KR102143510B1 - Risk management system for information cecurity - Google Patents

Abstract

The information security risk management system according to an embodiment of the present invention performs subject analysis based on basic information received from the subject server, and provides the subject server with inspection criteria for each subject according to the performed subject analysis result, and the subject server Provides the administrator server that calculates countermeasures based on the vulnerability received from and basic information input from the user to the administrator server, analyzes the vulnerability in response to the inspection criteria for each target received from the administrator server, and analyzes the analyzed vulnerability. It may include a target server that calculates a risk based on the risk level, requests countermeasures from the manager server in the order of asset items having a higher risk level, and receives and applies the countermeasures from the manager server.

Description

Information security risk management system {Risk management system for information cecurity}

The present invention relates to an information security risk management system. More specifically, the present invention is an information security that provides a stronger level of security for asset items determined to be of high importance in response to the vulnerability analysis by applying the importance according to the attributes of the company to which the target belongs through analysis by target person. It relates to a risk management system.

With the advancement of the IT industry, the importance of information security is also increasing. Companies and organizations, including government agencies, have enacted laws to improve the level of information protection, and are instructed to comply with mandatory certification systems. However, despite the voluntary efforts of these companies and organizations, various methods of intrusion threats are becoming increasingly sophisticated and specialized, and each agency and organization has come to a situation where it is necessary to have a professional security management system.

The conventional security management technology related to the derivation and removal of vulnerabilities is not customized according to industry information, and provides security functions in a batch manner. Accordingly, there is a problem in that the process is complicated and security management is difficult in deriving vulnerability and establishing security procedures.

Meanwhile, the prior art related to security vulnerability management is Registered Patent Publication No. 10-1651586 (security vulnerability management system discovered in the system development stage and the system operation stage).

Various embodiments of the present invention are designed to provide a customized security reinforcement function by separately designating an important inspection criterion for each subject's asset category and subject classification through subject-specific analysis, and analyzing vulnerabilities accordingly. In addition, various embodiments of the present invention have been devised to quantify the contents of a user's sentence-type vulnerability report and set a priority for preparing countermeasures based thereon.

The information security risk management system according to an embodiment of the present invention performs subject analysis based on basic information received from the subject server, and provides the subject server with inspection criteria for each subject according to the performed subject analysis result, and the subject server Provides the administrator server that calculates countermeasures based on the vulnerability received from and basic information input from the user to the administrator server, analyzes the vulnerability in response to the inspection criteria for each target received from the administrator server, and analyzes the analyzed vulnerability. It may include a target server that calculates a risk based on the risk level, requests countermeasures from the manager server in the order of asset items having a higher risk level, and receives and applies the countermeasures from the manager server.

The information security risk management system according to an embodiment of the present invention may perform security management tailored to a subject. Specifically, various embodiments of the present disclosure may provide a selective security enhancement function for important asset items for each subject in a more convenient manner through automatic classification of subjects and setting of asset class.

1 is a diagram showing the configuration of a security management system according to an embodiment of the present invention.
2 and 3 are block diagrams showing the configuration of a target server according to an embodiment of the present invention.
4 is a block diagram showing the configuration of a manager server according to an embodiment of the present invention.
5 is a flow chart showing a sequence of security management operations according to an embodiment of the present invention.
6 is a flowchart illustrating a sequence of security management operations performed between an administrator server and a target server according to an embodiment of the present invention.

The present invention can be applied to various changes and can have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail.

However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In describing each drawing, similar reference numerals are used for similar components.

When an element is referred to as being'connected' or'connected' to another element, it is understood that it may be directly connected or connected to the other element, but other elements may exist in the middle. Should be. On the other hand, when a component is said to be'directly connected' or'directly connected' to another component, it should be understood that no other component exists in the middle.

The terms used in this application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, terms such as'include' or'have' are intended to indicate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, and that one or more other features are present. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

1 is a diagram showing the configuration of a security management system according to an embodiment of the present invention. Referring to FIG. 1, the security management system according to an embodiment of the present invention may be composed of an administrator server 100 and a target server 200, and the target server 200 refers to a server such as individuals, companies, and organizations subject to security management. can do. In addition, the target server 200 may be connected to at least one terminal (20, 21, etc.).

The target server 200 and the manager server 100 may perform communication between both parties through a network. The administrator server 100 may check the security level of the target server 200 and provide countermeasures and security training to the target server 200 to compensate for security vulnerabilities.

2 and 3 are block diagrams showing the configuration of a target server according to an embodiment of the present invention.

First, referring to FIG. 2, it is shown that the target server 200 according to an embodiment of the present invention includes a communication unit 210, a storage unit 220, and a control unit 230. In addition, the control unit 230 may include an input information analysis unit 231, a vulnerability analysis unit 232, a risk evaluation unit 233, a security training unit 234, a statistics providing unit 235, and a blocking setting unit 236.

First, the communication unit 210 may use a network to transmit and receive data between a user device and a server, and the type of the network is not particularly limited. The network may be, for example, an Internet Protocol (IP) network that provides a large data transmission/reception service through an Internet Protocol (IP) or an All IP network that integrates different IP networks. In addition, the network is a wired network, a Wibro (Wireless Broadband) network, a mobile communication network including WCDMA, a High Speed Downlink Packet Access (HSDPA) network and a mobile communication network including a Long Term Evolution (LTE) network, LTE advanced (LTE-A) ), a mobile communication network including 5G (Five Generation), a satellite communication network and a Wi-Fi network, or at least one or more of them.

The communication unit 210 according to an embodiment of the present invention may perform communication with the manager server 100. In more detail, the communication unit 210 may transmit basic information related to a target person, information on a vulnerability and risk assessment result, etc. to the administrator server 100 side. In addition, the communication unit 210 may receive information related to inspection criteria and countermeasures from the manager server 100. In addition, the communication unit 210 may perform wired/wireless communication with a plurality of interlocked terminals 20, 21, etc. Specifically, the communication unit 210 may collect information on whether or not the interlocked terminals are accessible (whether a password is set).

The storage unit 220 may include, for example, an internal memory or an external memory. The built-in memory is, for example, volatile memory (e.g., dynamic RAM (DRAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM), etc.)), non-volatile memory (e.g., OTPROM (one time programmable ROM), PROM (programmable ROM), EPROM (erasable and programmable ROM), EEPROM (electrically erasable and programmable ROM), mask ROM, flash ROM, flash memory (e.g., NAND flash or NOR flash), hard drive, Alternatively, it may include at least one of a solid state drive (SSD).

External memory is a flash drive, for example, compact flash (CF), secure digital (SD), micro secure digital (Micro-SD), mini secure digital (mini-SD), extreme digital (xD), It may further include a multi-media card (MMC) or a memory stick. The external memory may be functionally and/or physically connected to the electronic device through various interfaces.

The storage unit 220 according to an embodiment of the present invention may store an asset classification criterion, a vulnerability analysis-related command and program, and a risk level determination-related command and program. In addition, the storage unit 220 may include and store commands and programs related to calculating vulnerability and risk statistics data for each asset according to a result of risk determination. In addition, the storage unit 220 may store commands and programs related to an operation of arbitrarily blocking external access to assets having a (security) risk higher than a specific reference value.

The control unit 230 may also be referred to as a processor, a controller, a microcontroller, a microprocessor, and a microcomputer. Meanwhile, the control unit may be implemented by hardware or firmware, software, or a combination thereof.

In the case of implementation by firmware or software, an embodiment of the present invention may be implemented in the form of a module, procedure, function, etc. that performs the functions or operations described above. The software code may be stored in a memory and driven by the controller. The memory may be located inside or outside the user terminal and the server, and may exchange data with the control unit by various means already known.

The control unit 230 according to an embodiment of the present invention may include an input information analysis unit 231, a vulnerability analysis unit 232, a risk evaluation unit 233, a security training unit 234, a statistics providing unit 235, and a blocking setting unit 236.

The input information analysis unit 231 may perform an operation of analyzing basic information of the target server 200 input by the user. In addition, the input information analysis unit 231 may classify and analyze information obtained from a plurality of terminals connected to the target server 200 as a target. For example, the input information analysis unit 231 may classify the assets by item based on the input basic information (eg, the asset name, the asset manager, the management department, the person in charge, the related institution, the business type, the department-specific tasks, etc.). For example, the input information analysis unit 231 may classify each asset item according to whether or not an asset related to an external web service is classified, according to a manufacturer, a manager, and other preset classification criteria. The input information analysis unit 231 may evaluate the importance of an asset for each asset item based on the input information. At this time, the importance of the asset may be calculated based on scores determined by dividing into items of confidentiality, integrity, and availability. For example, assets that can only be accessed and managed by the asset-owning department and the person in charge are scored with high confidentiality scores, and assets with no loss even if leaked to the outside may be scored with low confidentiality scores. In addition, the integrity is an evaluation item for unauthorized changes.For example, the integrity score is set as a high score for assets that cause loss in case of alteration or loss, and a low integrity score is set when the effect of alteration is negligible. Can be. In addition, for the availability, a high score may be given to assets that are adversely affected if they are not immediately used at a desired time, such as assets that operate uninterruptedly for 24 hours a year and assets that must be restored immediately in the event of a failure.

The confidentiality, integrity, and availability may be directly scored from 1 to 3 points by the user. In this case, the input information analysis unit 231 may determine the importance of the corresponding asset by grade based on the score assigned to each item of confidentiality, integrity, and availability. However, the present invention is not limited thereto, and the input information analysis unit 231 may evaluate the importance based on the name of each asset previously input by the user and characteristic information of each asset according to various embodiments. The input information analysis unit 231 determines that a predetermined specific word is included in, for example, the name of the input asset or other information, or in the case of a file of a predetermined specific format, the evaluation items (confidentiality, integrity , At least one of availability) can be controlled to automatically set the score to the highest or lowest score. In addition, the input information analysis unit 231 may provide part of the input basic information to the manager server 100 and request that the manager server 100 perform analysis (environmental analysis; PEST analysis) other than asset information.

The vulnerability analysis unit 232 may check vulnerabilities against administrative standards, technical standards, and physical standards from the viewpoint of information protection. The evaluation according to the administrative standard is a legal evaluation method, and the technical standard is the evaluation method for vulnerabilities from threats such as hacking. The vulnerability analysis unit 232 may be assigned an item for determining the vulnerability of the asset according to a preset asset classification method.

According to various embodiments, the vulnerability analysis unit 232 may interwork with the administrator server 100 side to determine and evaluate the vulnerability based on the details of the detailed vulnerability recorded by the user. Users can directly record their own assessment of security vulnerabilities (eg, omissions in records, accessibility of external staff, etc.) in sentence format. In contrast, when the vulnerability analysis unit 232 checks the details of the detailed vulnerability input by the user in sentences, the vulnerability analysis unit 232 may transmit the corresponding input information to the administrator server 100 to request natural language processing. In addition, after processing the content in natural language by the natural language processing unit (not shown) of the manager server 100, it is possible to determine the field (physical, technical) of the vulnerability and the degree of the vulnerability that the input detailed vulnerability means. Thereafter, the result of natural language processing and vulnerability determination performed by the administrator server 100 may be transmitted to the target server 200, and the vulnerability analysis unit 232 may separately store and manage the vulnerability determination result received from the administrator server 100.

Specifically, the manager server 100 may perform natural language processing based on artificial intelligence. The manager server 100 may store information related to key terms and vulnerabilities for each industrial field of an enterprise. In addition, the manager server 100 may perform a text recognition operation based on artificial intelligence according to various embodiments. Accordingly, the administrator server 100 receives contents that require natural language processing (e.g., contents described in detailed vulnerability items) among the input contents identified by the target server 200 from the target server 200, and processes them in natural language to respond to the corresponding contents. You can judge the content of the vulnerability and the level of the vulnerability. Thereafter, the manager server 100 may transmit the corresponding information to the vulnerability analysis unit 232 of the target server 200 again, and check and manage the vulnerability information for each asset in the target server 200.

In addition, the vulnerability analysis unit 232 may analyze the vulnerability by applying a weight corresponding to the asset type. For example, the vulnerability analysis unit 232 may apply a higher weight to an asset item whose classification is'document' and the person in charge is set to a specific person.

In addition, referring to FIG. 3, the vulnerability analysis unit 232 may include a simulated hacking unit 232a, a check standard setting unit 232b, and a harmful event detection unit 232c.

First, the mock hacking unit 232a performs mock hacking under the control of the mock hacking execution unit 132 of the manager server 100, and may collect and manage the results of the mock hacking. The result of the simulated hacking collected by the simulated hacking unit 232a (a weak path, a document with a low security strength, etc.) may be reflected in the vulnerability analysis.

The inspection criterion setting unit 232b may apply the inspection criterion for each subject provided from the manager server 100 to analyze the vulnerability in the subject server. The inspection criterion setting unit 232b may apply a weight to some asset items based on the inspection criterion when analyzing the vulnerability. For example, in the case of electronic device companies, weights may be set for asset items related to new product design and technology development contents, and accordingly, the inspection standard setting unit 232b provides more secure asset items with weights among asset items having the same level of security strength. It can be judged as being vulnerable (eg, the vulnerability value can be set high).

The harmful event detection unit 232c may detect the number of occurrences, a path of occurrence, and an attack target of harmful events such as malicious code and worm virus. The harmful event detection unit 232c may evaluate the vulnerability value differently according to the number of times a malicious event defined as a harmful event is detected in the target server and the linked terminal and the attack target. For example, if the influx of malicious code detected by the harmful event detection unit 232c is higher than a preset value, the vulnerability analysis unit 232 evaluates the overall level of security vulnerability in the server (e.g., it means that the security is very weak). Can be evaluated).

The risk evaluation unit 233 may evaluate the security risk of the target person based on the vulnerability analysis result. The risk level can be calculated for each asset category, and the risk level of each asset is the sum of'asset grade','standard importance','threat potential', and'threat impact' and the vulnerability calculated by the vulnerability analysis unit 232. It can be obtained from the multiplied by the evaluation result. More specifically, the risk may be calculated by (evaluation value)/(evaluation maximum value)*12*(vulnerability evaluation result)=(risk level).

The risk evaluation unit 233 may determine the risk based on the vulnerability evaluated according to the result of the simulated hacking. The risk assessment unit 233 can collect and manage information on access paths, documents and programs that are exposed to vulnerabilities by simulated hacking, and evaluate the asset items that are exposed to vulnerabilities as having a higher risk based on the results of the simulated hacking. I can.

The risk evaluation unit 233 may set the priority of requesting countermeasures according to the order of high risk, and may request countermeasures from the manager server 100 in the order of items having the highest priority of the response.

The security training unit 234 may perform an operation of applying the corresponding countermeasure as the countermeasure calculated by the manager server 100 is transmitted to the target server 100. The security training unit 234 may, for example, install and execute a security enhancement program received from the manager server 100. In addition, the security training unit 234 may automatically transmit a security reinforcement invitation message to the corresponding terminal in response to a password change and release event in the companion terminal detected by the target server 200. In addition, documents, programs, etc. that display a security enhancement recommendation message in the security training unit 234 may be separately designated. Alternatively, the security training unit 234 may display a security reinforcement recommendation message only for data whose asset class is evaluated above a preset value.

The statistics provider 235 can arrange and provide graphs according to various criteria (e.g., by item of each asset, by asset class, by manager, by risk level, etc.) of the result of risk determination performed inside the target server 200. have. In addition, the tables and graphs provided by the statistics providing unit 235 may be provided to be viewed by a general document preparation program.

The blocking setting unit 236 may control to block an access path when a harmful event is detected.

4 is a block diagram showing the configuration of a manager server according to an embodiment of the present invention.

Referring to FIG. 4, the manager server 100 may include a communication unit 110, a storage unit 120, and a control unit 130, and the control unit 130 includes a subject analysis unit 131, a simulated hacking execution unit 132, and a risk assessment and countermeasure calculation unit for each subject. 133, a statistics unit 134, and an update unit 135 may be included.

First, the communication unit 110 may perform a communication connection with a target server 200 according to an embodiment of the present invention. Specifically, the communication unit 110 may receive information transmitted from the target server 200 and transmit specific information to the target server 200. The information transmitted from the communication unit 110 to the target server 200 may correspond to, for example, information related to countermeasures, information related to vulnerabilities calculated by natural language processing based on artificial intelligence, and inspection criteria for each subject.

According to an embodiment of the present invention, the storage unit 120 includes instructions and algorithms for performing subject analysis based on basic information received from the subject server 200, legal information required for subject analysis (eg, environmental analysis), and subject analysis results. Information can be stored. In addition, the storage unit 120 may store commands and programs required for evaluating the level of vulnerabilities implied by the corresponding content by processing the content of detailed vulnerability in sentence format input from the target server 200 in natural language. Specifically, the storage unit 120 may process the content in the form of a sentence in natural language, and store an artificial intelligence-based program required to evaluate the level of vulnerability based on the processed content and key terms (industry terms) for each subject. . In addition, the storage unit 120 may store information related to statistics, updates, and simulated hacking performed by the manager server 100.

The control unit 130 may include a subject analysis unit 131, a simulated hacking execution unit 132, a risk assessment and countermeasure calculation unit 133 for each subject, a statistics unit 134, and an update unit 135.

First, the subject analysis unit 131 may perform subject analysis based on basic information received from the subject server 200. In this case, the subject analysis may include an operation of determining the classification of a company and institution to which the subject belongs. Further, the subject analysis may include an environment analysis for each subject, and the environment analysis may include an operation of detecting legal information related to an industry to which the subject belongs, and a related institution.

The subject analysis unit 131 may also calculate an inspection standard for each subject based on an environmental analysis for each subject. In this case, the inspection criteria for each subject may provide a criterion for classifying an asset item having a relatively high importance and an asset item having a relatively low importance among a plurality of asset items of the subject server received from the subject server. In addition, the above check criterion may apply a weight of importance to a specific asset item. The inspection standard setting unit 232b of the target server may analyze the vulnerability of the target server 200 after receiving and applying the check standard for each target calculated by the manager server 100.

The mock hacking execution unit 132 may be configured to perform mock hacking of the target server 200 by a mock hacking request from the target server 200. For example, the target server 200 may transmit a simulated hacking request to the manager server 100 as a random user request or a preset time (eg, 1 month) elapses. Accordingly, the manager server 100 may prepare a simulated hacking for each target server, and the simulated hacking execution unit 132 may set a lower priority of a hacking technique in which a history exists when there is a previous simulated hacking history. Accordingly, when an administrator attempts to hack a target person for whom a simulated hacking has been requested, hacking can be attempted based on a new hacking technique in which no previous hacking history exists. In addition, the simulated hacking execution unit 132 may calculate and provide information related to each target person and other information about the asset class so that the manager can refer to the information on the target person before performing the simulated hacking.

The subject-specific risk evaluation and countermeasure calculation unit 133 may perform an operation of evaluating the risk per subject based on the risk level information received from the subject server 200 and calculating a countermeasure. The risk assessment and countermeasure calculation unit 133 for each subject may distinguish between a countermeasure calculation operation of the manager server area and a countermeasure calculation operation of the manager area. The risk assessment and countermeasure calculation unit 133 for each target person includes, for example, a case where countermeasures in the administrator server area such as malicious code removal and vaccine installation are required, and countermeasures that require direct user corrective action such as manual revision and password change. When a countermeasure is requested in the 100th dimension of the manager server, programs and commands related to the countermeasure can be automatically provided to the target server 200. The countermeasure calculation unit 133 may control to display a countermeasure request message on the manager or target person server 200 when a user or manager-level countermeasure is requested.

The statistics unit 134 may calculate statistics on a risk value for each industry and a risk value for each subject based on basic information and a risk value transmitted from the subject server 200 according to an embodiment of the present invention. In addition, the statistics unit 134 may calculate important asset items and key terms for use by subject classification. The main terms of use calculated by the statistics unit 134 may be separately converted into a DB and managed, and may be used to process detailed weak content natural language and to determine vulnerability using the same.

Specifically, the main terms used for each subject calculated by the statistics unit 134 may be used to calculate the vulnerability value. For example, when the control unit 130 of the manager server 100 (e.g., a natural language processing unit in the control unit 130, not shown) processes the details of the detailed vulnerability received from the target server in natural language, the statistics unit calculates the details of the detailed vulnerability. When the main terms used by each subject category are included, control can be made to increase the number of vulnerabilities of the corresponding item. In addition, it is possible to select and apply, prepare, or recommend a pre-set countermeasure or preventive measure corresponding to each major terminology, and request to reconfirm if there is ambiguous or incorrect expression in the details of the entered detailed vulnerability. .

In one embodiment, the natural language processing unit parses the details of the detailed vulnerability received from the target server based on various criteria such as phonology, syllables, words, keywords, phrases and sentences, and compares each parsed component with a DB. It may be determined whether or not the main use terms for each subject classification calculated by the statistics unit are included among the detailed vulnerability details.

In an embodiment, in a DB in which the main use terms are managed, the main use terms for each subject classification and terms similar thereto may be classified and stored in each group. For example, if the user entering detailed vulnerability information does not know or does not know the terminology correctly, or if there is a mistake, it may be difficult to match the DB. Therefore, a group of terms considering several variables can be stored in the DB.

In an embodiment, the group of terms stored in the DB may be automatically collected and generated based on user history, detailed vulnerabilities input so far, web crawling, dictionary (synonym dictionary, etc.) search.

In addition, the control unit 130 of the manager server 100 may generate a group of terms including synonyms, synonyms, errors, misunderstandings, etc. of each term based on a model learned based on the above-described data, and store them in a DB.

In addition, in the case of a user who does not know the terminology, conditions, contents, circumstances, results, or symptoms corresponding thereto may be described and entered in natural language. The control unit 130 of the administrator server 100 performs machine learning based on the collected data based on the user's usage records, detailed vulnerabilities entered so far, web crawling, and dictionaries (synonym dictionary, etc.), and the user inputs therefrom. It is possible to obtain a model that derives the main terms stored in the DB from one detailed vulnerability.

The control unit 130 of the manager server 100 may perform natural language processing based on the learned model, derive key terms stored in the DB from detailed vulnerabilities entered by the user, and utilize them for vulnerability determination.

In an embodiment, the control unit 130 of the manager server 100 may assign a weight to the main usage term acquired from content included in the input detailed vulnerability. For example, a high weight is given to key terms that are clearly included in the detailed vulnerabilities, and if similar terms (synonyms, misunderstandings, misunderstandings, etc.) of major terms included in the DB are included in the detailed vulnerabilities, Is given a low weight, and if the main term used in the DB is not included in the detailed vulnerability, but the natural language processing results determine that the content corresponding to the main term is included in the detailed vulnerability, the lowest weight is given. Can be given.

The controller 130 may determine the utilization frequency and importance in consideration of the weight in using each of the main terms used to determine the vulnerability. For example, the use frequency and importance can be set higher as the main usage terms with higher weights.

In addition, the statistics unit 134 may calculate average information on major hacking (or malicious code entry) paths, major hacking techniques, etc. by subject classification (eg, classification by industry such as distribution companies, media companies, etc.). The average information for each subject classification calculated by the statistic unit 134 may be referred to when setting the inspection criteria and calculating countermeasures.

According to an embodiment of the present invention, the update unit 135 may check version information of an installed program of the target server 200 according to a preset time interval, and provide an update if necessary. The update unit 135 may, for example, update a vaccine program previously installed in the target server 200. In addition, the update unit 135 may provide a new security module provided by the manager server 100 to the target server 200 side.

5 is a flow chart showing a sequence of security management operations according to an embodiment of the present invention.

Referring to the order of the security management operation according to an embodiment of the present invention, first, the control unit 230 of the target server 200 may perform operation 505 of detecting the writing of basic information in relation to assets requiring security by a user. Thereafter, the controller 230 may perform an operation 510 of evaluating asset information based on the input basic information. In detail, the asset information evaluation operation may refer to an operation of classifying the written content by asset item and calculating a grade according to the importance of the asset.

Thereafter, the controller 230 may perform operation 515 for analyzing the vulnerability. At this time, the vulnerability analysis may be calculated based on the number of harmful events detected during a preset period, including the result of the simulated hacking.

Thereafter, the controller 230 may perform operation 520 of determining the degree of risk. The operation 520 may be an operation of determining the risk level for each asset item, and the controller 230 may utilize the analyzed vulnerability information including the asset class when determining the risk level. The control unit 230 may calculate the risk evaluation result as a value within a certain range (eg, 3 to 12), and may determine that an error has occurred when a value outside a preset range is calculated. The level of risk can be classified into high, medium, and low based on the risk level, and in the case of items whose risk is evaluated as high, priority can be given to calculating countermeasures.

Thereafter, the controller 230 may perform operation 525 of performing security training based on a program and command provided from the manager server. The security training may include, for example, an installation operation of a security enhancement program.

6 is a flowchart illustrating a sequence of security management operations performed between an administrator server and a target server according to an embodiment of the present invention.

First, when operation 605 of writing basic information is performed in the subject server 200, the subject server 200 may perform operation 610 of requesting an inspection standard from the manager server 100 side. Thereafter, the manager server 100 may perform operation 615 of analyzing the target person. Operation 615 of the subject analysis may include an operation of deriving an inspection criterion for each subject. Thereafter, the manager server 100 may perform operation 620 of providing the calculated inspection criteria for each subject to the subject server 200. Thereafter, the target server 200 may perform operation 625 of analyzing the vulnerability according to the inspection criteria. The target server 200 analyzes the vulnerabilities of the asset items of the target server according to the inspection criteria during operation 625, but may analyze the vulnerability by referring to additional data such as a simulation hacking result and the number of harmful events detected.

The target server 200 may perform operation 630 of transmitting the analysis result to the administrator server 100 after the vulnerability analysis. More specifically, the target server 200 may determine the security risk based on the vulnerability result information after the vulnerability analysis and calculate the security risk level. In addition, the analysis result provided from the target server 200 to the administrator server 100 may include the result of calculating the vulnerability and the degree of risk.

Thereafter, the manager server 100 may perform operation 635 of calculating a countermeasure based on the analysis result received from the target server 200. Thereafter, the manager server 100 may perform operation 640 of providing a countermeasure to the target server 200 side. In this case, the countermeasure may refer to a program that performs security enhancement, such as a vaccine program, including a message that summarizes usage guidelines for security enhancement. Thereafter, the target server 200 may perform operation 645 of applying the received countermeasure. The target server 200 may install and execute the received security enhancement program, for example. Alternatively, the target server 200 may perform an operation of controlling to display recommendations such as password change and e-mail reading attention to each linked terminal as a message.

In short, the security management system according to an embodiment of the present invention performs subject analysis based on basic information received from the subject server, and provides the subject server with inspection criteria for each subject according to the performed subject analysis result, and the subject server An administrator server that calculates countermeasures based on the vulnerability received from the administrator server and basic information input from the user is provided to the administrator server, and the vulnerability is analyzed in response to the inspection criteria for each target received from the administrator server, and the analyzed vulnerability The risk is calculated based on, and may include a target server for requesting countermeasures from the manager server in the order of asset items having a higher risk level, and receiving and applying countermeasures from the manager server.

Although the present invention has been described in detail with reference to the above-mentioned examples, those skilled in the art can make modifications, alterations, and modifications to the examples without departing from the scope of the present invention. In short, in order to achieve the intended effect of the present invention, it is not necessary to separately include all the functional blocks shown in the drawings or to follow all the orders shown in the drawings in the order shown, and even if not, the technical features of the present invention described in the claims Note that it can fall within the scope.

100: admin server
131: subject analysis unit
132: Simulated hacking execution unit
133: Risk assessment and countermeasure calculation unit for each subject
134: Statistics Department
135: update unit
200: target person server
231: input information analysis unit
232: Vulnerability analysis unit
233: Risk assessment unit
234: Security Training Department
235: Statistics providing unit
236: blocking setting unit

Claims (1)

An administrator server that performs subject analysis based on basic information received from the subject server, provides the subject server with inspection criteria for each subject according to the performed subject analysis result, and calculates countermeasures based on vulnerabilities received from the subject server ; And
Provides basic information input from the user to the manager server, analyzes vulnerabilities in response to the inspection criteria for each target received from the manager server, calculates a risk based on the analyzed vulnerability, and has a high risk value Including; a target server requesting the countermeasures from the manager server in the order of the items, and receiving and applying the countermeasures from the manager server,
The target server is
An input information analysis unit for classifying assets by preset items based on basic information input from a user and calculating a grade of the assets;
A vulnerability analysis unit that determines a vulnerability based on a simulated hacking result and a harmful event detection operation; And
Includes; a risk assessment unit that evaluates the risk based on the vulnerability determined by the vulnerability analysis unit,
The risk evaluation unit
The risk is calculated by calculating the evaluation score for the asset grade, standard importance, threat possibility and threat impact on the vulnerability evaluation result determined by the vulnerability analysis unit,
It is characterized in that priority is given to requesting countermeasures for asset items whose calculated risk value is greater than or equal to a preset value, and requests security countermeasures for the asset item to the manager server for the asset items according to the assigned order. Information security risk management system.

Images