KR100891345B1 - Information security managment system supporting inter-mapping between each different information security index and method thereof - Google Patents

Abstract

An information security management system supporting inter-mapping between different information security indexes are provided to calculates an information security value according to information security indexes that a user defines by mapping only security indexes which are proper to a user situation. A risk analyzing group(20) analyzes the risk, threat, risk degree of information property group, and an index management group(40) stores information security indexes and user definition indexes. An index operating member generates user definition indexes through mutual mapping between information security indexes. An index mapping unit(31) generates user definition indexes by extracting and mapping the common items of small classification, and an index result outputting group(32) outputs the evaluation values of information security to a display. A user definition index database(41) stores the user definition indexes.

Description

Information security management system supporting inter-mapping between each different information security index and method

The present invention selects each item according to the user's situation from among a plurality of information protection level indicators which are applied as the calculation criteria of the information protection level indicators for evaluating the information security level in the information and communication field. The present invention relates to an information security operation management system and method that supports mutual mapping of different information security level indicators that can be extracted and set from multiple information security level indicators.

In general, risk management for information systems has different advantages and disadvantages in using quantitative or qualitative methods. In the qualitative method, the subjective view of the evaluator works a lot, and there can be a lot of differences depending on the evaluation point. And most of the existing risk management techniques are handwritten, so there is no criterion to determine whether the optimal protection measures have been established despite the considerable amount of time spent in manpower. In particular, it is very difficult to estimate asset value because information and communication infrastructure is very large and interlocks with other facilities.

The current risk management (analysis) process is mainstream, identifying the unit assets, calculating their asset value, analyzing threats and vulnerabilities, and calculating their risk, becoming the de facto standard model. However, the evaluation activities in risk management have a very subjective point of view in estimating asset value, asset level, threat level, vulnerability level, and countermeasure cost, and therefore, have limited reliability in evaluating the value of information assets.

On the other hand, in the basic idea of information security, managers demand a cost-effective effect, and they are interested in how much damage can be reduced compared to when the protection measures are taken and not established.

In addition, the existing security risk management system requires one evaluator to organize all the results. As a result, they do not know what the other evaluators have given, and the opinions of various evaluators tend to be ignored. Therefore, there is a need for a method of providing various data in one risk management engine server and managing the entire evaluation result so that all of the evaluators can select and decide. In this case, the contents of the minority evaluation can be reviewed later. In addition, in the case of information and communication infrastructure, it is not located in one place but is scattered in several regions. Therefore, evaluators may not be able to gather and express opinions in one place, and thus there is a limit in collecting the overall evaluation results.

In addition, conventional techniques in performing the risk analysis as described above has the following problems. First, risk analysis is divided into qualitative and quantitative methods according to the approach, which requires a lot of manpower and cost to process both methods simultaneously.

Second, to establish a protection plan based on the results of risk analysis, an information security solution should be established, and level indicators for establishing a protection plan should be presented. Level indicators for risk management of information are ISO27001, and the national cyber safety manual checklist presented to the National Intelligence Service and the information security management system certified by the Korea Information Security Agency (Information Security Management System) There is a national standard called ISMS). Therefore, in order to select or manufacture the optimal solution, the risk index is calculated using any one of the above standards as the level indicator. However, as mentioned above, the standard for calculating the risk index of information protection is divided into the international standard and the domestic standard as described above. This is the fact that the level indicators by different standards are applied to each country, institution or user. to be.

In addition, the solution provider of information security does not provide a universally applicable information security solution, and according to the user, it is necessary to provide a security solution suitable for different level indicators. There is a problem that takes a lot of time.

The present invention has been made to solve the above-mentioned conventional problems, and in detail, the object of the present invention is to make a database of different information security level indicators to the situation of the user in different information security level indicators according to the user's situation. The present invention provides an information security operation management system and method for supporting the mutual mapping of different information security level indicators, which can calculate information security evaluation values according to the user-defined information security indicators by mapping only the level indicators. .

In addition, another object of the present invention is to analyze the detailed relationship between the risk analysis results and the at least one information security indicators by analyzing the assets, vulnerabilities, threats, risks, so as to propose a mapping plan between the individual indicators domestic and foreign information security indicators In addition, the present invention provides an information security operation management system and method that supports mutual mapping of different information security level indicators that can simultaneously apply the indicators of individual organizations and output the results of the risk analysis process as evaluation values for each indicator.

In addition, another object of the present invention is to provide a method of converting the evaluation results between each indicator so that the evaluation results according to each individual indicator can be simultaneously applied and individually identified. The present invention provides an information security operation management system and method for supporting information security level index mapping.

The present invention includes the following examples in order to achieve the above object.

According to a first embodiment of the present invention, there is provided an information security operation management system supporting different information security level indicator intermapping of the present invention, including a user PC, a network system including a database or a server, and an individual information protection system. A risk analysis member for analyzing the vulnerability, threat, and risk of the information asset group in question; Indicator management for storing at least one information asset level indicator presented by an international or domestic certification authority and a user-defined indicator selectively mapped from at least one information security level indicator presented by the international or domestic certification body. Absence; And an indicator calculating member generating the user-defined indicators by mutually mapping at least one information protection level indicator presented by an international or domestic certification authority stored in the indicator managing member by a selection signal applied through an input unit. It is done.

According to a second embodiment of the present invention, in the information protection operation management system supporting mutual information protection level indicator mutual mapping according to the first embodiment, the indicator operating member is the indicator according to the selection signal output from the input unit. An index mapping unit for classifying the information protection level indicator items of at least one certification authority stored in the management member into large, medium, and small, and extracting and mapping common items of the small classification to generate user-defined indicators; Evaluation of information protection expressing the risk index as a certain value based on any one of the user-defined indicator or the information protection level indicator, and the vulnerability of the asset calculated by the risk analysis member and the data on the threat and the risk level. Indicator output unit for outputting the value to the display.

According to a third embodiment of the present invention, in an information security operation management system supporting mutual information protection level indicator mutual mapping according to the second embodiment, the indicator management member is an international standard for storing information protection level indicators of international standards. Standard indicator DB; At least one selection indicator database in which at least one domestic information protection level indicator stored by a domestic accredited institution set by a user is stored; The index mapping unit includes a user-defined indicator DB that stores a user-defined indicator generated by mapping to the items of the information protection level indicator stored in the international standard indicator DB and the selection indicator DB.

According to a fourth embodiment of the present invention, in an information security operation management system supporting different information security level index mapping according to the third embodiment, the at least one selection indicator DB is defined by the user in-house. In-house level indicators are included.

According to a fifth embodiment of the present invention, in the information security operation management system supporting the mutual information mapping of different information protection level indicators according to the third embodiment, the information protection level indicator proposed by the authorized agency is the cyber security manual of the National Intelligence Service. And the Korea Information Security Agency's Information Security Management System (ISMS).

According to a sixth embodiment of the present invention, in the information security operation management system supporting the mutual information mapping of different information security level indicators according to the third embodiment, the information security level indicator of the international standard is characterized in that the ISO27001 level indicator. do.

According to a seventh embodiment of the present invention, in the information security operation management method that supports the mutual information mapping of different information security level indicators of the present invention, the risk is calculated through vulnerabilities and threats between each component of the asset defined as the asset. Generating a risk analysis result of the risk analysis member; An index definition step of the index calculation member for mapping the set information protection level index to set the user-defined index; An indicator calculation step of an indicator calculation member for linking the analysis result of the risk level with the user-defined indicator set in the indicator definition step to calculate an evaluation result of information protection as a predetermined value; And an evaluation output step of the indicator operation member for outputting the information protection evaluation value calculated in the indicator operation step.

According to the eighth embodiment of the present invention, in the information security operation management method which supports the mutual information mapping of different information security level indicators according to the seventh embodiment, the index definition step of the index calculation member is performed according to a signal selected by the input unit. An individual information protection indicator registration step of inputting and registering at least one level indicator for evaluation of information protection from among the selected international standard indicators, the first selection indicator, or the second selection indicator; A mapping item input step of inputting a mapping item by setting a classification criterion between level indicators registered in the indicator registration step; A mapping relationship setting step of setting a mapping relationship between different information protection level indicators according to the classification criteria input in the mapping item input step; And a linking table generation step of converting a result between the information protection level indicators by generating a connection table in the mapping relationship setting item between the information protection level indicators after the mapping relationship setting step.

According to a ninth embodiment of the present invention, in the information security operation management method supporting mutual information protection level index mapping according to the eighth embodiment, the indicator registration step is ISO27001, the information security management system of the Korea Information Security Agency. (ISMS), at least one or more of the cyber information manual of the National Intelligence Service.

According to a tenth embodiment of the present invention, in the information security operation management method which supports the mutual information mapping of different information security level indicators according to the eighth embodiment, the indicator registration step includes an in-house level indicator defined by the company itself. It is characterized by.

According to an eleventh embodiment of the present invention, in the information security operation management method which supports the mutual information mapping of different information protection level indicators according to the tenth embodiment, the mapping relationship setting step is performed by a selection signal selected arbitrarily from the input unit. Characterized in that the mapping is set from the small category of the at least one information security level indicator selected from the international standard information security level indicators or domestic standard information security level indicators.

According to a twelfth embodiment of the present invention, in the information security operation management method which supports different information security level indicator mutual mapping according to the eleventh embodiment, the connection table generation step, the connection table generation step, the user A template classified as a sub-category in the definition index and the information security level indicator of the international standard and the information security level indicator of the domestic standard may be configured such that a connection relationship is established with each other.

According to a thirteenth embodiment of the present invention, in the information security operation management method which supports the mutual information mapping of different information security level indicators according to the twelfth embodiment, the index calculation step is performed in a risk analysis result generation step of the risk analysis member. Calculate the information security evaluation result based on any one of the information security level indicators selected from the user-defined indicators or the information security level indicators of the accredited certification authority registered in the step of registering the indicators. Characterized in that.

Accordingly, the present invention selectively sets the evaluation criteria for different risk management and information protection by mapping only the level indicators suitable for its situation from the different information protection level indicators according to the user's situation by making a database of different information security level indicators. Therefore, it is possible to calculate the level of information security that can be defined according to the user's situation or needs, so that different information security level indicators can be applied through one solution.

In addition, the present invention provides a comprehensive information security risk in the field of information and communication, which combines a low-level risk analysis process that combines asset, vulnerability, threat, and countermeasure technologies and a high-level risk analysis process that analyzes risk as an information security level indicator. The management system analyzes the detailed relationships among various information security level indicators and suggests mapping methods between individual indicators to provide a method for converting between domestic and international information security level indicators and individual organization level indicators. As it can be carried out by itself, it is possible to set up the level indicator of risk management according to the user's expense reduction and its own situation.

Hereinafter, with reference to the accompanying drawings, a preferred embodiment of an information security operation management system and method for supporting different information security level indicator intermapping according to the present invention will be described in detail.

1 is a block diagram showing an information security operation management system that supports different information security level indicator intermapping according to the present invention.

Referring to FIG. 1, the information security operation management system supporting the mutual information protection level indexing mapping according to the present invention includes a risk analysis member 20 for analyzing a risk of leakage or loss of information protection in-house, and an information field. The indicator management member 40 stores the international standard indicators or domestic indicators among the information security level indicators set for the calculation of the risk indicators of the user, and the user selects from the items of the level indicators stored in the indicator management member 40. An index calculation member 30 for calculating the risk management index by comparing each item classified into categories and generating a user-defined index and comparing the risk analysis data, an input unit 10 for inputting data and outputting various commands; And a display 50 for outputting each evaluation result on the screen.

The risk analysis member 20 is an asset management unit that evaluates and manages in-house information assets, such as user PCs, network systems including databases or servers, and types and intangible information assets such as individual information protection systems. 21) a vulnerability management department 22 that manages internal security systems such as internal networks and access control systems, research institutes, and internal vulnerabilities such as document leakage at each department, and artificial terrorism and nature that threaten the company. It includes a threat management unit 23 for analyzing the threat of the disaster, and a risk analysis unit 24 for analyzing the risk occurrence situation due to accidents or artificial attacks.

The vulnerability management unit 22 provides data for analyzing threats or vulnerabilities on assets, and checks unnecessary services and access paths through diagnostic tools and scanners, and classifies the vulnerabilities into exposed parts. In addition, we conduct a simulated penetration test based on the vulnerabilities found to classify the likelihood of penetration.

The risk analysis unit 24 calculates the risk of the information system, and the risk calculation is calculated based on the threat to the asset and the vulnerability to the asset, and all add the result value as the risk. In this case, it is preferable that the natural number or the risk is classified into a plurality of grades for each calculation. Since the algorithm for this is already known, a detailed description thereof will be omitted. As described above, the risk analysis unit 24 calculates a risk degree based on the assets registered in the asset management unit 21 and the threats and vulnerabilities of the assets, and calculates the result.

The threat management unit 23 calculates a situation in which damages may occur due to viruses, worms, hacking, and unintentional actions, selects detailed items for each item, and defines and provides a threat list. To this end, the threat management unit 23 forms a list by configuring several items, and selects and provides a threat list for the corresponding asset. This is because a large list of threats presents confusion to the evaluator when it is presented in its entirety for each asset. For example, in the case of a Windows system, it shows only threats associated with Windows. If a threat is selected for the asset, the threat level is calculated by classifying it into 5 grades.

The asset management unit 21 evaluates the level of the medium having the information asset and provides the information. Here, the asset information is described, for example, in the case of important information, it is stored and managed in a high performance system and a high speed network system is used for transmission and reception. In the case of lower grade information, it will be stored in some drawers, while on paper or diskette. Therefore, since the asset management unit 21 evaluates and grades the level of the medium, the threat management unit 23 and the vulnerability management unit 22 analyze the threats and vulnerabilities of the medium to protect the information on the medium. The solution is easy to implement.

Here, the medium refers to a device that people can see and read, such as paper, safes, and hardware, and includes mail, telephone, and the Internet according to transmission. The asset management unit 21 divides and decides the grades by dividing them into confidentiality, integrity, and availability for media that manages the main information. At this time, the asset management unit 21 is provided with the basic data necessary for calculating the grade through the input unit 10.

Such information assets can be compared with the relevant institutions by providing certain rules and procedures to the managers and operators who secure the safety of the information and communication infrastructure and manage the facilities through the security risk management system. To this end, in order to evaluate the risk and safety as described above, the risk index of each information security is calculated and the result is evaluated based on the information security standard specification (information protection level indicator). Therefore, the present invention is to calculate the information protection evaluation value through the index of the item set in the international standard indicators and domestic standard indicators corresponding to the level of information protection of domestic and international authorized certification authority stored in the indicator management member (40). Here, the present invention stores at least one or more different level indicators different from the prior art through the indicator management member 40, through which the user-defined level indicators can be set according to the user's situation, and the risk and stability of information protection can be evaluated. A number of risk indices can be calculated. Description of this is disclosed in the description of the indicator management member 40 and the indicator operation member 30 below.

The indicator management member 40 includes an international standard indicator DB 42, which stores information protection level indicators (hereinafter referred to as international standard indicators) of the international standard, and an information protection level indicator (hereinafter referred to as domestic indicators) of the domestic standard. A first selection indicator DB 43 in which the first selection indicator set by the user is stored; a second selection indicator DB 44 in which the second selection indicator set by the user among the domestic indices is stored; and the international standard indicator And a user-defined indicator DB 41 in which a user-defined indicator for mapping the first selection indicator and the second selection indicator and set according to a user's situation is stored.

The international standard indicator DB 42 is an information security level indicator that defines the international standard of information protection, which corresponds to ISO27001. In addition to the above international standard indicators, the international standard indicator DB 42 is a domestic safety indicator according to the user's situation or setting, for example, the Korea Information Security Agency's Information Security Management System (ISMS) and the cyber security manual proposed by the National Intelligence Service. Can be replaced.

The first selection indicator DB 43 and the second selection indicator DB 44 store the user with any one of the domestic information security level indicators, for example, the information proposed by the Korea Information Security Agency or the National Intelligence Service. In addition to any one of the protection level indicators, it is also possible to set an information protection level indicator proposed in another country, which can be changed by the user's selection.

Here, for example, the first selection indicator DB 43 and the second selection indicator DB 44 may be provided with an enterprise-defined information protection system in addition to the above-mentioned cyber safety manual or information security management system (ISMS). It is also possible to store the level indicators related to management. For this purpose, the third optional indicator DB (not shown) may also be added.

The user-defined indicator DB 41 is information stored in the international standard indicator DB 42, the first selection indicator DB 43 and the second selection indicator DB 44 under the control of the index calculation member 30, respectively. The user-defined information level indicators are defined to map the items included in the protection level indicators to map the items appropriate to the user's situation so that the user can calculate the objective information protection level indicators according to each situation. Stored.

In this case, the user-defined indicator is classified into large, medium, and small categories of information protection items included in, for example, ISO27001, Information Security Management System (ISMS), and cyber manual. Therefore, since it is mapped according to the user's selection, different information protection level indicators are output as items classified according to the user's setting, and the risk index can be numerically calculated by comparing with the data output from the risk analysis unit 24. It is used as a basis. In this case, it is obvious that the user-defined indicators are mapped to the in-house information security level indicators defined by the company in addition to the above-described level indicators.

The index calculation member 30 may include information protection level indicators stored in the international standard index DB 42, the first selection index DB 43, and the second selection index DB 44 of the input unit 10. To the indicator mapping unit 31 to be mapped according to the selection signal and stored in the user-defined indicator DB 41, the user-defined indicator mapped from the indicator mapping unit 31 or the selection signal input from the input unit 10. Therefore, in the risk analysis unit 24 based on one of the indicator items stored in the international standard indicator DB 42, the first selection indicator DB 43, and the second selection indicator DB 44, respectively. An index result output unit 32 for comparing the analyzed data and calculating an information security evaluation value is included.

The indicator mapping unit 31 is stored in the international standard indicator DB 42, the first selection indicator DB 43 and the second selection indicator DB 44 according to the selection signal output from the input unit 10. Among the index items, they are classified into large, medium, and small, and the items included in each of the indicators are selected and mapped according to each classification, so that the user-defined indicators are calculated and stored in the user-defined indicator DB 41. Mapping between such indicators will be described later with reference to FIGS. 4 to 10.

The indicator result output unit 32 protects information on the vulnerability calculated by the risk analysis unit 24 and data on threat and risk based on one of the user-defined indicators and the standard indicators. An information protection evaluation result expressing the evaluation value of the predetermined value is calculated and the result is output to the display 50.

The present invention includes the above-described configuration, and the information security operation management method for supporting the different information protection level indicator inter-mapping according to the present invention using each of these configurations will be described in detail below.

2 is a flowchart illustrating an information security operation management method that supports different information security level index intermapping according to the present invention.

Referring to FIG. 2, a risk analysis result generation step (S10) of a risk analysis member 20 for calculating a risk level through vulnerabilities and threats between each component of an asset defined as an asset, and an information protection level index of a set information protection Indexing step (S20) of the index calculation member 30 to set a user-defined information protection indicator by mapping the analysis result of the risk and the indicator set in the indicator definition step by connecting the indicators set in the index definition step a certain value An index calculation step (S30) of the index calculation member 30 to be calculated as, and the evaluation output step (S40) of the index calculation member 30 for outputting the information protection evaluation value calculated in the index calculation step.

Here, the risk analysis result generation step (S10) in the risk analysis member 20 by analyzing the risk of the asset by linking the vulnerabilities, threats, and risk results for the asset registered in the asset management unit 21 and outputs the result. It's a step.

Here, the asset management unit 21 is a medium for storing information, for example, a hardware such as a server, a PC, a network device, an OS and basic services, an operating program and an application of the medium, and data stored in the medium. Register as an asset. The vulnerability management unit 22, the threat management unit 23, and the risk analysis unit 24 express values of the criticality of the assets as confidentiality, integrity, and availability factors, and the sensitivity of the data is When calculating confidentiality values, each threat, vulnerability, and risk is calculated. For example, the threat management unit 23 is classified into a case where the threat agent is a human (hacker, user, developer, system administrator) and a case caused by natural disasters or environments other than humans such as natural disasters and breakdowns. Calculate the degree as a rating or a certain value.

The vulnerability management unit 12 is defined as "the nature of the system that can realize the threat of each asset", the vulnerability level is defined as "the degree to which the threat of each asset can be realized" to the asset registered in the asset management unit 21 Vulnerability is expressed as a certain number, and the standard or method can be implemented as a known technique for those in the same industry.

The risk analysis unit 24 calculates a risk index for the entire ICT infrastructure based on the analyzed result of the vulnerability and threat. Such risk analysis is not completed at one time, but timely analysis is performed according to changes in assets, threats, and vulnerabilities, which are changed from time to time.

The index defining step S20 of the index computing member 30 will be described with reference to FIG. 3.

FIG. 3 is a flowchart illustrating an index definition step of an index calculation member in an information security operation management method supporting mutual information protection level index intermapping according to the present invention.

Referring to FIG. 3, the index defining step S20 of the index calculating member 30 drives the index mapping unit 31 in the index calculating member 30 according to a signal selected by the input unit 10. Input the level indicator for evaluation of at least one or more information in the international standard indicator DB 42, the first selection indicator DB 43, the second selection indicator DB 44 selected by the user in the indicator management member 40 and A mapping item input step (S22) for inputting a mapping item by setting a classification criterion between the individual information protection indicator registration step (S21) to register, the indicator registered in the indicator registration step (S21), and the mapping item input step ( Mapping relationship setting step (S23) for setting a mapping relationship between different information protection indicators according to the classification criteria input in S22), and generating a connection table in the mapping relationship setting item between the indicators, resulting in the information protection indicators. Concatenation And a table generating step (S24).

The indicator registration step (S21) is a step of storing and registering the individual information protection indicator in the indicator management member 40 in accordance with the input signal applied from the input unit 10 in the indicator operation member (30). That is, the user is a level indicator stored in the international standard indicator DB 42, the first selection indicator DB 43, the second selection indicator DB 44 in the indicator management member 40 through the input unit 10. When the selection and registration signal is input, the indicator management member 40 generates registration information in each of the information protection indicators DB 42, 43, and 44. Accordingly, the indicator management member 40 may select the international standard indicator DB 42, the first selection indicator DB 43, and the second selection indicator DB 44 according to the selection and registration request signal of the input unit 10. It is generated in the indicator management member 40, and stores each indicator applied through the input unit 10.

Wherein the international standard indicator DB 42 is, for example, ISO27001 (see Fig. 6), the first optional indicator DB 43 is the Korea Information Security Agency (ISMS) (see Fig. 5), The two selection index DBs 44 respectively stored cyber information manuals (see FIG. 4) of the National Intelligence Service. In addition to the first selection indicator DB 43 and the second selection indicator DB 44, other level indicators may be applied. For example, the application of the present invention is also carried out by registering the information protection level indicator in the company in the third selection indicator DB (not shown) and proceeding to each step described below.

4 shows the cyber information manual of the National Intelligence Service, which consists of 253 detailed check items in nine major categories. In addition, the Information Security Management System (ISMS) of the Korea Information Security Agency of FIG. 5 is composed of 15 major categories and more than 300 detailed check items, and the international standard indicator ISO27001 of FIG. 6 is composed of 11 major categories and 133 small categories. Become. 4 to 6 illustrate a part of each level of information protection level, and the present invention is not only applicable to the level of information protection level mentioned in the present specification but also to information protection level indexes of other countries or other organizations. The indicators described above as applicable have been described as examples for the understanding of the invention.

The mapping item input step S22 is performed by the indicator mapping unit 31 according to the selection signal of the input unit 10. The international standard indicator DB 42, the first selection indicator DB 43, and the second selection indicator are selected. A step of inputting to set a mapping item among each index item stored in the DB 44. Here, the surface mapping unit 31 classifies the mapping items into major classifications, medium classifications, and small classifications, and selects common items among the small classifications between the indicators, and sets the mapping relationship as follows. That is, the indicator mapping unit 31 is divided into different major classification, medium classification and small classification in the case of each information protection level indicator, as shown in FIGS. 4 to 6, and the indicator items included in each sub classification. To distinguish between mapping and linking, input mapping items by dividing into large category, middle category, and small category.

The mapping relationship setting step S23 is stored in the international standard indicator DB 42, the first selection indicator DB 43, and the second selection indicator DB 44 according to the user's situation in the indicator mapping unit 31. A step of arbitrarily selecting among the small classification items and setting the mapping to the small classification items of the user-defined indicators stored in the user-defined indicator DB 41. Here, the indicator mapping unit 31 is the international standard indicator DB 42 and the first selection indicator DB according to the signal selected by the input unit 10 in the major classification, the middle classification, and the small classification classified in the mapping item input step S22. (43), and selectively set in the small category of each information protection level indicator stored in the second selection indicator DB (44) to map to the small category of the index set in the user-defined indicator DB (41). This constitutes a table as shown in FIG. 7, and the display 50 outputs a screen as shown in FIG. 8.

7 and 8, the user-defined information protection indicators stored in the user-defined indicator DB 41 are classified in accordance with the selection signal of the input unit 10 by the indicator mapping unit 31, respectively. And the sub-category 102, sub-category 103, and each item 104 mapped to the sub-category is the international standard index DB 42, the first selection indicator DB 43 and the second selection indicator DB. An item selected by the input unit 10 is mapped and set among the sub-categories included in each of the indices stored in 44.

In the connection table generation step S24, the index mapping unit 31 executes a template for setting the interconnection relationship between the items classified as the subclass in the user-defined information protection index. 7 and 8, the sub-classification of 1.1.1 includes two items of the first selection indicator (ISMS), two items of the first selection indicator (NCSC), and item 1 of the International Standards Index (ISO27001). Dogs are included. Accordingly, when evaluating the level of information security for the information security policy documents classified as the subclass 1.1.1, the indicator mapping unit 31 includes two items stored in the international standard indicator DB 42 and the first selection indicator DB 43. The items stored in the second and second items of choice index DB (44) are templated so that a connection relationship is established with each other. Therefore, when evaluating the information security policy document, the evaluation result as the numerical value set through the user-defined index is output and the evaluation value as the numerical value set in the information protection level index of the international standard stored in the international standard index DB 42 or The evaluation result values set in the first selection indicator (ISMS) or the second selection indicator (cyber safety manual) are respectively output. That is, the present invention can output the evaluation result value even with the numerical value set by the user due to the setting of the user-defined indicator, but is converted into the evaluation result value set in each indicator of each item of the set connection and outputted. It is also possible.

As described above, the index defining step S20 of the index calculation member 30 builds the user-defined index DB 41 in the index management member 40, and the international standard index DB 42 and the first selection index. A mapping relationship is set for each item stored in the DB 43 and the second selection indicator DB 44.

In the index calculation step S30 of the indicator calculation member 30, each item included in the risk analysis result of the risk analysis member 20 is applied to the user-defined indicator to express the information protection level indicator as a predetermined value. It is a step of calculating the evaluation value of. Here, the index calculation member 30 compares each item included in the risk analysis result output from the risk analysis member 20 through the indicator mapping unit 31 with each item included in the user-defined indicator. In this case, mapping and connection of the user-defined indicator item according to the risk analysis result are shown in FIGS. 9 and 10.

FIG. 9 is a block diagram illustrating a connection relationship between a risk analysis result and an index item in an information security operation management method supporting mutual information protection level index mapping according to the present invention.

Referring to FIG. 9, the indicator mapping unit 31 includes each item included in the risk analysis result, for example, a system vulnerability check and a breach response status, a network vulnerability check, and a countermeasure application status. The items of classification that can evaluate the information security level indicators for the output analysis result items of 20) are searched and connected. Accordingly, the indicator mapping unit 31 connects the information stored in the user-defined indicator DB 41 to the information protection level indicator for the network connection policy of 6.2.5.

10 is a screen output of a state in which a risk analysis result and an index item are connected in an information security operation management method supporting mutual information protection level index mapping according to the present invention.

Referring to FIG. 10, the display 50 outputs an item of the user-defined indicator DB 41 connected to the upper side, and a risk analysis result value output from the risk analysis member 20 on the lower side. In addition, although not shown in the drawing, the indicator result output unit 32 outputs the analysis result of the risk as an information protection evaluation value expressed as a predetermined value based on the items stored in the user-defined indicator DB 41. . At this time. The indicator result output unit 32 may be expressed as an evaluation unit set as the user-defined indicator, but the international standard indicator DB 42 and the first selection indicator that are connected and set for each item of the sub-class included in the user-defined indicator. It is also possible to output the evaluation value for each indicator stored in the DB 43 and the second selection indicator DB 44.

Here, the index calculation step S30 has been described with reference to FIG. 10, and FIG. 9 is illustrated to explain an example of a connection relationship with respect to 6.2.5. FIG. 10 shows the result of the connection table with respect to 6.3.1. As an example of the output, different items were output, but the actions and processes are the same.

In the evaluation output step S40 of the index calculation member 30, the index result output unit 32 outputs the mapping result and the index calculation result to the display 50. Here, the evaluation value is preferably output by expressing the evaluation result for each item on the screen of FIG. 10 as a predetermined value.

Therefore, the user has the information protection evaluation value according to the user-defined indicator according to the risk analysis result output from the risk analysis member 20 through the input unit 10, the information protection evaluation value according to ISO27001 according to the international standard, The information security evaluation value by the Information Security Management System (ISMS) by the Korea Information Security Agency and the result of each evaluation by the cyber safety manual of the National Intelligence Service can be confirmed. In this way, the result of the risk analysis process for everyday information protection can automatically reflect the evaluation value applied to the level indicator for the user-defined indicators and other information protection evaluation values.

1 is a block diagram showing an information security operation management system supporting different information security level indicators mutual mapping according to the present invention;

2 is a flowchart illustrating an information security operation management method supporting mutual information protection level indicator mutual mapping according to the present invention;

3 is a flow chart showing the steps of index definition of the indicator management member in the information security operation management method supporting the mutual information protection level indicator mutual mapping according to the present invention;

4 is a table showing an example of the first selection indicator in the information security operation management method supporting mutual information protection level indicators mutual mapping according to the present invention;

5 is a table showing an example of the second selection indicator in the information security operation management method supporting mutual information protection level indicators mutual mapping according to the present invention;

6 is a table showing international level indicators in the information security operation management method supporting mutual information protection level indicators mutual mapping according to the present invention;

7 is a table showing an example of integrated classification for each indicator in the information security operation management method supporting mutual information protection level index mapping according to the present invention;

8 is a screen showing the connection relationship by indicator in the information security operation management method supporting mutual information protection level indicators mutual mapping according to the present invention;

9 is a block diagram showing a connection between a risk analysis result and an indicator item in an information security operation management method supporting mutual information protection level index mapping according to the present invention;

FIG. 10 is a screen showing a state in which a risk analysis result and an indicator item are connected in an information protection operation management method supporting mutual information protection level indicator mutual mapping according to the present invention.

* Explanation of symbols showing the main parts of the drawings *

10: input 20: risk analysis member

21: Asset Management Department 22: Vulnerability Management Department

23: threat management department 24: risk analysis department

30: surface computing member 31: surface mapping unit

32: indicator result output unit 40: indicator control member

41: user-defined indicator DB 42: international standard indicator DB

43: first choice indicator DB 44: second choice indicator DB

50: display

Claims (13)

A risk analysis member for analyzing the vulnerabilities, threats, and risks of a user PC, a network system including a database or server, and an information asset group including an individual information protection system; Indicator management for storing at least one information asset level indicator presented by an international or domestic certification authority and a user-defined indicator selectively mapped from at least one information security level indicator presented by the international or domestic certification body. Absence; And an index calculation member configured to generate the user-defined indicators by mutually mapping at least one information protection level indicator presented by an international or domestic certification authority stored in the indicator management member by a selection signal applied through an input unit. An information security operation management system that supports the mutual mapping of different information security level indicators. The method of claim 1, wherein the index calculation member According to the selection signal output from the input unit, the information protection level indicator items of at least one certification authority stored in the indicator management member are classified into large, medium, and small, and the common items of the small classification are extracted and mapped to user-defined indicators. An index mapping unit to generate; Evaluation of information protection that expresses risk index as a certain value on the basis of any one of the user-defined indicator or the information protection level indicator and the vulnerability of the asset calculated by the risk analysis member and data on threat and risk level. An information security operation management system supporting the mutual mapping of different information security level indicators, comprising: an indicator result outputting unit for outputting the value to a display. The method of claim 2, wherein the indicator management member An international standard indicator database for storing information security level indicators of the international standard; At least one selection indicator DB in which at least one information protection level indicator proposed by an authorized institution set by a user is stored; Different information protection level indicators, characterized in that the index mapping unit includes a user-defined indicator DB is stored in the user-defined indicators generated by mapping to the items of the information protection level indicators stored in the international standard indicator DB and the selection indicator DB Information security operation management system supporting mutual mapping. The method of claim 3, wherein the at least one selection indicator DB is An information security operation management system that supports the mutual mapping of different information security level indicators, which includes internal level indicators defined by the user in-house. According to claim 3, wherein the information protection level indicator proposed by the authorized institution is An information security operation management system that supports mutual mapping of different information security level indicators, including the National Security Agency's Cyber Safety Manual and the Korea Information Security Agency's Information Security Management System (ISMS). The information protection level indicator of the international standard is An information security operations management system supporting the mutual mapping of different information security level indicators, characterized by ISO27001. Generating a risk analysis result of the risk analysis member for calculating a risk level through vulnerabilities and threats between each component of the asset defined as the asset; An index definition step of the index calculation member for mapping the set information protection level index to set the user-defined index; An indicator calculation step of an indicator calculation member for linking the analysis result of the risk level with a user-defined indicator set in the indicator definition step to calculate an evaluation result of information protection as a predetermined value; And an evaluation output step of the index calculation member outputting the information protection evaluation value calculated in the index calculation step. The method of claim 7, wherein the index defining step of the index operation member Information protection that is the standard for the evaluation of at least one of the information protection level indicators of the international standard selected by the user according to the signal selected by the input unit, the first or second selection indicator selected from the information security level indicators of the domestic standard. An information protection index registration step of inputting and registering level indicators; A mapping item input step of inputting a mapping item by setting classification criteria between the information protection level indicators registered in the indicator registration step; A mapping relationship setting step of setting a mapping relationship between different information security level indicators according to the classification criteria input in the mapping item input step; And a linking table generation step of converting a result between the information protection level indicators by generating a connection table in the mapping relationship setting item between the information protection level indicators after the mapping relationship setting step. Information security operations management methods that support mapping. The method of claim 8, wherein the indicator registration step An information security operation management method that supports mutual mapping of different information security level indicators, comprising at least one of ISO27001, the Korea Information Security Agency (ISMS), and the National Intelligence Service's Cyber Information Manual. The method of claim 8, wherein the indicator registration step An information security operation management method that supports the mutual mapping of different information security level indicators, which includes internally defined internal level indicators. The method of claim 9, wherein the mapping relationship establishing step Mapping from a sub-category item of one or more information protection level indicators selected from the information protection level indicator of the international standard or the domestic standard information protection level indicator to a sub-category item of the user-defined indicator by a randomly selected selection signal from the input unit. Information security operation management method that supports mutual mapping of different information security level indicators. The method of claim 11, wherein the connection table generation step, The information classified as a sub-category in the user-defined indicators, and the information security level indicators of the international standard and the information security level indicators of the domestic standard, so as to establish a connection relationship with one or more items, characterized in that the different information security level indicators mutually Information security operations management methods that support mapping. The method of claim 12, wherein the index calculation step The information protection any one selected from the user-defined index or the information protection level index of the accredited certification authority registered in the indicator registration step for each item included in the risk analysis result output in the risk analysis result generation step of the risk analysis member. An information security operation management method that supports cross-mapping of different information security level indicators, comprising calculating the results of the information security evaluation based on the level indicators.

Images