KR102594207B1 - Security compliance automation method - Google Patents

Abstract

A security compliance automation device is launched. The security regulation compliance automation device of the present invention includes a regulation input unit that receives a plurality of regulations and standard values for the regulations; a regulation mapping table unit that compares regulations input from the regulation input unit and creates a mapping table; a reference modeling unit that detects representative reference points of regulations by reference modeling the regulations grouped by the regulation mapping table unit; and a workflow engine unit that determines whether the protection target equipment satisfies regulations based on representative reference points detected by reference modeling.

Description

Security Compliance Automation {SECURITY COMPLIANCE AUTOMATION METHOD}

The present invention relates to an automated device for compliance with security regulations, and more specifically, to an automated device for compliance with security regulations that compares multiple security regulations, searches for representative reference points, and determines whether the security regulations of the protected equipment are satisfied based on the retrieved representative reference points. will be.

The electric power industry must be strictly classified, managed, and protected by the Information and Communication Infrastructure Protection Act. This is called security compliance.

For the safety and basic living of the people, organizations with government-designated infrastructure must comply with security regulations.

Security for the electric power industry and key industries is largely divided into three areas: managerial, physical, and technical. In other words, security regulations for the facility can be satisfied only when security policies, measures, and procedures for the facility are implemented administratively, physically, and technically. For example, personnel management and partner management matters are divided into the administrative security area, passwords, CCTV surveillance, etc. are divided into the physical security area, and electronic security devices such as systems or network equipment can be divided into the technical security area. there is.

There are currently various types of managerial, physical, and technical security technologies applied to the electric power industry. As a result, in the past, it was practically difficult to manage the many security devices installed for the purpose of protecting power facilities, and individual management was inefficient in terms of cost, manpower, and time.

In addition, technically, compatibility between security devices is difficult due to the use of different protocols and communication technologies, and there are problems affecting the operation of existing facilities due to security devices. For example, in the case of the SCADA (Supervisory Control And Data Acquisition) system, which is a major infrastructure, the construction status of information security facilities corresponding to technical security includes hardware such as intrusion prevention systems and integrated threat management devices, and software such as security operating systems and antivirus. There are thousands of them. In addition, recently, new devices such as IoT (Internet of Things) sensors are being added along with physical security equipment, so a system to integrate them is needed.

The background technology of the present invention is disclosed in Korean Patent Publication No. 10-2018-0128120 (2018.12.03) titled ‘Environmental safety integrated management system and diagnostic evaluation method thereof’.

The present invention was created to improve the above-mentioned problems, and the purpose of one aspect of the present invention is to compare a plurality of security regulations to search for representative reference points and determine whether the security target device satisfies the security regulations based on the searched representative reference points. The goal is to provide a device that automates security compliance.

An apparatus for automating security regulation compliance according to an aspect of the present invention includes a regulation input unit that receives a plurality of regulations and reference values for the regulations; a regulation mapping table unit that generates a mapping table by comparing the regulations input from the regulation input unit; a reference modeling unit that detects a representative reference point of the regulation by reference modeling the regulations grouped by the regulation mapping table unit; And a workflow engine unit that determines whether the regulation of the equipment to be protected is satisfied based on the representative reference point detected by the reference modeling, wherein the workflow engine unit identifies the assets of the equipment to be protected, and determines whether the assets of the equipment to be protected are Once identified, an asset management and risk assessment department that detects risk indicators that evaluate the risk of the equipment to be protected; A security management data linkage unit that receives data on security target equipment through a security system input unit; A monitoring unit that connects with the security management data linkage unit to inspect and take action on vulnerabilities in data input from the security management data linkage unit based on a standard value that has undergone a risk assessment and outputs status rating information; And a status tracking unit that tracks the security management status of the equipment to be protected according to regulations using the status rating information output from the monitoring unit, and the asset management and risk assessment unit determines the importance, vulnerability and threat of the equipment to be protected. A risk index is detected by calculating the risk by multiplying the factor consisting of If the representative reference point is different, the inspection action is fed back to the security management data linkage unit.

The security regulation compliance automation device according to one aspect of the present invention can compare a plurality of security regulations, search for representative reference points, and determine whether the security target equipment satisfies the security regulations based on the searched representative reference points.

The security regulation compliance automation device according to another aspect of the present invention provides clear standards and representative reference points for ambiguous laws and regulations through reference modeling, and expands the regulation set consisting of security regulations (Standard) and criteria (Criteria) to comply with laws and regulations. It makes it possible to technically implement the concept of security compliance through one-to-one mapping between

1 is a block diagram of a security remedy compliance automation device according to an embodiment of the present invention.
Figure 2 is a diagram showing a set of regulations according to an embodiment of the present invention.
Figure 3 is a block diagram of a regulation mapping unit according to an embodiment of the present invention.
Figure 4 is a diagram showing a regulation mapping table according to an embodiment of the present invention.
Figure 5 is a block diagram of a reference modeling unit according to an embodiment of the present invention.
Figure 6 is a block diagram of a workflow engine unit according to an embodiment of the present invention.
Figure 7 is a diagram showing the operation process of the security management data linking unit according to an embodiment of the present invention.
Figure 8 is a diagram showing an example of operation of the security management data linkage unit according to an embodiment of the present invention.
Figure 9 is a diagram showing the operation process of the monitoring unit according to an embodiment of the present invention.
Figure 10 is a diagram showing an example of operation of a monitoring unit according to an embodiment of the present invention.
Figure 11 is a diagram showing the operation process of the state tracking unit according to an embodiment of the present invention.
Figure 12 is a diagram showing an example of operation of the state tracking unit according to an embodiment of the present invention.
Figure 13 is a diagram showing an example of the operation of the output unit according to an embodiment of the present invention.
Figure 14 is a diagram showing an example of a management field according to an embodiment of the present invention.
Figure 15 is a diagram showing an example of a physical field according to an embodiment of the present invention.
Figure 16 is a diagram showing an example of a technical field according to an embodiment of the present invention.
Figure 17 is a diagram showing NERC-CIP-007 R.5 according to an embodiment of the present invention.
Figure 18 systematically maps the laws that the system must comply with by mapping North American regulations (e.g., NERC-CIP 007 R.5) according to an embodiment of the present invention based on the standard (W-01) provided by KISA. This diagram shows an example of reference modeling.
Figure 19 is a diagram illustrating an example of regulatory content corresponding to a representative reference point in a rule according to an embodiment of the present invention.

Hereinafter, an apparatus and method for automating security regulation compliance according to an embodiment of the present invention will be described in detail with reference to the attached drawings. In this process, the thickness of lines or sizes of components shown in the drawings may be exaggerated for clarity and convenience of explanation. In addition, the terms described below are terms defined in consideration of functions in the present invention, and may vary depending on the intention or custom of the user or operator. Therefore, definitions of these terms should be made based on the content throughout this specification.

Figure 1 is a block diagram of an automated device for compliance with security regulations according to an embodiment of the present invention, Figure 2 is a diagram showing a set of regulations according to an embodiment of the present invention, and Figure 3 is a diagram showing a set of regulations according to an embodiment of the present invention. Figure 4 is a block diagram of a regulation mapping unit according to an embodiment of the present invention, Figure 4 is a diagram showing a regulation mapping table according to an embodiment of the present invention, Figure 5 is a block diagram of a reference modeling unit according to an embodiment of the present invention, and Figure 6 is It is a block diagram of the workflow engine unit according to an embodiment of the present invention, Figure 7 is a diagram showing the operation process of the security management data linking unit according to an embodiment of the present invention, and Figure 8 is a diagram showing the operation process of the security management data linkage unit according to an embodiment of the present invention. It is a diagram showing an example of the operation of the security management data linkage unit according to the present invention, Figure 9 is a diagram showing the operation process of the monitoring unit according to an embodiment of the present invention, and Figure 10 is a diagram showing an example of the operation of the monitoring unit according to an embodiment of the present invention. It is a diagram, FIG. 11 is a diagram showing the operation process of the state tracking unit according to an embodiment of the present invention, FIG. 12 is a diagram showing an example of the operation of the status tracking unit according to an embodiment of the present invention, and FIG. 13 is a diagram showing the operation process of the state tracking unit according to an embodiment of the present invention. This is a diagram showing an example of a dashboard operation according to an embodiment of.

Referring to FIG. 1, the security regulation compliance automation device according to an embodiment of the present invention includes a regulation input unit 10, a regulation mapping unit 20, a reference modeling unit 30, and a workflow engine unit 40. do.

The regulation input unit 10 receives individual regulations and reference values for each regulation.

In general, regulations may include domestic laws, foreign laws, international standards such as IEC, and inter-company standards (DE FACTO). Domestic law also has lower-level laws such as higher-level laws, guidelines, and guides, and the types and standard values of regulations may vary depending on lower-level laws such as higher-level laws, guidelines, and guides.

Referring to FIG. 2, the regulation input unit 10 receives regulations and standard values for determining compliance with each regulation. Hereinafter, each security regulation and its standard values are referred to as a regulation set.

The regulation mapping unit 20 compares a plurality of regulations input from the regulation input unit 10 and generates a mapping table. The regulation mapping unit 20 includes a regulation comparison unit 21 and a mapping table unit 22.

Different regulations are regulations of different regions, institutions, countries, etc., and there is no particular limitation as long as the regulations are different.

The regulation comparison unit 21 compares a plurality of regulations, for example, two regulations input from the regulation input unit 10, and groups them according to similarity.

Grouping can be divided into physical group, technical group, and administrative group.

The reason for dividing regulations into physical, technical, and administrative groups is that most security requirements fall into three categories (physical, technical, and administrative). However, grouping methods can be classified in various ways depending on the characteristics or categories of regulations limited to the above-described embodiments.

The mapping table unit 22 defines a regulation representing each grouped regulation in a rule item, and maps the items and standard values of all regulations entered for each rule. Here, the rule is a more detailed and actionable rule than the regulation represented by each grouped regulation.

*Referring to Figure 4, three categories of rules can be entered in the row of the mapping table, standard values for each regulation can be input in the column, and these columns can be expanded after a set is defined. That is, the regulation set of the regulation input unit 10 can be expanded to columns.

The reference modeling unit 30 detects a representative reference point (Criteria of Criteria) of the regulation by reference modeling each regulation grouped as described above. The reference modeling unit 30 includes a reference information modeling unit 31 and a scheduler 32.

Typically, all regulations entered have their own set reference points. Accordingly, the reference information modeling unit 31 performs reference modeling to find a representative reference point, that is, a representative reference point (Criteria of Criteria).

Referring to FIG. 5, in order to perform reference modeling, the reference information modeling unit 31 first detects a representative reference point set as a more detailed and practical rule than the upper level law.

For example, rules include the Korea Internet & Security Agency (KISA)'s security vulnerability guide, the Information Security Certification System (ISMS), and the rules provided by the National Institute of Standards and Technology (NIST).

The reference information modeling unit 31 receives objects for data modeling from these rules and goes through a rule matching process to check whether the input regulation set conforms to the rules.

The criteria providing the execution rules can be updated either periodically or aperiodically due to changes in the environment.

Accordingly, the scheduler 32 updates the standard for providing the execution rule by reflecting the standard for providing the execution rule.

The workflow engine unit 40 determines whether the protection target equipment satisfies the regulations based on representative reference points modeled by the reference modeling unit 31.

The workflow engine unit 40 is used to determine whether the equipment to be protected complies with security regulations. As shown in FIG. 6, the workflow engine unit 40 includes an asset management and risk assessment unit 41, a security management data linkage unit 42, It includes an asset identification and risk assessment unit 41, a monitoring unit 43, a status tracking unit 44, and an output unit 45.

The security management data input unit 42 receives data from the security system of the protected equipment (power equipment, for example, SCADA) by interfacing with the security system linkage unit. This may be consistent with the regulatory mapping unit 20's division of technical, administrative, and physical security. In other words, the security system that protects the infrastructure can be connected to the workflow engine unit 40 through three types of interfaces (IF 1, 2, and 3).

Meanwhile, there is a separate asset management system to manage the infrastructure subject to protection, and this asset management system is also linked to the security management data linkage unit 42.

In other words, the asset management and risk assessment unit 41 identifies the assets of the equipment to be protected based on security system data linkage, and once the assets of the equipment to be protected are identified, it evaluates the risk of the equipment to be protected.

In risk assessment, the asset management and risk assessment unit 41 calculates the risk by multiplying factors consisting of the importance, vulnerability, and threat of the equipment to be protected and displays it as a risk index.

The risk level is provided to the monitoring unit 43 and the status tracking unit 44 and can be used to determine the level and priority of protective measures for the equipment to be protected. This is explained in more detail below.

The security management data linkage unit 42 can receive all types of data from security target equipment by interfacing with technical, managerial, and physical security systems.

Referring to Figures 7 and 8, data linkage methods are largely divided into two types: agentless method and agent method.

Agentless method is a method of receiving SNMP protocol or Syslog, a system log file. Agentless method is only possible for devices that can communicate with the security system using the standard protocol. In the case of the Agentless method, the internal protocol processor analyzes the SNMP protocol or Syslog, a system log file, and delivers messages about security events to the internal Agent processor.

The Agent method is a method based on a self-produced protocol and collects data directly by installing an Agent (S/W) in the equipment to be protected. The collected data is provided to the monitoring unit 43 to check vulnerabilities. Meanwhile, the action command transmitted from the monitoring unit 43 is input to the Agent processor to implement security measures to satisfy regulations (compliance).

The agent processor includes an agent manager that receives security management messages by communicating directly from the agent installed on the protected equipment, and an event manager that receives security event messages from a standard communication protocol (SNMP, Syslog) analyzer. Equipped with The event manager issues an inspection order to the monitoring unit 43 and receives an action order.

Referring to Figures 9 and 10, the monitoring unit 43 checks for data vulnerabilities and takes action in conjunction with the security management data linkage unit 42. To this end, the monitoring unit 43 transmits and receives inspection commands and action commands to the security management data linking unit 42. Here, the basis for the action order is the standard values that have been assessed for risk after asset identification.

To this end, the monitoring unit 43 detects security data from the inspection command received from the security management data linking unit 42 and matches the detected security data with a representative reference point of the reference modeling unit 30.

In this case, the monitoring unit 43 feeds back inspection measures to the security management data linkage unit 42 if the representative reference points of the security data and the reference modeling unit 30 are different. Checking action means changing the status of the asset (object of protection) according to the rule if the rule and security data do not match. For example, in the case of 'rule: Unnecessary account detected', 'Action: Delete unnecessary account' command is created and sent.

Afterwards, the monitoring unit 43 compiles the asset information, asset identification, and risk assessment score and compliance score detected by the risk assessment unit 41 and outputs status rating information to the status tracking unit 44. .

The status tracking unit 44 tracks the security management status of the corresponding protection target equipment according to regulations.

The status tracking unit 44 utilizes the status rating information of the equipment subject to inspection, action completion, and uncompleted protection through the security management data linkage unit 42 and the monitoring unit 43.

The status tracking unit 44 compiles the status rating information of all assets being managed and classifies compliance scoring.

The compliance scoring calculation formula is as follows.

Compliance Score = {∑Asset _i ×Risk _i ×(number of rule matched/number of total requirements)}/number of total assets

Here, Asset _i is asset information, and Risk _i is the risk assessment score.

As shown in FIG. 13, the output unit 45 includes the asset identification and risk assessment unit 41, the security management data linkage unit 42, the monitoring unit 43, and the status tracking unit of the workflow engine unit 40 ( 44) Each operation situation is diagrammed and statistics and reporting functions on compliance and asset status are performed.

Figure 14 is a diagram showing an example of a management field according to an embodiment of the present invention, Figure 15 is a diagram showing an example of a physical field according to an embodiment of the present invention, and Figure 16 is a diagram showing an example of a physical field according to an embodiment of the present invention. It is a drawing showing an example of a technical field according to the present invention, and Figure 17 is a drawing showing NERC-CIP-007 R.5 according to an embodiment of the present invention, and Figure 18 is a drawing showing the North American regulations (e.g., This is a diagram showing an example of systematic reference modeling of the laws that the system must comply with by mapping NERC-CIP 007 R.5) to the standard (W-01) provided by KISA, and Figure 19 is an example of the present invention. This is a diagram showing an example of rules corresponding to representative standard values for regulatory content according to an embodiment.

For example, in KISA (Korea Internet & Security Association), items for vulnerability analysis and evaluation can be divided into management, physical, and technical fields and presented as in the table shown in Figures 14 to 16. there is.

In addition, NERC-CIP-007 R.5, a representative North American standard shown in Figure 17, does not provide specific standards for 'Change known default passwords'.

In this case, in order to perform representative modeling, the vulnerability check items provided by the reference management agency (KISA) are coded (Administrative_01, Physical_01, Technical_01, ...) and reference modeling is performed.

For a more detailed explanation, the table shown in FIG. 18 maps North American regulations (e.g., NERC-CIP 007 R.5) based on the standard (W-01) provided by KISA to show the laws that the system must comply with. This is the result of reference modeling.

According to W-01, system administrators are encouraging users to change their account name from Administrative to something else.

Although NERC-CIP is abstract, the representative standard (Criteria of Criteria) presents a clear standard of ‘≠Administrative’.

Meanwhile, a detailed example of a rule is to code contents corresponding to inspection items in the above-mentioned KISA table.

There are regulations to remove ‘Adminstrator’, the account name preferred by most IT workers, from a security perspective. These somewhat abstract regulatory contents are coded as Rule (Account.change) in the mapping table.

As shown in Figure 19, the rule compares various regulations and corresponds 1:1 to the representative reference value (C of C).

This kind of reference modeling can provide clear standards for ambiguous laws and regulations, and by expanding the set of regulations composed of regulations and standards, the concept of security compliance can be technically implemented through 1:1 mapping between laws and regulations. am.

As such, the apparatus and method for automating security regulation compliance according to an embodiment of the present invention can compare two security regulations to search for a representative reference point and determine whether the device to be protected satisfies the security regulation based on the searched representative reference point.

In addition, the device and method for automating security regulation compliance according to an embodiment of the present invention provides clear standards and representative reference points for ambiguous laws and regulations through reference modeling, and provides a regulation set consisting of security regulations (Standard) and criteria (Criteria). By extension, it makes it possible to technically implement the concept of security compliance through one-to-one mapping between laws and regulations.

Implementations described herein may be implemented, for example, as a method or process, device, software program, data stream, or signal. Although discussed only in the context of a single form of implementation (eg, only as a method), implementations of the features discussed may also be implemented in other forms (eg, devices or programs). The device may be implemented with appropriate hardware, software, firmware, etc. The method may be implemented in a device such as a processor, which generally refers to a processing device that includes a computer, microprocessor, integrated circuit, or programmable logic device. Processors also include communication devices such as computers, cell phones, portable/personal digital assistants (“PDAs”) and other devices that facilitate communication of information between end-users.

The present invention has been described with reference to the embodiments shown in the drawings, but these are merely illustrative, and those skilled in the art will recognize that various modifications and other equivalent embodiments can be made therefrom. You will understand. Therefore, the true technical protection scope of the present invention should be determined by the scope of the patent claims below.

10: regulatory input unit 20: regulatory mapping unit
21: Regulation comparison unit 22: Mapping table unit
30: Reference modeling unit 31: Reference information modeling unit
32: Scheduler 40: Workflow engine unit
41: Asset identification and risk assessment department
42: Security management data linkage unit 43: Monitoring unit
44: status tracking unit 45: output unit

Claims (1)

a regulation input unit that receives a plurality of regulations and reference values for the regulations;
a regulation mapping table unit that generates a mapping table by comparing the regulations input from the regulation input unit;
a reference modeling unit that detects a representative reference point of the regulation by reference modeling the regulations grouped by the regulation mapping table unit; and
It includes a workflow engine unit that determines whether the protection target equipment satisfies regulations based on the representative reference point detected by the reference modeling,
The workflow engine unit includes an asset management and risk assessment unit that identifies the assets of the equipment to be protected and, when the assets of the equipment to be protected are identified, detects a risk index that evaluates the risk of the equipment to be protected; A security management data linkage unit that receives data on security target equipment through a security system input unit; A monitoring unit that connects with the security management data linkage unit to inspect and take action on vulnerabilities in data input from the security management data linkage unit based on a standard value that has undergone a risk assessment and outputs status rating information; And a status tracking unit that tracks the security management status of the protected equipment according to regulations using the status rating information output from the monitoring unit,
The asset management and risk assessment department calculates the risk by multiplying the importance, vulnerability, and threat of the equipment to be protected and detects the risk index.
The monitoring unit detects security data from the inspection command received from the security management data linkage unit, matches the security data with the representative reference point, and feeds inspection measures to the security management data linkage unit if the security data and the representative reference point are different. A security compliance automation device characterized in that.