breaks through the countermeasure;
A normal access probability input step of inputting a normal access probability which is a probability that the user is accessing the asset;
An asset damage level input step of inputting an asset damage level when the asset is infringed;
A countermeasure breakage damage degree calculating step for calculating a countermeasure breakage damage degree when the countermeasure is broken based on the unauthorized acquisition probability, the regular access probability, and the asset damage degree;
A threat occurrence frequency input step of inputting a threat occurrence frequency at which the threat infringes the asset; and
A defensive performance input step of inputting the defensive performance of the countermeasure to prevent the infringement;
A security evaluation value calculating step of calculating a security evaluation value based on the countermeasure damage damage degree, the threat occurrence frequency, and the defense performance;
A security evaluation method characterized by comprising: The security evaluation value calculating step includes a step of calculating a security evaluation value when all the countermeasures are broken based on the asset damage level, the threat occurrence frequency, and the defense performance. Item 2. The security evaluation method according to Item 1. The security evaluation method according to claim 2, further comprising a system security evaluation value calculation step of calculating a system security evaluation value from a sum of the security evaluation values calculated in the security evaluation value calculation step. Before the fraud acquisition probability input step,
The security evaluation method according to claim 1, further comprising a correspondence table display step of displaying a correspondence table in which a factor related to the fraud acquisition probability is associated with the fraud acquisition probability. . In an information processing apparatus that calculates an evaluation value related to a security level of an information system in which a plurality of measures for preventing infringement by a threat to the asset are provided in a path to access a main information processing apparatus in which assets to be protected are stored,
An unauthorized acquisition probability input means for inputting an unauthorized acquisition probability that the threat illegally acquires the asset accessed by a user having a legitimate authority after the threat has broken through the countermeasure;
Normal access probability input means for inputting a normal access probability that is a probability that the user is accessing the asset;
Asset damage level input means for inputting the asset damage level when the asset is infringed;
Countermeasure damage damage degree calculating means for calculating a countermeasure damage damage degree when the countermeasure is broken based on the unauthorized acquisition probability, the regular access probability, and the asset damage degree;
A threat occurrence frequency input means for inputting a threat occurrence frequency at which the threat infringes the asset;
Defensive performance input means for inputting the defensive performance of the countermeasure to prevent the infringement;
Security evaluation value calculating means for calculating a security evaluation value based on the countermeasure damage damage degree, the threat occurrence frequency, and the defense performance;
An information processing apparatus comprising: The said security evaluation value calculation means calculates the security evaluation value at the time of breaking through all the said countermeasures based on the said asset damage degree, the said threat occurrence frequency, and the said defense performance, The said evaluation values are characterized by the above-mentioned. Information processing device. The information processing apparatus according to claim 6, further comprising a system security evaluation value calculating unit that calculates a system security evaluation value from a sum of the security evaluation values calculated by the security evaluation value calculating unit. The information processing apparatus according to claim 5, further comprising: a correspondence table display unit that displays a correspondence table in which a factor related to the fraud acquisition probability and the fraud acquisition probability are associated with each other. .

Images