KR102671357B1 - Information Security Evaluation Management System - Google Patents

Abstract

The present invention relates to an information security evaluation and management system, comprising: a user authentication and authority management unit that authenticates users and manages user rights; A dashboard unit that includes outputting self-score summary, actual score summary, and final evaluation score calculation; An evaluation item register that classifies and registers inspection items and inquiry items; Evidence and evaluation management department, which attaches supporting materials for registered security evaluation items and detailed inquiry items and manages the evaluation; and an evaluation score management unit that manages evaluation scores for registered security evaluation items and detailed query items.

Description

Information Security Evaluation Management System

The present invention relates to an information security evaluation and management system, and more specifically, to an information security evaluation and management system that systematically prepares supporting materials for information security management status evaluation and manages the information security status.

The information security evaluation and management system is a system that provides a comprehensive approach to evaluate and manage an organization's information security. The system integrates tools and processes to improve information security by considering various security aspects related to the infrastructure, data, software, hardware, network and human resources of information assets.

Recently, as the number of cyber security damage cases in domestic public institutions is increasing, domestic public institutions are conducting regular information security management status assessments to strengthen their management and response capabilities to information security.

As the need for information security management status assessment gradually increases, it is necessary to actively respond to information security management status assessment and manage managerial, technical, and crisis response capabilities systematically and efficiently.

Korean Patent Publication No. 10-2018-0069971 (2018.06.26.)

The purpose of the present invention to solve the above problems is to provide an information security evaluation and management system that systematically prepares supporting materials for information security management status evaluation (in the field of managerial, technical, and crisis response capabilities) and manages the information security status. is to provide.

The information security evaluation and management system of the present invention for achieving the above purpose includes a user authentication and authority management unit that authenticates users and manages user rights; A dashboard unit that includes outputting self-score summary, actual score summary, and final evaluation score calculation; An evaluation item register that classifies and registers inspection items and inquiry items; Evidence and evaluation management department, which attaches supporting materials for registered security evaluation items and detailed inquiry items and manages the evaluation; and an evaluation score management unit that manages evaluation scores for registered security evaluation items and detailed query items.

The self-score summary and due diligence score summary show the self-assessment and due diligence evaluation scores for managerial, technical, and crisis response capabilities, and the final evaluation score calculation is based on the due diligence score and self-assessment poorness score (calculated and automatically entered in the system). value) and the additional information security activity score (value entered by the evaluator after the due diligence evaluation). If the organization participates in response training, enter the training score confirmed by the evaluator (1 to 5 points), and the infrastructure management agency In this case, the training score is characterized by entering the value confirmed by the evaluator (1 to 20 points).

The dashboard section outputs scores for each self-inspection and on-site inspection in the areas of managerial security, technical security, and crisis response capabilities, and divides evaluation preparation status into waiting, progress, and completion to output the evaluation preparation status for the current year, and displays the evaluation preparation status for the current year. It is characterized by outputting yearly evaluation results for each year.

The evaluation item register is characterized by attaching supporting materials and evaluating registered items.

The evaluation item register registers/deletes inspection items to be managed, registers/deletes inquiry items corresponding to the inspection items, modifies inquiry items, shows detailed information on inquiry items, and compares them with the previous year's items. Do this.

The above evidence and evaluation management department downloads the saved evidence and saves the progress status (waiting/in progress/complete) for each inquiry item, displays the explanation for each inquiry item and previous year's data, and registers the evidence, explanation for each inquiry, and evaluation opinion. It is characterized by:

The evaluation score management unit displays a summary of the self-score and due diligence score, the total score of the inquiry items belonging to the inspection item, and the score for each inquiry item, and shows detailed information for each inquiry item and checks the score.

According to the present invention, it is possible to help improve the level of information security by registering evaluation items by evaluation item and query in response to information security status evaluation, and managing supporting materials and evaluation scores.

1 is a configuration diagram of an information security evaluation management system according to the present invention.
Figure 2 is a screen configuration diagram of the dashboard unit according to the present invention.
Figure 3 is a screen configuration diagram of the evaluation item register according to the present invention.
Figure 4 is a screen configuration diagram of the evidence and evaluation management unit according to the present invention.
Figure 5 is a screen configuration diagram of the evaluation score management unit according to the invention.

Below, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein.

Next, a preferred embodiment of the information security evaluation and management system according to the present invention will be described in detail.

Figure 1 is a configuration diagram of an information security evaluation management system according to the present invention, Figure 2 is a screen configuration diagram of the dashboard unit according to the present invention, Figure 3 is a screen configuration diagram of an evaluation item register according to the present invention, and Figure 4 is a screen configuration diagram of the evidence and evaluation management unit according to the present invention, and Figure 5 is a screen configuration diagram of the evaluation score management unit according to the invention.

Referring to FIG. 1, the Information Security Evaluation Management System (ISEMS) according to the present invention may include a server 100 for providing information security evaluation management services. The server 100 can provide various functions of the information security evaluation and management system required through the administrator terminal 200, and can store and manage data generated in the information security evaluation and management system. Additionally, personalized UI/UX can be provided for each administrator. In addition, the server 100 can support large amounts of data processing and parallel work through a scalable architecture and performance optimization to enable simultaneous work through a plurality of administrator terminals 200, and can support major data processing and parallel work to prevent data loss. It can also support backup and recovery. Additionally, the server 100 can exchange data with a plurality of manager terminals 200 through a network.

Here, the server 100 provides menus such as the user authentication and authority management unit 110, the dashboard unit 120, the evaluation item registration unit 130, the evidence and evaluation management unit 140, and the evaluation score management unit 150. It can be included.

The user authentication and permission management unit 110 authenticates users and manages user permissions.

The dashboard unit 110 outputs self-score summary, inspection score summary, final evaluation score calculation, etc.

Referring to Figure 2, the dashboard unit 110 displays ① self-score summary showing self-assessment scores in the managerial, technical, and crisis response capabilities sections, and ② due diligence score summary in the managerial, technical, and crisis response capabilities sections. ③ The final evaluation score calculation is the due diligence score, self-assessment poorness score (a value calculated and automatically entered by the system), and additional information security activity score (a value entered by the evaluator after the due diligence evaluation). If you are an organization participating in response training, you can input the training score as confirmed by the evaluator (1 to 5 points). If you are an infrastructure management agency, you can enter the training score as confirmed by the evaluator (1 to 20 points). .

In addition, the dashboard unit 110 outputs scores for each self-inspection and on-site inspection in the areas of ④ managerial security, technical security, and crisis response capabilities in a circular graph, ⑤ waits for evaluation preparation status for the current year, It is divided into progress and completion and output as a bar graph. ⑥ Annual evaluation results for the last three years are output as a bar graph.

Meanwhile, if the progress status is saved in the evidence and evaluation management unit 140 menu, which will be described later, and the self-score/inspection score is registered in the evaluation score management unit 400 menu, it can be immediately reflected in the dashboard unit 120.

The evaluation item register 130 classifies and registers inspection items and inquiry items. At this time, supporting materials are attached and evaluated for the registered items.

Referring to FIG. 3, the evaluation item register 130 registers/deletes the inspection item to be managed by ① registering/deleting the inspection item, and ② registering/deleting the inquiry item registers/deletes the inquiry item corresponding to the inspection item. , ③ View inquiry item shows the details of the inquiry item, ④ Open inquiry item edit/comparison edits the inquiry item, and ⑤ Compare previous year's item shows it in comparison with the previous year's item.

The evidence and evaluation management unit 140 attaches supporting materials to registered security evaluation items and detailed query items and manages the evaluation.

Referring to FIG. 4, the evidence and evaluation management unit 140 ① downloads the stored evidence to download the evidence, ② saves the progress status to store the progress status (waiting/progress/complete) for each query item, and ③ downloads the commentary. View shows the commentary for each question item, and ④ Register/Open details registers supporting materials/explanations/evaluation opinions for each inquiry. ⑤ View previous year’s data shows the previous year’s data.

The evaluation score management unit 150 manages evaluation scores for registered security evaluation items and detailed query items.

Referring to FIG. 5, the evaluation score management unit 150 displays ① self-score summary/inspection score summary in summary of self-score and inspection score, and ② inspection item shows the total score of inquiry items belonging to the inspection item. ③ Query item shows the score for each query item, and ④ Open score details shows the details for each query item and checks the score.

The information security evaluation and management system of the present invention is software installed on a web server (Tomcat), and the user accesses and uses it through a web browser. In response to the evaluation of information security management status, the user enters evaluation items by evaluation item and query, Evidence and evaluation scores can be registered and visualized through the dashboard.

According to the present invention, the continuity and efficiency of preparation and information security management status evaluation work can be increased through regular inspection system support and implementation inspection, and the progress of the information security management evaluation work can be viewed as a whole. In addition, it is possible to identify the progress of each manager's work and prepare for evaluation without omission, and to improve the work efficiency of security personnel through management of the implementation status. In addition, it can be used for evaluation by establishing a security level and progress monitoring system through the DashBoard and efficiently performing excessively repetitive security operation tasks.

What has been described above is only an example for explaining the information security evaluation and management system according to the present invention, and the present invention is not limited to the above-described embodiment, and the scope of the following patent claims goes beyond the gist of the claimed invention. Anyone with ordinary knowledge in the field to which the relevant invention pertains will say that the technical spirit of the present invention exists to the extent that various modifications can be made.

100: Server 110: User authentication and authority management department
120: Dashboard section 130: Evaluation item register
140: Evidence and evaluation management department 150: Evaluation score management department
200: user terminal

Claims (7)

a user authentication and authority management department that authenticates users and manages user permissions;
A dashboard section that outputs self-score summary, actual score summary, and final evaluation score calculation;
An evaluation item register that classifies and registers inspection items and inquiry items;
Evidence and evaluation management department, which attaches supporting materials for registered security evaluation items and detailed inquiry items and manages the evaluation; and
Including an evaluation score management unit that manages evaluation scores for the registered security evaluation items and detailed query items,
The self-score summary of the dashboard section shows the self-assessment scores in the areas of managerial security, technical security, and crisis response capabilities, and the due diligence score summary shows the due diligence evaluation scores in the areas of managerial, technical, and crisis response capabilities. The final evaluation score is calculated as the due diligence score, self-assessment poorness score (a value calculated and automatically entered by the system), and additional information security activity score (a value entered by the evaluator after the due diligence evaluation). If an organization participates in response training, the training score is calculated. Enter the value confirmed by the evaluator (1 point to 5 points) and, if you are an infrastructure management agency, enter the value confirmed by the evaluator for the training score (1 point to 20 points).
The dashboard section outputs scores for each self-inspection and on-site inspection in the areas of managerial security, technical security, and crisis response capabilities in a circular graph, and the evaluation preparation status for the year is divided into waiting, progress, and completion, and is displayed in a bar graph. The yearly evaluation results are output as bar graphs for the last three years.
The evaluation item register registers and deletes the inspection items to be managed, registers and deletes inquiry items corresponding to the inspection items, shows detailed information on the inquiry items, modifies the inquiry items, and compares them with the previous year's items. Give,
The above evidence and evaluation management department downloads the saved evidential materials, stores the progress status (waiting/in progress/complete) for each inquiry item, displays explanations for each inquiry item and previous year's data, and provides supporting materials, explanations for each inquiry, and evaluation opinions. An information security evaluation management system characterized by registration. delete delete delete delete delete According to paragraph 1,
The evaluation score management unit shows a summary of the self-score and due diligence score, the total score of the inquiry items belonging to the inspection item, and the score for each inquiry item, and shows detailed information for each inquiry item and checks the score. Security evaluation management system.