KR101310487B1 - System for managing risk of customer on-demand and method thereof - Google Patents

Abstract

The present invention relates to a customer-demand risk management system and method, comprising: a vulnerability analysis module for collecting vulnerability information of a corresponding customer network and evaluating a vulnerability level using the vulnerability information upon receiving a request from a customer; Threat analysis module for evaluating threat level by receiving event log information through detection and blocking of harmful traffic flowing in and out, and evaluating asset value of customer network, and evaluating the vulnerability level and threat level evaluation result and asset value evaluation result Including a risk analysis module that analyzes the risk of the customer network using a network, the server and the network equipment or server systems located in the customer's internal network or the DMZ are evaluated by the customer service provider for vulnerability analysis and threat level evaluation. To assess the total risk of the asset and provide it to the customer Disclosed is a technique.

Description

Customer-Demand Risk Management System and its Method {SYSTEM FOR MANAGING RISK OF CUSTOMER ON-DEMAND AND METHOD THEREOF}

1 is a block diagram of a customer on-demand risk management system according to an embodiment of the present invention.

2 is a flow chart illustrating a customer demand risk management method according to an embodiment of the present invention.

3 illustrates a risk assessment report in accordance with the practice of the present invention.

Description of the Related Art

100: risk management server 101: vulnerability analysis module

102: threat analysis module 200: risk analysis module

200: Internet 300: Router

400: security equipment 500: aggregation switch

600: DMZ 700: Firewall

800: customer network 810: server or PC

811: Equipment

The present invention relates to a customer demand risk management system and a method thereof, and more particularly, to a network equipment or server systems located in a customer internal network or a demilitarized zone (DMZ) in a server of a service provider. It is a technology that evaluates the overall risk of assets by analyzing and evaluating threat levels and provides them to customers.

In general, vulnerability analysis is a vulnerability analysis tool for network devices such as routers and switches, server systems such as web servers, DB servers, mail servers, network management stations (NMSs), and security devices. Port scanning and application level vulnerability check using the results, and using the results to check the OS vulnerability, open ports, application vulnerability, backdoor infection of each device it means.

Threat management is to identify threat factors such as various hacking, denial of service (DoS) attacks, worms, viruses, etc. from the outside using the system's vulnerability, and evaluate the threat level and periodically manage the threat information. it means. Most threat information is identified based on data collected from event log systems, etc. Typical examples are based on event logs generated by intrusion detection systems (IDS), the type of threat, frequency of threat, source of threat, target system of threat, and Understand the threat level.

As such, threat management is indispensable to conduct vulnerability analysis on specific systems (customer assets) in addition to vulnerability analysis.

However, the single technologies for each of these vulnerability analysis and threat management are well-known technologies, but by integrating them, the telecommunication service provider can receive a request from the customer as a part of the system's security service. There is no additional service that diagnoses security level and manages it regularly on the web.

Therefore, the present invention for solving the above-described problem is to manage the risk on the network or the main network equipment and systems located in the DMZ by the customer's occasional request from the server on the remote service platform of the carrier side The risk management results.

According to an embodiment of the present invention for achieving the above object, the risk management system for a customer demand type collects vulnerability information of a corresponding customer network when a request from a customer is received, and evaluates a vulnerability level using the vulnerability information. And a threat analysis module for evaluating threat levels by receiving event log information through detection and blocking of harmful traffic flowing into and out of the customer network, evaluating asset values of the customer network, and evaluating the vulnerability level and the threat level evaluation result. And a risk analysis module for analyzing the risk of the customer network using the result of the asset valuation.

In addition, the customer-demand risk management method according to the present invention, the first process of evaluating and storing the asset value for the customer network, and when receiving a risk evaluation request from the customer, collects vulnerability information for the customer network, A second process of evaluating a vulnerability level using vulnerability information, a third process of evaluating a threat level by receiving event log information through detection and blocking of harmful traffic flowing into and out of the customer network from a security device, and the vulnerability And a fourth process of evaluating the risk of the customer network using the level and threat level evaluation result and the asset value evaluation result.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an on-demand risk management system according to an embodiment of the present invention.

The risk management system of the present invention includes a risk management server 100, router 300, security equipment 400, aggregation switch 500, firewall 700, DMZ 600, and customer network 800 Configure.

First, the risk management server 100 provides vulnerability analysis and threat management services to major network equipment and systems located in the customer network 800 or the DMZ 600 through the Internet network 200. At this time, the risk management server 100 is connected directly through the Internet network 200 without passing through the security equipment 400 for the DMZ 600, and evaluates the risk, the customer network 800 for the customer network (800) When a customer is requested to evaluate a risk through a vulnerability analysis agent pre-installed on a server or a PC 810 from a customer, the vulnerability analysis and the threat level are evaluated to evaluate the potential risk of the corresponding customer network 800. In addition, the risk management server 100 preferably performs risk analysis of the corresponding server or PC through vulnerability and threat analysis, and also performs history management on the result.

To this end, the risk management server 100 includes a vulnerability analysis module 101, a threat analysis module 102, and a risk analysis module 103. The vulnerability analysis module 101 collects port scanning information for network devices such as routers and switches using IP, server systems such as web servers, DB servers, mail servers, network management systems (NMS), and security devices. Performs vulnerability analysis using the information, and writes the result in the form of a report as shown in FIG. 3 and reports the result to a customer or an operator.

At this time, the vulnerability analysis module 101 may operate as a standalone, or download and install an vulnerability analysis tool in the form of ActiveX through the web so that the vulnerability analysis module 101 can operate on a desired server or PC 810. . That is, when analyzing the vulnerability of the DMZ 600 without the internal protection network such as the firewall 700, a standalone method of directly connecting through the Internet network 200 without the firewall 700 to obtain and analyze the vulnerability information. If you want to analyze the vulnerability of the customer network 800 that is not accessible from the outside because the internal network security equipment such as the firewall 700 is installed, the web in the server or PC 810 in the customer network 800 After downloading and installing the vulnerability agent (vulnerability analysis tool) implemented in the ActiveX form through the vulnerability analysis module 101 to request a vulnerability analysis.

The vulnerability analysis module 101 may check whether the OS vulnerability, open port, application vulnerability, and backdoor infection of each device through port scanning and application level vulnerability checking. It provides an analysis report on the results.

Meanwhile, the threat analysis module 102 performs a function of evaluating a threat level based on event log information received from the security device (IDS / IPS deployment) 400. That is, the threat analysis module 102 evaluates the level of the threat based on real-time log information (attack, attack type, attack count, occurrence time, target system, etc.) of the attack.

The risk analysis module 103 combines the vulnerability and threat level results evaluated by the vulnerability analysis module 101 and the threat analysis module 102 to evaluate the risk. In addition, the risk analysis module 103 evaluates the asset value of the internal equipment of the customer network 800 and the DMZ 600, stores the result, and applies the result of the asset value evaluation at a later risk assessment.

The router 300 is connected between the Internet network 200 and the security equipment 400 to determine the communication path, the security equipment 400 is located between the router 300 and the aggregation switch 500, the customer network in real time Detection and blocking of harmful traffic among the traffic flowing into and out of 800 are performed and the log information is transmitted to the threat analysis module 102 in real time.

The DMZ 600 is a buffer zone between the external network and the internal network, and is separated by the setting of the firewall 700. The DMZ 600 is located in the customer network 800 due to security vulnerabilities caused by these servers by placing servers frequently accessed from the outside. It is desirable to avoid direct damage.

The customer network 800 is connected to the aggregation switch 500 through the firewall 700, and includes a server or PC 810 and a plurality of equipment 811 therein. At this time, most of the front end of the customer network 800 is installed with a firewall 700, so that it is not possible to execute a vulnerability analysis tool from the outside to perform IP scanning or port scanning for vulnerability analysis.

Here, the server or PC 810 in the customer network 800 is installed a vulnerability agent, scans all the equipment 811 in the customer network 800 and transmits the result to the vulnerability analysis module 101. For example, the vulnerability analysis of the vulnerability analysis module 101 includes "vulnerability level: high host: 221.xxx, service: RPC, check items: rpm / cmsd / running, port: 811 / tcp, description: cmsd, RPC service. "In operation" and so on. At this time, multiple vulnerability results may be generated for one server.

Hereinafter, a customer demand risk management method according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

First, the risk analysis module 103 uses the collected information to evaluate and store the value of the assets of the equipment in the customer network 800 and the DMZ 600 (S100). In other words, the asset value of the assets to be analyzed (network equipment such as routers and switches using IP, server systems such as web servers, DB servers, mail servers, network management systems (NMS), security equipment, etc.). Evaluate. At this time, the asset value may be differentiated internally by assigning weights according to role, importance, price, location, capacity, and the like.

For example, if the asset value of the mail server (not shown) and the DNS server (not shown) in the customer network 800 is evaluated, the mail server (not shown) is stopped only for the mail service when a security incident occurs. DNS server (not shown) will not be able to use the Internet at all in the event of a security accident. Therefore, when the value of the asset is quantified, the weight is given to the DNS server (not shown) rather than the mail server (not shown).

Then, when receiving a risk assessment request from the customer, the vulnerability analysis module 101 is the customer network 700 or DMZ (through the Internet network 200, router 300, security equipment 400, aggregation switch 500) 600 to collect information for vulnerability analysis by scanning (S200).

Accordingly, the vulnerability analysis module 101 evaluates the vulnerability level using the collected vulnerability information (S300). That is, the vulnerability analysis module 101 evaluates the vulnerability level based on the vulnerability analysis result, and may determine the vulnerability level by combining vulnerabilities corresponding to one device. For example, if you have a vulnerability that is vulnerable to a ping of death attack because the security patch does not run properly on a particular server's operating system, it randomly picks a ping packet that exceeds 65535 bytes. If you send it to the server, it means that the server is down, and the level of vulnerability is high. The method of calculating the vulnerability assessment is shown in Table 1 below.

Asset number 00000000 Asset name A system Asset IP 10.10.10.10 Vulnerability Information  Vulnerability i (Vi) Vulnerability j (Vj) Vulnerability k (Vk) meaning cmsd RPC service is running System Account Vulnerability Telnet access from any server Vulnerability level High High Medium Vulnerability Assessment
(Rv)

Rv: result of total vulnerabilities assessment of an asset
Vi,Vj,Vk: level of each vulnerability

Rv: result of total vulnerabilities assessment of an asset
Vi, Vj, Vk: level of each vulnerability

Table 1 discloses a case where the final vulnerability evaluation (Rv) is performed by calculating three (Vi, Vj, Vk) results for the asset A system.

Subsequently, the threat analysis module 102 collects harmful traffic detection and blocking log information received through the security device 400 in real time, and evaluates the threat level of the customer network 800 using the collected results (S400). ). At this time, the security equipment 400 detects and blocks harmful traffic flowing into and out of the customer network 800 in real time with equipment having an intrusion detection function and an intrusion blocking function, and transmits corresponding log information to the threat analysis module 102. . Here, the threat log information detected by the security device 400 includes an attacker, an attack type (DoS, backdoor, worm, virus, buffer overflow, cgi-vulnerability, etc.), occurrence time, attack traffic amount, attack packet number, target system, Attack intensity, etc., and is transmitted to the threat management module 102 via the Internet. Accordingly, the threat analysis module 102 may evaluate the threat level based on the received event log information as shown in Table 2 below, and may obtain a qualitative or quantitative result through the threat level calculated as described above.

T = s (severity, frequency, newness)
T: threat assessment value

severity: The risk of an attack, threat level (up, medium, or low) assessed objectively by the Cyber Emergency Response Team (CERT).
frequency: the frequency of the attacks, the more the attacks, the higher the threat level
newness: The higher the threat level, the higher the attack

ｆ: A function that determines the threat level by combining the three factors (severity, frequency, and newness)

At this time, the threat analysis module 102 determines the threat level of the asset by comprehensively calculating all the threats of the asset (equipment in the customer network 800, etc.). According to Table 2, the risk of each threat may be calculated, and the total threat level for a specific asset may be calculated as shown in Table 3 below by combining the levels of all threats.

Asset number 00000000 Asset name A system Asset IP 10.10.10.10 Threat information  Threat i (Ti) Threat j (Tj) Threat k (Tk) meaning targa2: denial of service attack using a vulnerability in the TCP / IP stack Connection type detected using CGI Bionet backdoor CodeRed.F (3) virus Threat level High (medium) high Threat assessment
(Rv)

Rt: result of total threats assessment of an asset
Ti, Tj, Tk: level of each threat

Rt: result of total threats assessment of an asset
Ti, Tj, Tk: level of each threat

As shown in Table 3, the threat assessment of the asset A system is calculated by calculating the three (Ti, Tj, Tk) results.

Thereafter, the risk analysis module 103 uses the vulnerability level and the threat level evaluation information evaluated through the processes S300 and S400 to calculate the risk level for the customer network 800 or the DMZ 600 using an algorithm as shown in Table 4 below. Evaluate (S500).

R: result of risk assessment
Wi: asset value
Rv: result of vulnerability assessment
Rt: result of threat assessment

R: result of risk assessment
Wi: asset value
Rv: result of vulnerability assessment
Rt: result of threat assessment

According to Table 4, the comprehensive risk assessment method calculates vulnerability levels and threat levels to perform risk analysis, and the result can be used to calculate the potential risk value of an asset quantitatively or qualitatively as shown in Table 5 below.

Asset A Asset B Asset C Asset D Asset valuation
10: High importance
1: low importance Wa Wb Wc Wd Vulnerability Assessment Rv (a) Rv (b) Rv (c) Rv (d) Threat assessment Rt (a) Rt (b) Rt (c) Rt (d) Risk analysis
R Ra Rb Rc Rd

Objectively assess the risk values of the servers or PCs 810 in the customer network 800 through the risk assessment results for assets as shown in Table 5, and report the results to the operator as shown in FIG. We recommend that you install security solutions or patch patches in order of high risk.

However, since the vulnerability analysis result can provide unnecessary information, it is desirable to perform the filtering process of information so that it can provide important information.

In addition, in the case of the threat log, it is preferable to select and extract only the essential threat information in consideration of the fact that the log information reduces the usefulness of the information by generating massive log information regardless of the threat level.

In addition, it is desirable to allow the user to check the reported results as shown in FIG.

As described above, the present invention, unlike the existing uniform one-time vulnerability analysis and threat management service, by evaluating and providing the vulnerability level and the threat level according to the needs of the customer, the customer easily checks the security of the own network periodically. It can carry out the security patch of the server or PC can be checked on a regular basis to increase the convenience of the customer.

In addition, the present invention combines the results of vulnerability assessment and threat assessment to conduct potential risk assessment of the asset, and thus, there is an effect of systematically and conveniently managing the customer's asset by using the result.

In addition, the preferred embodiment of the present invention for the purpose of illustration, those skilled in the art will be able to various modifications, changes, replacements and additions through the spirit and scope of the appended claims, such modifications and changes are the following claims Should be seen as belonging to.

Claims (17)

A vulnerability analysis module that collects port scanning information from network devices and servers in the corresponding customer network upon receiving a request from a customer, and analyzes the collected port scanning information to evaluate a vulnerability level; A threat analysis module for evaluating a threat level by receiving event log information through detection and blocking of harmful traffic flowing in and out of the customer network; And A risk analysis module for evaluating asset value of a customer network and analyzing the risk of the customer network using the vulnerability level, the threat level evaluation result, and the asset value evaluation result. Customer demand risk management system comprising a. The method of claim 1, wherein the vulnerability analysis module, Customer demand risk management system characterized in that the DMZ (demilitarized zone) is directly connected through the Internet network without evaluating the security equipment, the vulnerability is evaluated. The method of claim 1, wherein the vulnerability analysis module, A customer-specific risk management system, which provides a vulnerability analysis tool in the form of ActiveX for downloading through the web for a customer network equipped with a firewall. According to claim 2 or 3, wherein the vulnerability analysis module, Through port scanning and application level vulnerability checking, it is possible to check the OS vulnerabilities, open ports, application vulnerabilities, and backdoor infections of each device, and provide an analysis report on the results. Customer demand risk management system. The method of claim 1, wherein the threat analysis module, Evaluating the threat level of the customer network using real-time log information (attack, attack type, attack count, occurrence time, target system information) received from security equipment that detects and blocks harmful traffic flowing into the customer network. Customer demand risk management system. The method of claim 1, wherein the risk analysis module, Customer-customized risk management system, characterized in that for providing the customer to check the risk analysis results on the web. The method of claim 1 or 6, wherein the risk analysis module, Customer risk management system characterized in that for performing the risk analysis, the history management for the results. The method of claim 1 or 6, wherein the risk analysis module, According to the results of the risk analysis, customer-specific risk management system, characterized in that the customer recommended to install a security solution or security patch work. A first step in which the risk analysis module evaluates and stores asset values for the customer network; A second step of, when the vulnerability analysis module receives a request from a customer, collecting port scanning information from a network device and a server in the customer network, and analyzing the collected port scanning information to evaluate a vulnerability level; A third step of the threat analysis module evaluating a threat level by receiving event log information through detection and blocking of harmful traffic flowing into and out of the customer network from a security device; And A fourth process of the risk analysis module evaluating the risk of the customer network using the vulnerability level and threat level evaluation result and the asset value evaluation result; Customer-demand risk management method comprising a. 10. The method of claim 9, And a fifth step of the risk analysis module providing the customer with security measures according to the risk assessment. The method of claim 9, wherein the second process, A customer-specific risk management method characterized by directly assessing the vulnerability of the DMZ (demilitarized zone) through the Internet without going through security equipment. The method of claim 9, wherein the second process, A customer-specific risk management method for a customer network equipped with a firewall, the vulnerability analysis tool is provided in the form of ActiveX to download through the web. The method of claim 9, wherein the second process, Through port scanning and application level vulnerability checking, it is possible to check the OS vulnerabilities, open ports, application vulnerabilities, and backdoor infections of each device, and provide an analysis report on the results. Featured customer risk management methods. The method of claim 9, wherein the third process, Evaluating the threat level of the customer network using real-time log information (attack, attack type, attack count, occurrence time, target system information) received from security equipment that detects and blocks harmful traffic flowing into the customer network. Featured customer risk management methods. The method of claim 9, wherein the fourth process, Customer-customized risk management method, characterized in that provided to the customer to check the risk analysis results on the web. The method of claim 9, wherein the fourth process, And performing a risk analysis and performing a history management on the results. The method of claim 9, wherein the fifth process, According to the results of the risk analysis, customer-specific risk management method characterized in that the customer recommends the installation of a security solution or security patch work.

Images