JP2011028613A - Countermeasure candidate generation system, countermeasure candidate generation method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a countermeasure candidate generation system and a countermeasure candidate generation method, for outputting candidates of countermeasures to vulnerability even if a handling method corresponding to vulnerability information cannot be acquired from the outside. <P>SOLUTION: The countermeasure candidate generation system includes a storage means and a generation means. The storage means stores, for each countermeasure to vulnerability in security, countermeasure information showing an item related to the vulnerability and the countermeasure in association with each other. The generation means refers to the storage means, upon acquisition of vulnerability information showing an item related to the vulnerability in security, to identify a countermeasure associated with the item shown by the vulnerability information from the countermeasures, and extracts the identified countermeasure from the countermeasure information as a countermeasure candidate. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a countermeasure candidate generation system, a countermeasure candidate generation method, and a program.

  Patent Literature 1 describes a vulnerability handling system that performs a handling process according to vulnerability information published on a network.

  In this system, first, the vulnerability information management server collects vulnerability information and countermeasure processing methods related to managed devices from the information providing site. Subsequently, the vulnerability information management server transmits an instruction to the management target device to perform the corresponding processing method.

JP 2002-268985 A

  In the system described in Patent Literature 1, if the information providing site does not disclose a countermeasure processing method corresponding to vulnerability information, the vulnerability information management server cannot acquire the countermeasure processing method. Therefore, in this case, the system described in Patent Document 1 has a problem that it is not possible to specify a handling method corresponding to vulnerability information.

  The objective of this invention is providing the countermeasure candidate production | generation system, countermeasure candidate production | generation method, and program which can solve the said subject.

  The countermeasure candidate generation system of the present invention includes a storage means for storing countermeasure information indicating the items related to the vulnerability and the countermeasures in association with each other for each countermeasure against the security-related vulnerabilities, and security vulnerabilities. When the vulnerability information indicating the item related to the sex is acquired, the storage unit is referred to, the countermeasure associated with the item indicated by the vulnerability information is identified from the countermeasures, and the identified countermeasure And generating means for extracting as countermeasure candidates from the countermeasure information.

  The countermeasure candidate generation method of the present invention is a countermeasure candidate generation method in a countermeasure candidate generation system, in which, for each countermeasure against security-related vulnerabilities, a matter related to the vulnerability and the countermeasure are associated with each other. A storage step of storing the indicated countermeasure information in the storage means, and obtaining vulnerability information indicating items related to security-related vulnerabilities; referring to the storage means, the vulnerability information from among the countermeasures And a generation step of identifying a countermeasure associated with the item indicated by the item and extracting the identified countermeasure from the countermeasure information as a countermeasure candidate.

  The program of the present invention stores, in a storage means, countermeasure information indicating the items related to the vulnerability and the countermeasures in association with each other for each countermeasure against the security-related vulnerability, When acquiring vulnerability information indicating items related to security vulnerabilities, referring to the storage means, the countermeasures associated with the items indicated by the vulnerability information are identified from the countermeasures, and the identification is performed. And a generation procedure for extracting the taken countermeasures as countermeasure candidates from the countermeasure information.

  According to the present invention, it is possible to identify a candidate for countermeasures against vulnerability even if a response processing method corresponding to vulnerability information cannot be acquired from the outside.

It is the block diagram which showed the countermeasure candidate production | generation system 1 of 1st Embodiment of this invention. It is the figure which showed an example of countermeasure information. It is the figure which showed an example of vulnerability information. 5 is a flowchart for explaining the operation of the measure candidate generation system 1; It is the figure which showed an example of the countermeasure candidate. It is the block diagram which showed the countermeasure candidate production | generation system 1A of 2nd Embodiment of this invention. It is the figure which showed an example of system information. It is a flowchart for demonstrating operation | movement of the countermeasure candidate production | generation system 1A.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 is a block diagram showing a countermeasure candidate generation system 1 according to the first embodiment of the present invention. In FIG. 1, a countermeasure candidate generation system 1 includes a countermeasure information storage unit 2, a vulnerability information storage unit 3, a vulnerability countermeasure candidate generation unit (hereinafter simply referred to as “generation unit”) 4, and a countermeasure candidate storage unit. And 5.

  The countermeasure information storage unit 2 can be generally referred to as storage means. The countermeasure information storage unit 2 stores countermeasure information. The countermeasure information indicates items related to the vulnerability and countermeasures in association with each other for each countermeasure against the security-related vulnerability (hereinafter simply referred to as “vulnerability”).

  FIG. 2 is a diagram showing an example of the countermeasure information 2A. The countermeasure information 2A is not limited to that shown in FIG.

  In FIG. 2, countermeasure information 2A indicates, for each countermeasure 2a, a threat type 2b, an attack property 2c, an asset property 2d, a measure property 2e, and a measure 2a in association with each other. The threat type 2b, the attack property 2c, the asset property 2d, and the countermeasure property 2e are items related to vulnerability.

  The countermeasure 2a indicates a countermeasure (countermeasure name) against a vulnerability related to at least one of the threat type 2b, the attack property 2c, the asset property 2d, and the countermeasure property 2e. The measure 2a indicates, for example, a measure as a system for vulnerability.

  The threat type 2b indicates the type of threat for which the countermeasure 2a associated with the threat type 2b is effective. The threat type 2b means the influence of vulnerability.

  The attack nature 2c indicates the nature of the attack that causes the threat type 2b associated with the attack nature 2c. The nature 2c of the attack includes one or more of an attack performer (attacker) 2c1, an attack path 2c2, and an attack type 2c3. The attack nature 2c necessarily includes the attack type 2c3.

  The property 2d of the asset indicates the property of the asset to be attacked. The property 2d of the asset includes at least one of the asset type (form) 2d1 and the position (state) 2d2 where the asset is placed.

  The measure property 2e indicates the property of the measure 2a associated with the measure property 2e. The nature 2e of the countermeasure includes at least one of the countermeasure embodiment or place 2e1 and the type of countermeasure (layer of countermeasure such as application level or middleware level, or type of vulnerability that can be dealt with) 2e2. Including.

  Returning to FIG. 1, the vulnerability information storage unit 3 stores vulnerability information. For example, the vulnerability information storage unit 3 stores vulnerability information published on the WEB by a vulnerability information provider (for example, an application manufacturer).

  Vulnerability information is information in which vulnerabilities and vulnerability properties are associated with each other. The vulnerability information indicates items related to the vulnerability (for example, the influence of the vulnerability, the type of the vulnerability, the type of attack corresponding to the vulnerability, and the route of the attack). Note that the vulnerability information may indicate at least one of the impact due to the vulnerability, the type of vulnerability, the type of attack corresponding to the vulnerability, and the path of the attack as items related to the vulnerability.

  FIG. 3 is a diagram showing an example of vulnerability information 3A. The vulnerability information 3A is not limited to that shown in FIG. 3, but can be changed as appropriate.

  In FIG. 3, “attack source category: network” indicates a path of the attack. “Impact on confidentiality (C): Partial” indicates the impact of vulnerability. “Vulnerability type: OS command injection” indicates the type of vulnerability.

  Returning to FIG. 1, the generation unit 4 can be generally referred to as generation means.

  When the generation unit 4 acquires the vulnerability information from the vulnerability information storage unit 3, the generation unit 4 refers to the countermeasure information storage unit 2 and refers to the countermeasure associated with the item indicated by the vulnerability information (that is, the vulnerability). Identify measures that can invalidate the vulnerabilities indicated by the information.

  The generation unit 4 extracts the identified countermeasure from the countermeasure information as a countermeasure candidate. The generation unit 4 stores the countermeasure candidate in the countermeasure candidate storage unit 5.

  Note that the generation unit 4 may acquire vulnerability information input from a user or the like without extracting the vulnerability information from the vulnerability information storage unit 3.

  Here, the “measure candidate” is a list of conditions that must be satisfied in order to protect the computer system from threats, and describes the presence or absence of countermeasures and the state that the system should satisfy.

  The countermeasure candidate generation system 1 may be a computer such as a server, for example. In this case, the computer reads and executes a program recorded on a computer-readable recording medium, whereby the countermeasure information storage unit 2, the vulnerability information storage unit 3, the generation unit 4, and the countermeasure candidate storage unit 5 Function as. The computer-readable recording medium is, for example, a CD-ROM (Compact Disk Read Only Memory), a hard disk, or a memory.

  Each of the countermeasure information storage unit 2, the vulnerability information storage unit 3, the generation unit 4, and the countermeasure candidate storage unit 5 may be realized by dedicated hardware.

  Next, the operation will be described.

  FIG. 4 is a flowchart for explaining the operation of the measure candidate generation system 1. Hereinafter, the operation of the countermeasure candidate generation system 1 will be described with reference to FIG. In the following, it is assumed that the countermeasure information storage unit 2 stores the countermeasure information 2A illustrated in FIG. 2, and the vulnerability information storage unit 3 stores the vulnerability information 3A illustrated in FIG. .

  First, in step S <b> 41, the generation unit 4 extracts vulnerability information 3 </ b> A from the vulnerability information storage unit 3. Alternatively, the generation unit 4 accepts vulnerability information 3A input from a user or the like. When the generation unit 4 acquires the vulnerability information 3A, the generation unit 4 executes Step S42.

  In step S42, the generation unit 4 refers to the countermeasure information storage unit 2 and identifies a countermeasure associated with the item indicated by the vulnerability information 3A from among a plurality of countermeasures indicated in the countermeasure information 2A.

  Here, step S42 will be specifically described.

  The generation unit 4 first extracts information necessary for extracting a countermeasure from the countermeasure information 2A from the vulnerability information 3A (see FIG. 3). Here, three pieces of information of “attack source category: network”, “impact on confidentiality: partial”, and “vulnerability type: OS command injection” are extracted.

  Next, the generation unit 4 uses these pieces of information to identify a countermeasure from the countermeasure information 2A (see FIG. 2).

  Specifically, the generation unit 4 has the associated threat type 2b of the countermeasures indicated in the countermeasure information 2A as “confidentiality” and the associated attack path 2c2 as “network”. Furthermore, a countermeasure whose associated countermeasure type (type of vulnerability that can be dealt with) 2e2 includes “OS command injection” is specified.

  Furthermore, the generation unit 4 also identifies a countermeasure whose associated countermeasure type (a vulnerability type that can be dealt with) 2e2 indicates “all”.

  For this reason, the generation unit 4 determines from the countermeasure information 2A shown in FIG. 2 that “encryption of the specific file”, “prohibit execution of other than the specific file”, “patch application”, and “disconnect the network”. 4 measures are identified.

  That is, it can be seen that any one of the four countermeasures extracted by the generation unit 4 may be executed as a countermeasure for invalidating the vulnerability represented by the vulnerability information 3A shown in FIG.

  After identifying the countermeasure, the generation unit 4 executes Step S43.

  In step S43, the generation unit 4 extracts the identified countermeasure from the countermeasure information 2A as a countermeasure candidate. When the generation unit 4 extracts the countermeasure candidates, the generation unit 4 executes Step S44.

  In step S44, the generation unit 4 stores the countermeasure candidates in the countermeasure candidate storage unit 5.

  FIG. 5 is a diagram illustrating an example of countermeasure candidates stored in the countermeasure candidate storage unit 5.

  In FIG. 5, the part to which the underline is given is a countermeasure candidate newly generated for the vulnerability information 3A by the current operation.

  Next, the effect of this embodiment will be described.

  In the present embodiment, the countermeasure information storage unit 2 stores countermeasure information in which items related to vulnerability and countermeasures are associated with each other for each countermeasure against vulnerability. When acquiring the vulnerability information, the generation unit 4 identifies a countermeasure associated with the item indicated by the vulnerability information from the countermeasures indicated in the countermeasure information, and uses the identified countermeasure as the countermeasure information. Extract from

  For this reason, even if the response processing method corresponding to vulnerability information is not disclosed, it becomes possible to specify the countermeasure candidate corresponding to vulnerability information. This effect can also be achieved by a countermeasure candidate generation system including the countermeasure information storage unit 2 and the generation unit 4.

  In addition, every time vulnerability information is acquired, security experts do not need to create countermeasure candidates corresponding to the vulnerability information, so countermeasure candidates that invalidate the vulnerability represented by the vulnerability information with little effort. Can be specified.

  For example, even when vulnerabilities including software bugs appear intermittently, it is possible to quickly identify countermeasure candidates for invalidating the vulnerabilities without relying on an expert.

  In addition, when new vulnerability information is disclosed or new vulnerability information is created, it is possible to quickly identify countermeasure candidates.

  In the present embodiment, the items related to the vulnerability may indicate at least one of the influence of the vulnerability, the type of the vulnerability, the type of attack that causes the vulnerability, and the path of the attack.

  In this case, measures that can prevent the occurrence of threats related to the vulnerability can be listed as countermeasure candidates.

  In the present embodiment, the countermeasure indicated in the countermeasure information indicates a countermeasure against the vulnerability as a system.

  In this case, even when vulnerabilities appear intermittently, after taking into account the nature of individual vulnerabilities, countermeasure candidates including methods for preventing the occurrence of threats related to vulnerabilities in the entire system are selected. Can be generated.

(Second Embodiment)
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 6 is a block diagram showing a countermeasure candidate generation system 1A according to the second embodiment of this invention. In FIG. 6, in addition to the countermeasure candidate generation system 1 shown in FIG. 1, the countermeasure candidate generation system 1A includes a system information collection unit 6, a system information storage unit 7, a countermeasure generation policy input unit 8, and a countermeasure planning unit. 9 and a countermeasure setting unit 10. In FIG. 6, the same components as those shown in FIG. Hereinafter, the countermeasure candidate generation system 1A will be described focusing on differences from the countermeasure candidate generation system 1.

  The system information collecting unit 6 can be generally called collecting means. The system information collection unit 6 collects system information indicating measures that can be executed by a system that is a candidate for execution of measures. The system information collection unit 6 stores system information in the system information storage unit 7.

  FIG. 7 is a diagram showing an example of system information.

  Returning to FIG. 6, the measure generation policy input unit 8 accepts a measure generation policy input by the user. The measure generation policy indicates a guideline for measures to be satisfied.

  The measure planning unit 9 can be generally called planning means.

  Based on the countermeasure candidates in the countermeasure candidate storage section 5 and the system information in the system information storage section 7, the countermeasure planning section 9 selects countermeasure candidates that can be executed by the system that is the countermeasure execution candidate among the countermeasure candidates. Develop as a countermeasure for execution.

  In the present embodiment, the countermeasure planning unit 9 uses the countermeasure candidate in the countermeasure candidate storage unit 5 and the system information in the system information storage unit 7 to execute a countermeasure candidate that matches the countermeasure generation policy for execution. Develop as a countermeasure.

  The countermeasure setting unit 10 implements the countermeasures formulated by the countermeasure planning unit 9 using a setting management tool such as an SNMP (Simple Network Management Protocol) or a CIM (Computer Integrated Manufacturing) manager.

  The countermeasure candidate generation system 1A may be a computer such as a server, for example. In this case, the computer reads and executes a program recorded on a computer-readable recording medium, whereby the countermeasure information storage unit 2, the vulnerability information storage unit 3, the generation unit 4, the countermeasure candidate storage unit 5, and the system It functions as an information collection unit 6, a system information storage unit 7, a measure generation policy input unit 8, a measure planning unit 9, and a measure setting unit 10. The countermeasure information storage unit 2, vulnerability information storage unit 3, generation unit 4, countermeasure candidate storage unit 5, system information collection unit 6, system information storage unit 7, countermeasure generation policy input unit 8, countermeasure planning unit 9, and countermeasure Each of the setting units 10 may be realized by dedicated hardware.

  Next, the operation will be described.

  FIG. 8 is a flowchart for explaining the operation of the measure candidate generation system 1A. In FIG. 8, the same processes as those of the countermeasure candidate generation system 1 shown in FIG. Hereinafter, an operation different from the processing of the countermeasure candidate generation system 1 will be mainly described with reference to FIG.

  When step S44 ends, step S81 is executed.

  In step S81, the measure generation policy input unit 8 receives a measure generation policy from the user. When the countermeasure generation policy input unit 8 receives the countermeasure generation policy, the countermeasure generation policy input unit 8 outputs the countermeasure generation policy to the countermeasure planning unit 9. When the countermeasure planning unit 9 receives the countermeasure generation policy, it executes Step S82.

  In step S82, the measure planning unit 9 selects a measure candidate that matches the measure generation policy based on the measure candidate in the measure candidate storage unit 5 and the system information in the system information storage unit 7, as a measure for execution. As a plan.

  For example, when the countermeasure generation policy indicates that “a countermeasure candidate that can be executed by a system that is a countermeasure execution candidate among countermeasure candidates is a countermeasure for execution”, the countermeasure planning unit 9 sets the countermeasure candidate as a countermeasure candidate. By applying system information and solving it as a general satisfiable problem, the measures for execution are calculated.

  When the countermeasure planning unit 9 formulates a countermeasure for execution, the countermeasure planning unit 9 sends the countermeasure for execution to the countermeasure setting unit 10. When the measure setting unit 10 receives a measure for execution, the measure setting unit 10 executes step S83.

  In step S83, the measure setting unit 10 executes a measure for execution using the setting management tool.

  Next, the effect of this embodiment will be described.

  In this embodiment, in addition to the effects exhibited by the first embodiment, the following effects are achieved.

  According to the present embodiment, the measure planning unit 9 can execute a measure that can be executed by the system that is a measure execution candidate based on the measure candidate in the measure candidate storage unit 5 and the system information in the system information storage unit 7. To plan.

  In this case, it is possible to devise a measure corresponding to the system that is a candidate for executing the measure.

  In each embodiment described above, the illustrated configuration is merely an example, and the present invention is not limited to the configuration.

DESCRIPTION OF SYMBOLS 1, 1A countermeasure candidate generation system 2 Countermeasure information storage part 3 Vulnerability information storage part 4 Vulnerability countermeasure candidate generation part 5 Countermeasure candidate storage part 6 System information collection part 7 System information storage part 8 Countermeasure generation policy input part 9 Countermeasure planning part 10 Countermeasure setting part

Claims (12)

For each countermeasure against security vulnerabilities, storage means for storing countermeasure information indicating the items related to the vulnerability and the countermeasures in association with each other;
When acquiring vulnerability information indicating items related to security vulnerabilities, referring to the storage means, the countermeasures associated with the items indicated by the vulnerability information are identified from the countermeasures, and the identification is performed. And a generation means for extracting the countermeasures taken as countermeasure candidates from the countermeasure information. In the countermeasure candidate generation system according to claim 1,
The matter related to the vulnerability indicates at least one of the influence of the vulnerability, the type of the vulnerability, the type of attack corresponding to the vulnerability, and the route of the attack. Candidate generation system. In the countermeasure candidate generation system according to claim 1 or 2,
The countermeasure is a countermeasure candidate generation system indicating a countermeasure as a system against the vulnerability. In the countermeasure candidate production | generation system of any one of Claim 1 to 3,
A collection means for collecting system information indicating measures that can be executed by the system that is a candidate for execution of measures;
A countermeasure candidate further comprising, based on the countermeasure candidate and the system information, a planning means for planning a countermeasure candidate that can be executed by the system that is the countermeasure execution candidate among the countermeasure candidates as a countermeasure for execution. Generation system. A countermeasure candidate generation method in the countermeasure candidate generation system,
For each countermeasure against security vulnerabilities, a storage step of storing in the storage means countermeasure information indicating the items related to the vulnerability and the countermeasures in association with each other;
When acquiring vulnerability information indicating items related to security vulnerabilities, referring to the storage means, the countermeasures associated with the items indicated by the vulnerability information are identified from the countermeasures, and the identification is performed. And a generation step of extracting the taken countermeasures as countermeasure candidates from the countermeasure information. In the countermeasure candidate generation method according to claim 5,
The matter related to the vulnerability indicates at least one of the influence of the vulnerability, the type of the vulnerability, the type of attack corresponding to the vulnerability, and the route of the attack. Candidate generation method. In the countermeasure candidate production | generation method of Claim 5 or 6,
The countermeasure is a countermeasure candidate generation method, which indicates a countermeasure against the vulnerability as a system. In the countermeasure candidate production | generation method of any one of Claim 5 to 7,
A collection step for collecting system information indicating measures that can be executed by a system that is a candidate for taking measures;
A candidate for countermeasure, further comprising a planning step of planning a countermeasure candidate that can be executed by the system that is the countermeasure execution candidate among the countermeasure candidates based on the countermeasure candidate and the system information as a countermeasure for execution Generation method. On the computer,
For each countermeasure against security vulnerabilities, a storage procedure for storing countermeasure information indicating the items related to the vulnerability and the countermeasures in association with each other in a storage means;
When acquiring vulnerability information indicating items related to security vulnerabilities, referring to the storage means, the countermeasures associated with the items indicated by the vulnerability information are identified from the countermeasures, and the identification is performed. A program for executing a generation procedure for extracting a taken countermeasure from the countermeasure information as a countermeasure candidate. The program according to claim 9,
The item related to the vulnerability indicates at least one of the influence of the vulnerability, the type of the vulnerability, the type of attack corresponding to the vulnerability, and the path of the attack, . The program according to claim 9 or 10,
The countermeasure is a program indicating a countermeasure against the vulnerability as a system. The program according to any one of claims 9 to 11,
In the computer,
A collection procedure that collects system information indicating the countermeasures that can be performed by the system that is the candidate for countermeasure execution;
Based on the countermeasure candidate and the system information, a plan procedure for planning a countermeasure candidate that can be executed by the system that is the countermeasure execution candidate among the countermeasure candidates as a countermeasure for execution is further executed. program.

Images