JP2015106215A - Risk analysis device and risk analysis program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security risk analysis method that can objectively set the value of an information asset.SOLUTION: A risk analysis device 100 inputs a plurality of information assets of an analysis object product, and a harmful event which is an event harmful to at least any of the input plurality of information assets, and associates each the information asset with the harmful event which is harmful to determine the value of each the information asset in accordance with the number of the associated harmful events. The risk analysis device 100 then calculates a risk value of a threat for the analysis object product on the basis of the determined value.

Description

  The present invention relates to a technology for performing security risk analysis in products and systems.

  In order to design a product security, it is first necessary to clarify the security measures to be implemented in the product. Therefore, it is necessary to conduct security risk analysis and clarify the security threats and risks to be taken.

  Patent Document 1 describes a security risk analysis method. In Patent Document 1, first, information assets to be protected in a product to be analyzed are clarified. Information assets include information such as personal information and functions related to the information. Next, clarify the possible threats to information assets in the analysis target product. Thereafter, the risk value of each threat is determined by using the value of the information asset in the analysis target product and the possibility of the threat occurring in the analysis target product.

JP 2009-230278 A

However, it was difficult to objectively set the value of the information assets of the analyzed products.
For example, in Patent Document 1, an analyst sets values in four stages from 0 to 3 from the viewpoint of confidentiality, integrity, and availability of information assets. However, it is very difficult for analysts who have no analysis experience to set values objectively for all information assets.
An object of the present invention is to provide a security risk analysis method that can objectively set the value of information assets.

The risk analysis apparatus according to the present invention is:
An information asset input unit for inputting a plurality of information assets of the analysis target product;
A harmful event input unit for inputting a harmful event that is a harmful event for at least one of the plurality of information assets input by the information asset input unit;
For each information asset, among the adverse events input by the adverse event input unit, an associating unit for associating the harmful event harmful to the information asset,
An asset value determination unit that determines the value of each information asset according to the number of harmful events associated by the association unit;
A risk value calculation unit that calculates a risk value of a threat to the analysis target product based on the value determined by the asset value calculation unit.

  In the risk analysis apparatus according to the present invention, the value of each information asset is determined according to the number of harmful events associated with each information asset, and the risk value is calculated based on the calculated value. Therefore, even an analyst with no analysis experience can easily determine the value of each information asset and perform risk analysis.

1 is a configuration diagram of a risk analysis apparatus 100 according to Embodiment 1. FIG. 4 is a flowchart showing the operation of the risk analysis apparatus 100 according to the first embodiment. The figure which shows the model 32. FIG. The figure which shows the asset event correspondence table 41. FIG. The figure which shows the result of having counted the number of corresponding harmful events for every security characteristic of an information asset based on the asset event correspondence table 41 shown in FIG. The figure which shows the example which defined the number of events corresponding to the value of an information asset. The figure which shows the asset value table. The figure which shows the example which defined the number of events corresponding to the value of an information asset. The block diagram of the risk analysis apparatus 100 which concerns on Embodiment 2. FIG. 9 is a flowchart showing the operation of the risk analysis apparatus 100 according to the second embodiment. The figure which shows the severity input with respect to the adverse event. The figure which shows the asset event correspondence table 41. FIG. The figure which shows the seriousness degree asset value correspondence table. The figure which shows the asset value table. 10 is a flowchart showing the operation of the risk analysis apparatus 100 according to the third embodiment. The figure which shows the seriousness degree asset value correspondence table. The figure which shows the asset value table. FIG. 6 is a configuration diagram of a risk analysis apparatus 100 according to a fourth embodiment. 10 is a flowchart showing the operation of the risk analysis apparatus 100 according to the fourth embodiment. The figure which shows the threat information 33. The figure which shows the threat identified for every object. The figure which shows the risk value calculated with respect to the information asset. The figure which shows the risk value calculated with respect to the component. The figure which shows the example of the hardware constitutions of the risk analysis apparatus 100 shown to Embodiment 1-4.

Embodiment 1 FIG.
FIG. 1 is a configuration diagram of a risk analysis apparatus 100 according to the first embodiment.
The risk analysis apparatus 100 includes an input unit 10, a risk analysis unit 20, a common information storage unit 30, and an analysis information storage unit 40.

The input unit 10 is a man-machine interface with an analyst. The input unit 10 includes an information asset input unit 11, a harmful event input unit 12, and a correspondence unit 13.
The information asset input unit 11 inputs information assets of the analysis target product. The harmful event input unit 12 inputs a harmful event that is a harmful event. The association unit 13 associates each information asset input by the information asset input unit 11 with the harmful event input by the harmful event input unit 12.

The risk analysis unit 20 performs risk analysis of information assets based on the information input by the input unit 10. The risk analysis unit 20 includes an asset value determination unit 21 and a risk value calculation unit 22.
The asset value determination unit 21 determines the value of each information asset according to the number of harmful events associated with the association unit 13. The risk value calculation unit 22 calculates the risk value of the threat to the analysis target product based on the value determined by the asset value determination unit 21.

The common information storage unit 30 is a storage device that stores common information used in performing risk analysis. The common information storage unit 30 stores harmful event information 31, a template 32, and threat information 33.
The harmful event information 31 is information indicating harmful events input in the past. The template 32 is a template used when an analyst inputs an adverse event. The threat information 33 is information indicating the possibility of occurrence of each threat generated on the analysis target product and the range affected by each threat.

The analysis information storage unit 40 is a storage device that stores the results of risk analysis and information about progress. The analysis information storage unit 40 stores an asset event correspondence table 41 and an asset value table 42.
The asset event correspondence table 41 is a table in which information assets and harmful events are associated with each other. The asset value table 42 is a table showing the asset value for each information asset.

FIG. 2 is a flowchart showing the operation of the risk analysis apparatus 100 according to the first embodiment.
Here, an example in which an in-vehicle device system is used as a risk analysis target (analysis target product) will be described. The target of risk analysis is not limited to the in-vehicle device system, but may be other products or systems.

  First, the information asset input unit 11 inputs the information asset of the analysis target product (S101). Information assets include information such as personal information and functions related to the information. Here, it is assumed that a program, a parameter, sensor information, and a command are input as information assets.

Next, the harmful event input unit 12 inputs a harmful event (S102 to S105). The harmful event is an inconvenient event in the analysis target product, and includes an event related to security and an event not related to security.
First, the harmful event input unit 12 selects whether or not to input a harmful event using past data (S102). When diverting past data (YES in S102), the harmful event input unit 12 reads the harmful event information 31 stored in the common information storage unit 30, and inputs the read harmful event information 31 (S103). The harmful event input unit 12 may select and input some harmful events without inputting all the harmful events indicated by the read harmful event information 31. On the other hand, when the past data is not used (NO in S102), the harmful event input unit 12 reads the template 32 stored in the common information storage unit 30 (S104), and inputs the harmful event according to the template 32 (S105). ). The harmful event input unit 12 may directly input a harmful event in S105 without using the template 32.

FIG. 3 is a diagram showing the template 32.
The template 32 illustrates various harmful events. Some adverse events are partially hidden characters, and specific adverse events can be expressed by changing the hidden characters depending on the product subject to risk analysis. . Thus, by using the harmful event template 32, harmful events can be input efficiently, and even an analyst with no analysis experience can input easily.

  Here, it is assumed that a brake illegal operation, an engine illegal operation, a personal information leak, a speedometer illegal display, and an air conditioner illegal operation are input as harmful events.

  Next, the associating unit 13 associates the information asset input in S101 with the harmful event input in S103 or S105, generates an asset event correspondence table 41, and stores it in the analysis information storage unit 40. Store (S106).

FIG. 4 is a diagram showing the asset event correspondence table 41.
In the asset event correspondence table 41, the information asset column is arranged on the vertical axis, and the harmful event column is arranged on the horizontal axis. In particular, for information assets, a column is provided for each security characteristic of confidentiality, integrity, and availability. When the security characteristic of the information asset corresponds to the harmful event, “○” is attached to the intersection, and “×” is attached when it does not correspond. The correspondence between the security characteristic of an information asset and a harmful event means that a harmful event may occur when the security characteristic of the information asset is compromised.
For example, in FIG. 4, “◯” is attached because the confidentiality of the command corresponds to the leakage of personal information. This means that if the confidentiality of the command is lost, a harmful event such as leakage of personal information of the in-vehicle device system may occur. This association can be easily set even by an analyst who has no risk analysis experience, as long as the analyst has knowledge of the vehicle-mounted device system that is the subject of risk analysis.

  The association unit 13 displays, for example, the asset event correspondence table 41 without “O” and “X” on the display device, and allows the analyst to input “O” and “X”. The asset event correspondence table 41 may be generated.

  Next, the asset value determination unit 21 counts the number of security characteristics of the corresponding information asset for each harmful event based on the asset event correspondence table 41 (S107). The asset value determination unit 21 determines whether or not there is a harmful event with the number of security characteristics of the corresponding information asset being 0 (S108), and if there is (S108), notifies the analyst to that effect and performs processing. To S102. At this time, the analyst may be asked whether or not a re-input of the harmful event is necessary, and the process may be returned to S102 if necessary.

  Note that the asset value determination unit 21 counts the number of harmful events corresponding to all the security characteristics of each information asset, and if there is an information asset with a corresponding number of harmful events of 0, notifies that fact. However, the process may be returned to S102.

Next, the asset value determination unit 21 counts the number of corresponding harmful events for each security characteristic of the information asset based on the asset event correspondence table 41 (S109).
FIG. 5 is a diagram showing a result of counting the number of corresponding harmful events for each security characteristic of the information asset based on the asset event correspondence table 41 shown in FIG.

Next, the asset value determination unit 21 extracts the maximum number of harmful events counted in S109 (S110), and uses the extracted maximum value to uniformly define the number of harmful events corresponding to each value. (S111).
FIG. 6 is a diagram illustrating an example in which the number of events corresponding to the value of the information asset is defined.
In FIG. 6, the value of the information asset is set in four stages: high, medium, low, and nothing. In addition, values 3, 2, 1, and 0 indicating values are assigned to high, medium, low, and non-values of information assets, respectively. Then, the number of events where the value of the information asset has no value is set to 0, and “(maximum value of the number of harmful events−1) / (number of stages of the value of the information asset−1)” for one value level. Assigned.
Here, in FIG. 5, the maximum value of the number of adverse events is “4” of the integrity of the program. In addition, the number of value stages of the information asset is “4”: high, medium, low, and none. Therefore, “(4-1) / (4-1) = 1” is assigned to one value level. That is, 1 ≦ n <2 is assigned to the number n of adverse events having a low value, 2 ≦ n <3 is assigned to the number n of adverse events having a medium value, and 3 ≦ n to the number n of high-value adverse events. ≦ 4 is assigned.
Here, the higher the value, the larger the value indicating the value. However, conversely, the higher the value, the smaller the value indicating the value.

Next, the asset value determination unit 21 determines a value for each security characteristic of the information asset according to the number of harmful events defined in S110, generates an asset value table 42, and stores it in the analysis information storage unit 40. Store (S112).
FIG. 7 is a diagram showing the asset value table 42.
In the asset value table 42, the information asset column is arranged on the vertical axis, and the security characteristic column is arranged on the horizontal axis. And the value which shows value is set to the intersection.
For example, the integrity of the program is high (3) because the number of corresponding adverse events is four. The completeness of the command is medium (2) because the number of corresponding adverse events is two.

Then, the risk value calculation unit 22 calculates a risk value for the in-vehicle device system of a threat that may occur to the in-vehicle device system based on the value for each security characteristic of the information asset determined in S112 (S113).
For example, the risk value calculation unit 22 reads out the possibility of occurrence of each threat generated in the in-vehicle device system and the range affected by each threat indicated by the threat information 33 stored in the common information storage unit 30. Then, the risk value calculation unit 22 calculates, for each threat, the product of the possibility of occurrence of the threat and the value of the security characteristic of each information asset included in the range affected by the threat, of the information asset of the threat. Calculated as a risk value for security characteristics. The risk value calculation unit 22 calculates the total of the calculated risk values for each threat as a risk value for the in-vehicle device system of the threat. Of course, not only this but the risk value calculation part 22 may calculate a risk value by another method.

As described above, in the risk analysis apparatus 100 according to the first embodiment, the value of the information asset is determined according to the number of harmful events corresponding to the information asset, and the risk value of the analysis target product is calculated based on the determined value. calculate.
Although it is difficult for an analyst with little analysis experience to determine the value of an information asset, using the risk analysis apparatus 100 according to Embodiment 1, the analyst only associates an information asset with an adverse event. Can determine the value of information assets. Therefore, even an analyst with little analysis experience can easily perform security risk analysis.

  In the above description, the value of information assets is set to four levels: high, medium, low, and nothing. However, the present invention is not limited to this, and it may be in 5 stages or 6 stages.

In the above description, the number of events corresponding to each value of the information asset is defined using the maximum number of harmful events counted in S109. However, the number of events corresponding to each value of the information asset may be defined using the set number of harmful events.
For example, “(number of harmful events−1) / (number of stages of information asset value−1)” may be assigned to one level of information asset value.
In this case, in FIG. 5, the number of harmful events is 5, and the number of value stages of the information asset is “4” of high, medium, low, and none, so “(5 -1) / (4-1) = 1.33 ". That is, as shown in FIG. 8, 1 ≦ n <2.33 is assigned to the number n of events having a low value, and 2.33 ≦ n <3.67 is assigned to the number n of events having a medium value. 3.67 ≦ n ≦ 5 is assigned to the number n of high events.

Embodiment 2. FIG.
In the first embodiment, the value of the information asset is determined from the number of harmful events corresponding to the information asset. However, the severity of the impact on the analyzed product may vary depending on the adverse event. In the second embodiment, a method for determining the value of an information asset using this seriousness will be described.
In the second embodiment, description of the same parts as those of the first embodiment will be omitted, and parts different from those of the first embodiment will be described.

FIG. 9 is a configuration diagram of the risk analysis apparatus 100 according to the second embodiment.
The risk analysis apparatus 100 shown in FIG. 9 relates to the first embodiment shown in FIG. 1 in that the input unit 10 includes the severity input unit 14 and the common information storage unit 30 stores the severity asset value correspondence table 34. Different from the risk analysis apparatus 100.
The severity input unit 14 inputs a severity indicating the seriousness of the adverse event. The seriousness asset value correspondence table 34 is a table in which the value of the information asset is associated with each seriousness.

FIG. 10 is a flowchart showing the operation of the risk analysis apparatus 100 according to the second embodiment.
Here, as in the first embodiment, an example in which an in-vehicle device system is used as a risk analysis target will be described. The target of risk analysis is not limited to the in-vehicle device system, but may be other products or systems.

The processing from S201 to S205 is the same as the processing from S101 to S105 shown in FIG.
Following the processing of S205, the severity input unit 14 inputs the severity for each harmful event input in S205 (S206). Here, when diverting past data, the severity is associated with each harmful event indicated by the harmful event information 31 read in S203. However, even when past data is used, the severity may be input for each input adverse event.

FIG. 11 is a diagram illustrating the severity level input for an adverse event.
As described above, the risk analysis target is the in-vehicle device system. Therefore, in FIG. 11, based on the website (http://www.ipa.go.jp/security/vuln/SeverityLevel2.html), the impact on the in-vehicle device system is very “danger”, and the impact is “ Severity levels are set in three levels: “Warning” and “Caution” that has some influence.
The severity can be easily set even by an analyst who has no analysis experience if the analysis target product has knowledge.

  The processing from S207 to S209 is the same as the processing from S106 to S108 shown in FIG.

FIG. 12 is a diagram showing the asset event correspondence table 41.
The asset event correspondence table 41 shown in FIG. 12 is basically the same as the asset event correspondence table 41 shown in FIG. 4 except that the severity input in S206 for each harmful event is shown.

Subsequent to the processing of S209, the asset value determination unit 21 identifies the most serious harmful event among the corresponding harmful events for each security property of the information asset (S210).
For example, as shown in FIG. 12, in the case of program availability, “engine unauthorized operation”, “speedometer unauthorized display”, and “air conditioner unauthorized operation” correspond to harmful events. And the severity of each harmful event is “engine illegal operation” is dangerous, “speedometer illegal display” is warning, and “air conditioner illegal operation” is caution, so “engine illegal operation” with the highest severity is identified Is done.

  Next, the asset value determination unit 21 determines the value of the information asset according to the severity of the specified harmful event according to the severity asset value correspondence table 34, generates the asset value table 42, and stores the analysis information storage Store in the unit 40 (S211).

FIG. 13 is a diagram showing the seriousness asset value correspondence table 34.
In the seriousness asset value correspondence table 34, the value of the information asset is associated with each seriousness. In FIG. 13, the value of the information asset with the severity “Danger” is 3, the value of the information asset with the severity “Warning” is 2, the value of the information asset with the severity “Caution” is 1, and the information with the severity “None” The value of the asset is associated with 0.
For example, in the case of the above-described program availability, since the severity of the harmful event “engine illegal operation” specified in S210 is “dangerous”, the value is 3. Further, as shown in FIG. 12, the confidentiality of the command corresponds only to the harmful event “personal information leakage”, and since the seriousness of “personal information leakage” is dangerous, the value is 3.

FIG. 14 is a diagram showing the asset value table 42.
The asset value table 42 shown in FIG. 14 has the same configuration as the asset value table 42 shown in FIG. However, because the method of determining the value is different, the value about the security characteristics of some information assets is different.

  The process of S212 is the same as the process of S113 shown in FIG.

As described above, in the risk analysis apparatus 100 according to Embodiment 2, the value of the information asset is determined according to the severity of the harmful event corresponding to the information asset, and the risk value of the analysis target product is determined based on the determined value. Is calculated.
Although it is difficult for an analyst with little analysis experience to determine the value of an information asset, using the risk analysis apparatus 100 according to the second embodiment, the analyst only associates an information asset with an adverse event. Can determine the value of information assets. Therefore, even an analyst with little analysis experience can easily perform security risk analysis.

  In the above description, the common information storage unit 30 stores the severity asset value correspondence table 34 in which the value of the information asset is associated with each severity, and the severity is based on the severity asset value correspondence table 34. Accordingly, the value of information assets is specified. However, a separate interface may be provided in the input unit 10 to input the value of information assets for each severity.

  In the above description, the value is determined using the highest severity among the severity levels of harmful events corresponding to the security characteristics of information assets. However, the value may be determined by using the average value of the severity of harmful events corresponding to the security characteristics of the information asset. Further, the value may be determined by weighting the average value of the severity of harmful events corresponding to the security characteristics of the information asset by the number of corresponding harmful events.

Embodiment 3 FIG.
In the second embodiment, the case has been described in which the severity of an adverse event has four levels of danger, warning, caution, and none, and the value of the information asset has four levels of 3 to 0. That is, in the second embodiment, the case where the number of severity levels is the same as the number of information asset value levels has been described.
In the third embodiment, the case where the number of severity levels and the number of information asset value levels are different will be described. When there are many stages of value of information assets, there is an advantage that risk values can be calculated at a fine level. In the third embodiment, an example will be described in which the severity is kept at 4 levels and the value of the information asset is 6 levels of 5-0.
In the third embodiment, description of the same parts as those of the second embodiment will be omitted, and parts different from those of the second embodiment will be described.

  The configuration of risk analysis apparatus 100 according to Embodiment 3 is the same as that of risk analysis apparatus 100 according to Embodiment 2 shown in FIG.

FIG. 15 is a flowchart showing the operation of the risk analysis apparatus 100 according to the third embodiment.
Here, as in the second embodiment, an example in which an in-vehicle device system is used as a risk analysis target will be described. The target of risk analysis is not limited to the in-vehicle device system, but may be other products or systems.

  The processing from S301 to S309 is the same as the processing from S201 to S209 shown in FIG.

Subsequent to S309, the asset value determination unit 21 counts the number of harmful events having the highest severity among the corresponding harmful events for each security characteristic of the information asset (S310).
For example, as shown in FIG. 12, if the program is complete, “engine illegal operation”, “personal information leakage”, “speedometer unauthorized display”, and “air conditioner unauthorized operation” are corresponding harmful events. The severity of each harmful event is the most serious because "engine illegal operation" is dangerous, "personal information leak" is dangerous, "speedometer illegal display" is warning, and "air conditioner illegal operation" is caution. “Engine illegal operation” and “personal information leak” with high severity “danger” are counted, and the number of cases is two.

  Next, the asset value determination unit 21 determines the value of the information asset according to the severity of the specified harmful event according to the severity asset value correspondence table 34, generates the asset value table 42, and stores the analysis information storage Store in the unit 40 (S311).

FIG. 16 is a diagram showing the seriousness asset value correspondence table 34.
In the seriousness asset value correspondence table 34, the value of the information asset is associated with each seriousness degree and the number of cases. In FIG. 16, the value of two or more information assets with a severity “danger” is 5, the value of one information asset with a severity “danger” is 4, the value of information assets with a severity “warning” of two or more Value of 3 information assets with a severity of “Warning” is 2, Value of information assets with a severity of “Caution” is 1 regardless of the number of cases, Value of information assets with a severity of “None” is 0 It is associated.
For example, in the case of the integrity of the above-described program, since the severity “danger” is counted as two in S310, the value is 5. Further, the confidentiality of the sensor information has a value of 4 because the severity “danger” is counted as one case.

FIG. 17 is a diagram showing the asset value table 42.
The asset value table 42 shown in FIG. 17 has the same configuration as the asset value table 42 shown in FIG. However, because the method of determining the value is different, the value about the security characteristics of some information assets is different.

  The process of S312 is the same as the process of S212 shown in FIG.

As described above, in the risk analysis apparatus 100 according to Embodiment 3, the value of the information asset is determined in detail according to the severity and the number of harmful events corresponding to the information asset, and the analysis target is based on the determined value. Calculate product risk values.
If the risk analysis apparatus 100 according to the first embodiment is used, the number of stages of information asset value can be increased more than the number of stages of severity set by the analyst, so that the load on the analyst is not changed. The value of information assets can be set in more detail.

Embodiment 4 FIG.
In the above embodiment, the method of determining the value of the information asset and calculating the risk value of the analysis target product has been described. In the fourth embodiment, a method for further clarifying the threat to the analysis target product and calculating the risk value of the analysis target product will be described.
In the fourth embodiment, description of the same parts as those of the second embodiment will be omitted, and parts different from those of the second embodiment will be described.

Here, what is affected by the threat includes not only the information asset of the analysis target product but also a function related to the information asset. For example, threats include those that exploit the resources of the analysis target product and affect the analysis target product outside.
It is difficult to set the value for products that are not analyzed products. For this reason, it has been difficult to accurately perform risk analysis on such threats affecting outside the analysis target product.

FIG. 18 is a configuration diagram of the risk analysis apparatus 100 according to the fourth embodiment.
The risk analysis apparatus 100 shown in FIG. 18 is that the input unit 10 includes a component input unit 15, a presence location input unit 16, and an influence input unit 17, and the risk analysis unit 20 includes a threat extraction unit 23 in FIG. 9. Different from the risk analysis apparatus 100 according to the second embodiment shown.
The component input unit 15 inputs a component constituting the analysis target product and a component classification (device, communication path, etc.). The existence location input unit 16 inputs an existence location of the information asset. The influence degree input unit 17 inputs an influence degree indicating the magnitude of the influence of threats other than information assets. The threat extraction unit 23 extracts threats for information assets and non-information assets.

FIG. 19 is a flowchart showing the operation of the risk analysis apparatus 100 according to the fourth embodiment.
Here, an example in which a network system is used as a risk analysis target will be described. The target of risk analysis is not limited to a network system, but may be other products or systems.

  The process of S401 is the same as the process of S201 shown in FIG. Here, it is assumed that personal information is input as the information asset.

Following the processing of S401, the component input unit 15 inputs the components constituting the analysis target product and the component classification (S402). Here, it is assumed that server A, server B, and the Internet are input as components of the analysis target product. Further, it is assumed that as a component classification, a device representing a server, a terminal, or the like, a communication path indicating the Internet, an in-house LAN, or the like is used.
Note that the component input unit 15 may input information indicating the network configuration or system configuration of the analysis target product instead of inputting the component. Then, the risk analysis apparatus 100 may identify a component from information indicating the input network configuration or system configuration.

Subsequently, the existence location input unit 16 inputs the existence location of the information asset input in S401 (S403). Here, it is assumed that personal information that is an information asset exists on the server A and the Internet, and that no personal information exists on the server B that is a component of the analysis target product.
The presence location input unit 16 may input the information asset flow in the network configuration or system configuration of the analysis target product instead of inputting the location where the information asset exists. Then, the risk analysis apparatus 100 may specify where each information asset exists based on the input flow.

  The processing from S404 to S408 is the same as the processing from S202 to S206 shown in FIG.

Following the processing of S408, the threat extraction unit 23 extracts the threat for the information asset from the threat information 33 as the first threat, and extracts the threat for other than the information asset as the second threat (S409).
FIG. 20 is a diagram showing the threat information 33.
In FIG. 20, the threat information 33 has a possibility of occurrence and an affected range for each threat. As an influence range, when the threat target is an information asset, it has an existence location and security characteristics, and when the threat target is other than an information asset, it has a component.
Specifically, unauthorized access affects the confidentiality, integrity, and availability of information assets residing on the device, while eavesdropping affects the confidentiality of information assets on the communication path, It is set to affect the device.
Therefore, here, unauthorized access and eavesdropping are extracted as the first threat, and the step attack is extracted as the second threat.

Next, the threat extraction unit 23 specifies the first threat extracted in S409 for each information asset, security characteristic, and location, and specifies the second threat extracted in S409 for each component (S410). .
FIG. 21 is a diagram illustrating threats identified for each target.
In FIG. 21A, the unauthorized access that is the first threat is identified for the confidentiality, integrity, and availability of the personal information existing in the server A, and the confidentiality of the personal information existing on the Internet is determined. It has been shown that the first threat, eavesdropping, has been identified.
FIG. 21B shows that a step attack, which is the second threat, has been identified for server A and server B. FIG.

  The processing from S411 to S415 is the same as the processing from S207 to S211 shown in FIG. Here, it is assumed that the confidentiality value of personal information is determined to be 3, the integrity value is 2, and the availability value is 1.

  Following the processing of S415, the impact input unit 17 inputs an impact indicating the magnitude of the influence of the second threat on the component for each component and second threat specified in S410 (S416). Here, it is assumed that the degree of influence of the step attack is input to server A and server B.

Next, the risk value calculation unit 22 calculates a risk value for the threat network system based on the value for each security characteristic of the information asset determined in S415 and the influence level input in S416 (S417).
Specifically, as illustrated in FIG. 22, the risk value calculation unit 22 calculates a risk value for the security specification of the threat information asset based on the value for each security characteristic of the information asset determined in S415. Here, for each threat, the product of the probability of occurrence of the threat and the value of the security characteristic of each information asset included in the range affected by the threat is used as the risk value for the security characteristic of the information asset of the threat. Calculated.
Further, as illustrated in FIG. 23, the risk value calculation unit 22 calculates a risk value for a threat component based on the influence level input in S416. Here, for each threat, the product of the possibility of occurrence of the threat and the degree of influence of the threat on the component is calculated as a risk value for the component of the threat.
And the risk value calculation part 22 calculates the total of the calculated risk value about each threat as a risk value with respect to the network system of the threat.
Of course, not only this but the risk value calculation part 22 may calculate a risk value by another method.

  As described above, risk analysis apparatus 100 according to Embodiment 4 calculates risk values for information assets other than information assets. Therefore, it is possible to comprehensively analyze threats related to the analysis target product, and it is possible to perform security risk analysis more accurately.

  In the above description, the example in which the value of the information asset is specified by the method described in the second embodiment has been described. However, the value of the information asset may be specified by the method shown in the first and third embodiments.

  In the above description, the possibility of occurrence of a threat is uniquely determined for an information asset or a component. However, the possibility of threat generation may be different for each information asset or component.

  Further, each configuration described in the above embodiment may be divided into two or more. For example, the threat extraction unit 23 may be divided into a first threat extraction unit that extracts a first threat and a second threat extraction unit that extracts a second threat.

  Moreover, the flow of the process demonstrated by the above embodiment is an example, and in the range in which a process is materialized, it is also possible to change an order or to perform in parallel.

  Further, the analysis information storage unit 40 may store each piece of information obtained by the processing described in the above embodiment. For example, information indicating information assets input by the information asset input unit, information indicating harmful events input by the harmful event input unit 12, information indicating the number of harmful events corresponding to each value defined by the asset value determination unit 21, The risk information calculated by the risk value calculation unit 22 may be stored in the analysis information storage unit 40 in the form of a table or the like. Of course, even if the analysis information storage unit 40 does not store these pieces of information, the information is stored in the memory included in the risk analysis apparatus 100 and used for processing.

FIG. 24 is a diagram illustrating an example of a hardware configuration of the risk analysis device 100 described in the first to fourth embodiments.
The risk analysis apparatus 100 is a computer, and each element of the risk analysis apparatus 100 can be realized by a program.
As a hardware configuration of the risk analysis apparatus 100, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input / output device 905 are connected to the bus.

  The arithmetic device 901 is a CPU (Central Processing Unit) that executes a program. The external storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, a hard disk device, or the like. The main storage device 903 is, for example, a RAM (Random Access Memory). The communication device 904 is, for example, a communication board. The input / output device 905 is, for example, a mouse, a keyboard, a display device, or the like.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
The risk analysis apparatus 100 is a program that realizes the functions described as the input unit 10 and the risk analysis unit 20.
Furthermore, an operating system (OS) is also stored in the external storage device 902. At least a part of the OS is loaded into the main storage device 903, and the arithmetic device 901 executes the above program while executing the OS.
In the description of the first to fifth embodiments, the information and data stored in the common information storage unit 30 and the analysis information storage unit 40, information, data, and signal values indicating the processing results of the input unit 10 and the risk analysis unit 20. And variable values are stored in the main storage device 903 as files.

  Note that the configuration in FIG. 24 is merely an example of the hardware configuration of each device, and the hardware configuration of each device is not limited to the configuration described in FIG. 24 and may be other configurations.

  100 risk analysis device, 10 input unit, 11 information asset input unit, 12 harmful event input unit, 13 correspondence unit, 14 severity input unit, 15 component input unit, 16 existing location input unit, 17 influence input unit, 20 risk analysis unit, 21 asset value determination unit, 22 risk value calculation unit, 23 threat extraction unit, 30 common information storage unit, 31 harmful event information, 32 template, 33 threat information, 40 analysis information storage unit, 41 asset event Correspondence table, 42 Asset value table.

Claims (6)

An information asset input unit for inputting a plurality of information assets of the analysis target product;
A harmful event input unit for inputting a harmful event that is a harmful event for at least one of the plurality of information assets input by the information asset input unit;
For each information asset, among the adverse events input by the adverse event input unit, an associating unit for associating the harmful event harmful to the information asset,
An asset value determination unit that determines the value of each information asset according to the number of harmful events associated by the association unit;
A risk analysis device comprising: a risk value calculation unit that calculates a risk value of a threat to the analysis target product based on the value determined by the asset value determination unit. The association unit associates harmful adverse events for each characteristic for each information asset,
The risk analysis according to claim 1, wherein the asset value determination unit determines a value for each information asset according to the number of harmful events associated with the association unit for each characteristic. apparatus. The risk analyzer further includes:
A severity input unit for inputting a severity indicating the seriousness of the adverse event;
The risk analysis apparatus according to claim 1 or 2, wherein the asset value determination unit further determines a value according to the severity input by the severity input unit. The risk analyzer further includes:
An impact input unit for inputting an impact indicating the magnitude of the threat impact on the component of the analysis target product;
The risk value calculation unit calculates a risk value of a threat to the analysis target product based on the value determined by the asset value determination unit and the influence level input by the influence level input unit. The risk analysis apparatus according to any one of 1 to 3. The risk analyzer further includes:
It has a template storage unit that stores templates for adverse events,
The risk analysis apparatus according to any one of claims 1 to 4, wherein the harmful event input unit inputs the harmful event based on a template stored in the template storage unit. An information asset input process for inputting a plurality of information assets of the analysis target product;
A harmful event input process for inputting a harmful event that is a harmful event for at least one of the plurality of information assets input in the information asset input process; and
For each information asset, out of the adverse events input in the adverse event input process, an associating process for associating a harmful event harmful to the information asset,
An asset value determination process for determining the value of each information asset according to the number of harmful events associated in the association process;
A risk analysis program for causing a computer to execute a risk value calculation process for calculating a risk value for a threat generated for an analysis target product based on the value determined in the asset value determination process.

Images