KR102439817B1 - System and method for managing secure vulnerability, and recording medium storing program for executing the same - Google Patents

Abstract

The security vulnerability management system according to the present invention includes a compliance management unit that registers and manages evaluation criteria for security vulnerabilities and financial IT regulations for electronic financial infrastructure of financial-related institutions in an evaluation criteria DB, and a project for evaluating the security vulnerabilities. The project management unit that creates and registers and manages the asset to be inspected in the project DB, the asset management unit that creates and registers and manages the asset to be inspected in the asset DB, and the evaluation criterion of the project to which the asset to be inspected belongs from the evaluation criterion DB. Select the corresponding evaluation item, select an evaluation item suitable for the evaluation field of the asset to be inspected from among the pre-selected evaluation items, select an evaluation item that matches the attribute of the asset to be inspected from among the pre-selected evaluation items, and An evaluation item generation unit that registers evaluation items in the evaluation item DB, and an information security management system, server, database, network infrastructure, network equipment, information protection system equipment, web/mobile/ A vulnerability analysis unit that analyzes the security vulnerability by dividing the HTS application into 9 fields, an analysis result registration unit that registers the vulnerability analysis result of the asset to be inspected analyzed through the vulnerability analysis unit in the evaluation item DB; It may include a result generating unit that automatically calculates the analysis result of the security vulnerability from the evaluation item DB to generate vulnerability statistics, and generates a result sheet including the generated vulnerability statistics and security vulnerability related information.

Description

SYSTEM AND METHOD FOR MANAGING SECURE VULNERABILITY, AND RECORDING MEDIUM STORING PROGRAM FOR EXECUTING THE SAME

The present invention relates to a technique for managing security vulnerabilities in the financial field, and more particularly, to a security vulnerability management system and method capable of implementing the management of security vulnerabilities in electronic financial infrastructure specialized for electronic financial services through systems and algorithms, and It is about the recording medium.

With the development and spread of information and communication technology, the security vulnerabilities of electronic financial infrastructure in the financial field using information and communication facilities are checked and analyzed, and electronic financial infrastructure is inspected from internal and external attacks based on the analysis result. It is essential to protect the target assets (eg servers, network equipment, etc.).

In the related art, there is a method of automatically analyzing a security vulnerability of a server according to a determined time schedule. As a related patent document, there is Korean Patent Application Laid-Open No. 2009-0038683 (hereinafter referred to as a prior patent).

In the prior patent, the vulnerability search database stored in advance is called according to the schedule and execution commands, the possibility of the existence of vulnerabilities in the management web server is searched according to the vulnerability data included in the called search database, and vulnerability information is derived by optimizing the search results. Then, based on the derived results, a technique for checking the vulnerabilities of the management web server is disclosed.

At this time, in order to check the security vulnerabilities of the IT system, it is required to analyze various evaluation fields other than the server, for example, information protection management system, database, network infrastructure, network equipment, information protection system equipment, web/mobile/HTS application. .

For example, since there is no separate procedure for systematic security vulnerability inspection and management in other evaluation fields (e.g., from the evaluation criteria registration stage to the result generation stage) other than the server, the inspection procedure is always the same, such as missing or unnecessary procedures. There is a problem that level results cannot be guaranteed.

Korea Patent Publication No. 2009-0038683 (published date: 2009. 04. 21.)

An object of the present invention is to provide a security vulnerability management system and method capable of implementing the management of security vulnerabilities in electronic financial infrastructure specialized for electronic financial services using systems and algorithms.

An object of the present invention is to provide a computer-readable recording medium in which a computer program for causing a processor to perform a security vulnerability management method is stored.

The problem to be solved by the present invention is not limited to the above-mentioned, and another problem to be solved that is not mentioned can be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description. will be.

According to one aspect, the present invention includes a compliance management unit that registers and manages evaluation criteria for security vulnerabilities and financial IT regulations for electronic financial infrastructure of financial-related institutions in an evaluation criteria DB, and a project for evaluation of the security vulnerabilities. The project management unit that creates and registers and manages the project DB, the asset management unit that creates and registers and manages the asset to be inspected in the project DB, and the evaluation criteria of the project to which the asset to be inspected belongs from the evaluation criterion DB selects an evaluation item to be evaluated, selects an evaluation item suitable for the evaluation field of the asset to be inspected from among the pre-selected evaluation items, selects an evaluation item that matches the attribute of the asset to be inspected from among the pre-selected evaluation items, and selects the selected evaluation An evaluation item generation unit that registers the items in the evaluation item DB, and the asset to be inspected from which the evaluation items are selected is stored in an information security management system, server, database, network infrastructure, network equipment, information protection system equipment, web/mobile/HTS A vulnerability analysis unit that analyzes the security vulnerability by dividing the application into nine fields, an analysis result registration unit that registers the vulnerability analysis result of the asset to be inspected analyzed through the vulnerability analysis unit in the evaluation item DB, and the evaluation It is possible to provide a security vulnerability management system including a result generator that automatically calculates the analysis result of the security vulnerability from the item DB to generate vulnerability statistics, and generates a result sheet including the generated vulnerability statistics and security vulnerability related information.

The evaluation criteria of the security vulnerability of the present invention may include at least one or more of an information protection management system, a server, a database, a network infrastructure, a network device, an information protection system device, and a web/mobile/HTS application.

The financial IT regulation of the present invention may include at least one of the Electronic Financial Transactions Act, the Electronic Financial Transactions Act Enforcement Decree, the Electronic Financial Supervision Regulations, and the Electronic Financial Supervision Regulation Enforcement Rules.

The project of the present invention may include a project name, evaluation criteria, evaluation field, inspection target institution, and inspection execution period.

The check target asset of the present invention may include an asset name, a project name, an evaluation field, and an asset attribute.

The vulnerability analysis result of the present invention may include an evaluation item ID, an item name, whether it is vulnerable, and a basis for determination.

The result sheet of the present invention may include the vulnerability check result for the security vulnerability, information about the vulnerability of the determination basis and the action method, and statistics for each risk level and vulnerability statistics for each field.

According to another aspect, the present invention includes the steps of registering the evaluation criteria for security vulnerabilities for electronic financial infrastructure of financial-related institutions and financial IT regulations in the evaluation criteria DB, and creating a project for evaluating the security vulnerabilities. Registering in DB, generating and registering the asset to be inspected of the project in the asset DB, selecting an evaluation item corresponding to the evaluation criterion of the project to which the asset to be inspected belongs from the evaluation criterion DB, and selecting a pre-selection Selecting an evaluation item suitable for the evaluation field of the asset to be inspected from among the evaluation items, selecting an evaluation item suitable for the property of the asset to be inspected from among the previously selected evaluation items, and registering it in the evaluation item DB; The selected asset is divided into nine areas of information protection management system, server, database, network infrastructure, network equipment, information protection system equipment, and web/mobile/HTS application to analyze the security vulnerabilities, and the vulnerabilities The steps of registering the analysis result in the evaluation item DB, automatically calculating the analysis result of the security vulnerability from the evaluation item DB to generate vulnerability statistics; A security vulnerability management method including the step of creating may be provided.

According to another aspect, the present invention is a computer-readable recording medium storing a computer program for causing a processor to perform a security vulnerability management method, wherein the security vulnerability management method includes a security vulnerability for an electronic financial infrastructure of a financial institution. Registering the evaluation criteria and financial IT regulation of step, selecting an evaluation item corresponding to the evaluation criteria of the project to which the inspection target asset belongs from the evaluation criteria DB, selecting an evaluation item suitable for the evaluation field of the inspection target asset from among the pre-selected evaluation items, and selecting the pre-selection Selecting an evaluation item suitable for the properties of the asset to be inspected from among the evaluation items and registering it in the evaluation item DB; , information protection system equipment, performing the analysis of the security vulnerability by dividing it into 9 fields of web/mobile/HTS application, and registering the vulnerability analysis result in the evaluation item DB; It is possible to provide a computer-readable recording medium comprising the steps of automatically calculating the analysis result to generate vulnerability statistics, and generating a result sheet including the generated vulnerability statistics and security vulnerability-related information.

According to an embodiment of the present invention, the management function for security vulnerabilities based on the financial IT environment (financial IT regulation and technology) is implemented by implementing the management of security vulnerabilities in electronic financial infrastructure specialized for electronic financial services as a system and algorithm. can provide

According to an embodiment of the present invention, by sharing the evaluation progress, such as the inspection progress status and the vulnerability status, for a project for checking security vulnerabilities in real time, it is possible to realize the ease of project management.

1 is a block diagram of a security vulnerability management system according to an embodiment of the present invention.
2 is a flowchart illustrating a main process of managing security vulnerabilities of an inspection target asset according to an embodiment of the present invention.
3 is an exemplary diagram of a user interface (UI) for an evaluation criterion form.
4 is an exemplary view of automatically generating results generated through the result generating unit in the form of a summary report for each field and a detailed report for each field.
5 is an exemplary diagram of automatically calculating and outputting statistics for each risk level and vulnerability statistics for each control field.
6 is an exemplary view of statistical comparison of the vulnerability evaluation of the electronic financial infrastructure in 2020 and the vulnerability evaluation result of the electronic financial infrastructure in 2021.
7 is an exemplary view of a graph and a result of comparing existing/new evaluation indices for a plurality of evaluation fields.

First, the advantages and features of the present invention, and a method for achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. Here, the present invention is not limited to the embodiments disclosed below, but may be implemented in a variety of different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and are commonly used in the technical field to which the present invention pertains. Since it is provided by way of example so that those with knowledge of the present invention can clearly understand the scope of the invention, the technical scope of the present invention should be defined by the claims.

In addition, in the following description of the present invention, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, the terms described below are terms defined in consideration of functions in the present invention, which may vary depending on the intention or custom of a user, an operator, etc., of course. Therefore, the definition should be made based on the technical idea described throughout the description of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

As is known, the information and communication infrastructure of non-financial companies can evaluate and manage security vulnerabilities with standards and certifications such as, for example, major information and communication infrastructure vulnerability evaluation standards, ISO-27001 (ISMS), and PIMS.

In addition, the financial sector (eg, a financial company) can evaluate and manage security vulnerabilities based on the evaluation criteria for security vulnerabilities in electronic financial infrastructure specialized for electronic financial services (eg, the Financial Security Agency). In the present invention, the system and algorithm want to implement it.

1 is a block diagram of a security vulnerability management system according to an embodiment of the present invention, and may include a security vulnerability management module 110 , a database module 120 , and the like when broadly divided.

Referring to FIG. 1 , the security vulnerability management module 110 includes a compliance management unit 111 , a project management unit 112 , an asset management unit 113 , an evaluation item generation unit 114 , a vulnerability analysis unit 115 , and an analysis result. It may include a register 116 and a result generator 117, and the like, and the database module 120 includes an evaluation standard DB 122, a project DB 124, an asset DB 126, and an evaluation item DB 128. and the like.

The compliance management unit 111 in the security vulnerability management module 110 provides evaluation criteria for security vulnerabilities for electronic financial infrastructure of financial-related institutions (eg, Financial Security Agency, etc.) and financial IT regulations (eg, Electronic Financial Transactions Act, electronic finance). It is possible to provide functions such as registering and managing the Enforcement Decree of the Transaction Act, the Electronic Financial Supervision Regulations, etc.) in the evaluation standard DB 122 .

As an example, as shown in FIG. 3 , data such as evaluation criteria for security vulnerabilities and financial IT regulations in the evaluation criteria DB 122 through the user interface (UI) for the evaluation criteria (eg, Excel, etc.) form can be registered and managed (eg, added, modified, deleted, etc.).

The evaluation criteria for security vulnerabilities may include, for example, at least one or more of information protection management system, server, database, network infrastructure, network equipment, information protection system equipment, web/mobile/HTS application, and hundreds to thousands of evaluation items (eg, 720 evaluation items).

Financial IT regulations may include, for example, at least one of the Electronic Financial Transactions Act of the Republic of Korea, the Electronic Financial Transactions Act Enforcement Decree, the Electronic Financial Supervision Regulations, and the Electronic Financial Supervision Regulations Enforcement Rules.

To this end, the compliance management unit 111 collects information such as evaluation criteria for security vulnerabilities, financial IT regulations, evaluation fields (eg, information security management system, etc.) and evaluation item IDs (eg, FISM-001, etc.) in the evaluation criteria DB ( 122) can provide functions such as registration and management.

The project management unit 112 creates a project (project for evaluation of security vulnerabilities for inspection targets), for example, a project name, evaluation criteria, evaluation field, inspection target institution, inspection execution period, etc. to create a project including the project DB (124) ) and can provide a function to manage the project, such as monitoring the progress of the project, and backing up and restoring it.

To this end, in the project DB 124, for example, the project name such as the vulnerability check of electronic financial infrastructure, for example, evaluation criteria such as the vulnerability evaluation standard of the electronic financial infrastructure for 20 years, for example, the inspection target institution such as 00 bank, the inspection is performed Information such as a period may be stored.

The asset management unit 113 creates an asset to be inspected for the evaluation of security vulnerabilities, for example, an asset for each evaluation field including an asset name, a project name, an evaluation field, an asset attribute, etc., registers and manages it in the asset DB 126 , etc. function can be provided.

To this end, the asset DB 126 stores, for example, an asset name such as an Internet banking web server, for example, a project name such as a vulnerability check of an electronic financial infrastructure, an evaluation field such as a server, for example, an asset attribute such as AIX/7.1, etc. can be

The evaluation item generation unit 114 selects an evaluation item corresponding to the evaluation criterion of the project to which the asset belongs from the evaluation criterion DB 122, and selects an evaluation item from the asset DB 126 in the evaluation field of the asset to be inspected among the evaluation items previously selected. Appropriate evaluation items are selected, and among the previously selected evaluation items, an evaluation item that matches the properties of the asset to be inspected (refer to the asset properties for each evaluation field in Table 1 below as an example) is selected, and the selected evaluation items are stored in the evaluation item DB ( 128) may provide functions such as registering (saving).

evaluation field Asset property (type) Information Security Management System - Since the entire information protection management system of a financial company is defined as one asset, there is no attribute to classify the assets. server - OS type: AIX, HP-UX, Linux Solaris, Windows, other OS database - DBMS type: ORACLE, MS-SQL, MySQL, PostgreSQL, MariaDB, other DBMS network infrastructure - Since the entire network infrastructure of a financial company is defined as one asset, there is no attribute to classify assets network equipment - Manufacturer/Product Name: Cisco Systems/All Routers and Switches, A10 Networks/All Routers and Switches, BROADCOM/Brocade, Radware/Alteon, Nortel Networks/All Routers and Switches, F5 Networks/BIG-IP, Citrix/All Router and Switch Products, PIOLINK/All Routers and Switches, 3COM/All Routers and Switches, Juniper Networks/All Routers and Switches, Other Manufacturers/Products
-Equipment type: router, switch Information protection system equipment - Equipment type: DDOS, intrusion prevention system, intrusion prevention system, intrusion detection system, VPN, web firewall, other equipment web
application - Protocol type: HTTP, HTTPS
- Electronic financial infrastructure: Electronic financial infrastructure, non-electronic financial infrastructure mobile
application - OS type: IOS, Android, other OS
- Electronic financial infrastructure: Electronic financial infrastructure, non-electronic financial infrastructure HTS - Electronic financial infrastructure: Electronic financial infrastructure, non-electronic financial infrastructure

The vulnerability analysis unit 115 divides the inspection target asset into nine fields of information protection management system, server, database, network infrastructure, network equipment, information protection system equipment, and web/mobile/HTS application to analyze security vulnerabilities (automatic analysis or manual analysis).

For example, the vulnerability analysis unit 115 is a security setting value (command and factor values) and decision rules are predefined in the system source code, so vulnerabilities can be automatically analyzed according to subsequent procedures, and security setting information can be collected from the asset to be inspected through the user interface The result can be saved as a file, and the security setting information collection result (file) of the asset is entered into the system through the user interface, and the system determines the asset security setting information collection result and the security setting value and judgment defined in the source code in advance. It can provide functions such as automatically analyzing vulnerabilities by comparing rules.

In addition, the vulnerability analysis unit 115 may manually analyze (check) security vulnerabilities for each evaluation item selected for the asset to be inspected according to the evaluation field and asset properties. The manual inspection method for this is shown in Table 2 below. as shown in

evaluation field How to check information protection
management system - In accordance with the inspection methods and judgment rules for each vulnerability evaluation item, the security management status of financial companies' electronic financial infrastructure and internal security regulations and guidelines are analyzed to check for vulnerabilities. server - In accordance with the inspection method and judgment rule for each vulnerability evaluation item, the security setting status and operating environment of each asset are analyzed to check whether there is a vulnerability. database network equipment Information protection system equipment - In accordance with the inspection method and judgment rule for each vulnerability evaluation item, the vulnerability is checked by analyzing the access control policy (Access List), security setting status, and operating environment of each asset. network infrastructure - Vulnerability is checked by analyzing the network configuration, access list status, and electronic financial infrastructure operating environment of financial companies according to the inspection method and judgment rules for each vulnerability evaluation item. web application - Analyze the server operating environment of each asset and check whether the server and client programs are vulnerable according to the inspection methods and judgment rules for each vulnerability evaluation item mobile application HTS

The analysis result registration unit 116 registers the security vulnerability analysis result (vulnerability automatic analysis result or vulnerability manual analysis result) of the asset to be inspected analyzed through the vulnerability analysis unit 115 in the evaluation item DB 128 . can provide

To this end, the evaluation item DB 128 includes, for example, an evaluation item ID such as SRV-069, for example, a password, an item name such as insufficient management policy setting, for example, whether weak or weak, such as inappropriate password management policy setting content, etc. The same judgment basis may be stored.

The result generating unit 117 automatically calculates the analysis result of the security vulnerability from the evaluation item DB 128 to generate various vulnerability statistics, and the result containing the generated vulnerability statistics and security vulnerability related information (eg, judgment basis, etc.) It can provide functions such as automatically generating

For example, the result generating unit 117 can generate a result file by automatically calculating statistics such as vulnerability statistics by risk level and control field for each evaluation field based on the security vulnerability analysis result registered in the evaluation item DB 128, In addition, it is possible to provide a function of visually expressing (displaying) statistics through a monitor not shown by comparing security vulnerability statistics by year and by project.

Here, in the result generated by the result generating unit 117, for example, vulnerability information such as a vulnerability check result, judgment basis and action method for the found security vulnerability, and vulnerability statistics by risk level and control field for each evaluation field are included. may be included, and the result file may support various electronic document formats, for example, electronic document formats such as MS-EXCEL, MS-WORD, and HTML.

2 is a flowchart illustrating a main process of managing security vulnerabilities of an inspection target asset according to an embodiment of the present invention.

Referring to FIG. 2 , in the compliance management unit 111 , evaluation standards for security vulnerabilities for electronic financial infrastructure of financial-related institutions (eg, Financial Security Agency, etc.) and financial IT regulations (eg, Electronic Financial Transactions Act, Electronic Financial Transactions Act Enforcement Decree) , electronic financial supervision regulations, etc.) can be registered and managed in the evaluation standard DB 122 (step 202).

Here, the evaluation criteria for security vulnerabilities may include, for example, at least one or more of an information protection management system, a server, a database, a network infrastructure, a network device, an information protection system device, and a web/mobile/HTS application, and hundreds to thousands It may consist of evaluation items (for example, 720 evaluation items), and financial IT regulations, for example, comply with at least one or more of the Electronic Financial Transactions Act of the Republic of Korea, the Electronic Financial Transactions Act Enforcement Decree, the Electronic Financial Supervision Regulations, and the Electronic Financial Supervision Regulations Enforcement Rules. may include

The project management unit 112 creates a project (project for evaluation of security vulnerabilities for inspection targets), for example, a project name, evaluation criteria, evaluation field, inspection target institution, inspection execution period, etc. ) (step 204).

In the project DB 124, for example, the project name, such as the vulnerability check of electronic financial infrastructure, etc., for example, evaluation criteria such as the vulnerability evaluation standard of the electronic financial infrastructure for 20 years, for example, inspection target institutions such as 00 bank, inspection execution period, etc. Information may be stored.

The asset management unit 113 creates an asset to be inspected for the evaluation of security vulnerabilities, for example, an asset for each evaluation field including an asset name, a project name, an evaluation field, an asset attribute, and the like, and registers it in the asset DB 126 (step 206). .

In the asset DB 126, asset names such as, for example, Internet banking web server, for example, project names such as vulnerability check of electronic financial infrastructure, etc., for example, evaluation fields such as servers, for example, asset properties such as AIX/7.1, etc. may be stored. .

The evaluation item generating unit 114 selects an evaluation item corresponding to the evaluation criterion of the project to which the asset belongs from the evaluation criterion DB 122, and selects an evaluation item suitable for the evaluation field of the asset to be inspected from among the selected evaluation items, , from among the previously selected evaluation items, select an evaluation item that matches the property of the asset to be inspected (refer to the property attribute for each evaluation field in Table 1 presented above as an example), and then register it in the evaluation item DB (step 208).

The vulnerability analysis unit 115 divides the asset to be inspected into nine fields: information protection management system, server, database, network infrastructure, network equipment, information protection system equipment, and web/mobile/HTS application to analyze security vulnerabilities (automatic analysis). or manual analysis) (step 210).

That is, in the vulnerability analysis unit 115, security setting values (commands and parameter values) for determining whether vulnerabilities are vulnerable by asset properties (OS type of server, manufacturer/product name of network equipment) in the field of server and network equipment capable of automatic vulnerability analysis ) and judgment rules are predefined in the system source code, so the vulnerability is automatically analyzed according to the subsequent procedure, and the command to collect security setting information from the asset to be inspected is executed through the user interface, and the result is saved as a file. , input the security setting information collection result (file) of the asset into the system through the user interface, and the system compares the security setting information collection result of the asset with the security setting value and judgment rule defined in the source code in advance to automatically detect vulnerabilities Analyze.

The analysis result registration unit 116 registers the security vulnerability analysis result (automatic vulnerability analysis result or manual vulnerability analysis result) of the asset to be inspected analyzed through the vulnerability analysis unit 115 in the evaluation item DB 128 .

The result generator 117 automatically calculates the analysis result of the security vulnerability from the evaluation item DB 128 to generate various vulnerability statistics (step 212), and the generated vulnerability statistics and security vulnerability related information (eg, judgment basis, etc.) A result sheet including is automatically generated (step 214).

That is, the result generating unit 117 automatically calculates statistics such as vulnerability statistics by risk level and control field for each evaluation field based on the security vulnerability analysis result registered in the evaluation item DB 128 to generate a result file.

The result generated by the result generating unit 117 may include, for example, vulnerability-related information such as the vulnerability check result for the discovered security vulnerability, the basis for judgment and the action method, and the vulnerability statistics by risk level and control field for each evaluation field, and the like. , the result file may support various electronic document formats, such as MS-EXCEL, MS-WORD, HTML, and the like.

4 shows an example of automatically generating results generated through the result generating unit in the form of a summary report for each field and a detailed report by field according to an embodiment of the present invention.

5 shows an example of automatically calculating and outputting (expressing) vulnerability statistics by risk level and control field for each evaluation field according to an embodiment of the present invention.

6 shows a comparison of vulnerability statistics by year/project, and shows an example of statistical comparison of the vulnerability evaluation result of the electronic financial infrastructure in 2020 and the vulnerability evaluation result of the electronic financial infrastructure in 2021.

7 shows an example of a graph and a result of comparing existing/new evaluation indices for a number of evaluation fields.

Meanwhile, combinations of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment, such that the instructions executed by the processor of the computer or other programmable data processing equipment correspond to each block in the block diagram or in the flowchart. Each step creates a means for performing the described functions.

These computer program instructions may also be stored in a computer-usable or computer-readable memory, etc., which may be directed to a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer-usable or computer-readable memory. The instructions stored in the block diagram may produce an article of manufacture containing instruction means for performing the functions described in each block in the block diagram or in each step in the flowchart.

And, since the computer program instructions may be mounted on a computer or other programmable data processing equipment, a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other program It is also possible that instructions for performing the possible data processing equipment provide steps for carrying out the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or each step may represent a module, segment, or part of code including at least one or more executable instructions for executing specified logical function(s). It should also be noted that in some alternative embodiments it is also possible for the functions recited in blocks or steps to occur out of order. For example, it is possible that two blocks or steps shown one after another may in fact be performed substantially simultaneously, or that the blocks or steps may sometimes be performed in the reverse order according to the corresponding function.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains may make various substitutions, modifications, and changes within the scope not departing from the essential characteristics of the present invention. It will be easy to see that this is possible. That is, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments.

Therefore, the protection scope of the present invention should be interpreted by the claims described below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

110: security vulnerability management module
111: Compliance Management Department
112: project management department
113: asset management department
114: evaluation item generation unit
115: vulnerability analysis unit
116: analysis result register
117: result generating unit
120: database module
122: evaluation criteria DB
124 : Project DB
126 : Asset DB
128: evaluation item DB

Claims (7)

A compliance management department that registers and manages the evaluation criteria for security vulnerabilities and financial IT regulations of financial institutions' electronic financial infrastructure in the evaluation criteria DB;
A project management unit that creates a project for evaluation of the security vulnerability, registers it in the project DB, and manages it;
An asset management unit that creates an asset to be inspected for the project, registers it in the asset DB, and manages it;
Selecting an evaluation item corresponding to the evaluation standard of the project to which the inspection target asset belongs from the evaluation criteria DB, and selecting an evaluation item suitable for the evaluation field in which the inspection target asset is classified by asset of the same type among the selected evaluation items; , an evaluation item generation unit that selects an evaluation item suitable for an asset attribute, which is a type of asset to be inspected, from among the previously selected evaluation items, and registers the selected evaluation item in the evaluation item DB;
Analysis of the security vulnerability is performed by dividing the asset to be inspected for which the evaluation items are selected into nine fields: information protection management system, server, database, network infrastructure, network equipment, information protection system equipment, and web/mobile/HTS application a vulnerability analysis unit that
an analysis result registration unit that registers the vulnerability analysis result of the asset to be inspected, analyzed through the vulnerability analysis unit, in the evaluation item DB;
Comprising a result generating unit that automatically calculates the analysis result of the security vulnerability from the evaluation item DB to generate vulnerability statistics, and generates a result sheet including the generated vulnerability statistics and security vulnerability related information
Security Vulnerability Management System. The method of claim 1,
The evaluation criteria of the security vulnerability are,
Information security management system, server, database, network infrastructure, network equipment, information security system equipment, including at least one of web / mobile / HTS application
Security Vulnerability Management System. The method of claim 1,
The financial IT regulation is,
A security vulnerability management system including at least one of the Electronic Financial Transactions Act, the Electronic Financial Transactions Act Enforcement Decree, the Electronic Financial Supervision Regulations, and the Electronic Financial Supervision Regulation Enforcement Rules. The method of claim 1,
The project is
Project name, evaluation criteria, evaluation field, inspection target institution, inspection period
Security Vulnerability Management System. The method of claim 1,
The assets to be inspected are:
Asset name, project name, evaluation field, asset attribute including
Security Vulnerability Management System. The method of claim 1,
The vulnerability analysis result is,
evaluation item ID, item name, vulnerability, and
Security Vulnerability Management System. The method of claim 1,
The result is
The vulnerability check result for the above security vulnerability, including information on the vulnerability of the basis for judgment and action method, statistics by risk level, and vulnerability statistics by field
Security Vulnerability Management System.

Images