KR102671361B1 - Integrated Information Security Evaluation System - Google Patents

Abstract

The present invention relates to an integrated information security evaluation system, which includes an information security evaluation and management system that prepares supporting materials for evaluating the information security management status and manages the information security status; An information security evaluation system that is linked online with the information security evaluation management system and evaluates the information security management status in advance; And a constant security management system that is automatically linked to the information security evaluation management system and automatically checks server vulnerabilities.

Description

Integrated Information Security Evaluation System

The present invention relates to an integrated information security evaluation system, and more specifically, to an integrated information security evaluation system in which the evaluation agency can pre-evaluate the information security management status of the inspection agency online.

As the number of cyber security damage cases in domestic public institutions is increasing, regular information security management status assessments are being conducted to strengthen information security management and response capabilities.

However, since the evaluation agency evaluates this information security management status by visiting the inspection agency site once a year on one day, regular security level management is insufficient, and the problem is that the security level is raised only on the day of the inspection to improve the evaluation results. There is.

Korean Patent Publication No. 10-2018-0069971 (2018.06.26.)

The purpose of the present invention to solve the above problems is to provide an integrated information security evaluation system that can improve work efficiency by pre-evaluating the information security management status registered by the inspection agency for self-evaluation online by the evaluation agency.

The integrated information security evaluation system of the present invention to achieve the above objectives includes an information security evaluation and management system that prepares supporting materials for evaluating the information security management status and manages the information security status; An information security evaluation system that is linked online with the information security evaluation management system and evaluates the information security management status in advance; And a constant security management system that is automatically linked to the information security evaluation management system and automatically checks server and PC vulnerabilities.

The information security evaluation management system includes a dashboard unit that outputs self-score summary, inspection score summary, and final evaluation score calculation, an evaluation item register that classifies and registers inspection items and inquiry items, and a registered security evaluation item and detailed inquiry. It is characterized by comprising an evidence and evaluation management department that attaches supporting materials and evaluates and manages items, and an evaluation score management department that manages evaluation scores for the registered security evaluation items and detailed query items.

The dashboard section outputs scores for each self-inspection and on-site inspection in the areas of managerial security, technical security, and crisis response capabilities. It divides evaluation preparation status into waiting, progress, and completion and outputs the evaluation preparation status for the current year. It is characterized by outputting yearly evaluation results for each year.

The information security evaluation system consists of an evaluation information management department that manages and measures performance by management status evaluation item, analyzes various statistical data by inspection agency, and manages annual evaluation schedule and schedule, and an evaluation organization that sets and manages the organization of each evaluation agency and work standards. and management department, and the evaluation preparation management department that performs information security-related work promotion registration and download, evaluation section, evaluation items, evaluation criteria, evaluation score distribution, and provision of evaluation criteria guidelines, automatic and manual registration by evaluation item, and evaluation item search. and detailed inquiry, registration of evaluation scores by evaluation criteria, submission and preview of evaluation results, evaluation performance and verification department that performs evaluation for the evaluation manager and evaluation manager, evaluation status query by indicator, comprehensive query of evaluation results by indicator, evaluation manager Detailed inquiry of evaluation results by star and evaluation item, evaluation result management department that uploads and downloads evaluation result information, information security status of the institution, detailed inquiry and download of evaluation results, inquiry of overall statistics status by evaluation organization and item, performance period and It is characterized by including an evaluation result utilization section that performs evaluation status statistics for each organization.

The continuous security management system has a dashboard section that outputs asset summary, inspection group summary, server/PC automatic inspection results, and inspection tool inspection results, and allows you to register and delete assets to be inspected, group assets, and schedule inspections. Inspection target section, inspection management section where inspection items and vulnerability action methods can be registered, inspection results section where inspection results can be viewed by classifying them by asset (IP) and inquiry item, and inspection results using inspection tools It is characterized by including an inspection tool section that can be viewed by registering.

According to the present invention, the information security management status of the inspection agency self-assessed and registered can be pre-evaluated online by the evaluation agency, thereby improving the inspection agency's information security level and evaluation work efficiency.

Figure 1 is a configuration diagram showing an integrated information security evaluation system according to the present invention.
Figure 2 is a screen showing the dashboard portion of the information security evaluation management system according to the present invention.
Figure 3 is a screen showing the evaluation item register of the information security evaluation management system according to the present invention.
Figure 4 is a screen showing the evidence and evaluation management unit of the information security evaluation management system according to the present invention.
Figure 5 is a screen showing the evaluation score management unit of the information security evaluation management system according to the invention.
Figure 6 is a screen showing the dashboard portion of the continuous security management system according to the present invention.
Figure 7 is a screen showing the inspection target part of the constant security management system according to the present invention.
Figure 8 is a screen showing the inspection management unit of the continuous security management system according to the present invention.
Figure 9 is a screen showing the inspection results of the continuous security management system according to the invention.
Figure 10 is a screen showing the inspection tool portion of the constant security management system according to the invention.

Below, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein.

Next, a preferred embodiment of the integrated information security evaluation system according to the present invention will be described in detail.

Figure 1 is a configuration diagram showing an integrated information security evaluation system according to the present invention, Figure 2 is a screen showing the dashboard portion of the information security evaluation and management system according to the present invention, and Figure 3 is an information security evaluation and management system according to the present invention. is a screen showing the evaluation item register, Figure 4 is a screen showing the evidence and evaluation management part of the information security evaluation management system according to the present invention, and Figure 5 is a screen showing the evaluation score management part of the information security evaluation management system according to the invention. , Figure 6 is a screen showing the dashboard part of the continuous security management system according to the present invention, Figure 7 is a screen showing the inspection target part of the continuous security management system according to the present invention, and Figure 8 is a screen showing the continuous security management system according to the present invention. It is a screen showing the inspection management part of, Figure 9 is a screen showing the inspection result part of the regular security management system according to the invention, and Figure 10 is a screen showing the inspection tool part of the regular security management system according to the invention.

Referring to Figure 1, the Integrated Information Security Evaluation System (IISES) according to the present invention includes an information security evaluation system (100) of an evaluation agency (National Intelligence Service) and an information security evaluation and management system (200) of a prison agency. and a permanent security management system 300 of the incarcerated institution.

The Information Security Evaluation System (ISES) 100 is linked online with the Information Security Evaluation Management System 200 to evaluate the information security management status in advance and manage the status of evaluation results by institution and year. there is.

This information security evaluation system 100 includes an evaluation information management department 110, an evaluation organization organization and management department 120, an evaluation preparation management department 130, an evaluation performance and verification department 140, an evaluation result management department 150, and an evaluation result management department 150. It may include menus such as the utilization section 160.

The evaluation information management unit 110 can manage management and achievement measurement for each management status evaluation item, analysis of various statistical data for each inspection institution, and annual evaluation schedule and schedule management.

The evaluation organization organization and management department 120 can establish and manage the organization and work standards for each evaluation agency.

The evaluation preparation management unit 130 can perform information security-related work promotion registration and downloading, evaluation section, evaluation items, evaluation criteria, evaluation score allocation confirmation, and provision of evaluation standard guidelines.

The evaluation performance and verification unit 140 performs automatic and manual registration for each evaluation item, search and detailed inquiry of evaluation items, registration of evaluation scores by evaluation criteria, submission and preview of evaluation results, and evaluation of the evaluation manager and person in charge of evaluation. You can.

The evaluation result management unit 150 can perform evaluation status inquiries by indicators, comprehensive evaluation results by indicators, detailed evaluation results by evaluation person and evaluation item, upload and download of evaluation result information, etc.

The evaluation result utilization unit 160 can check the information security status of the organization, check and download detailed evaluation results, check statistical status of scores by evaluation organization and item, and check statistical status of evaluation status by performance period and organization.

The Information Security Evaluation Management System (ISEMS) 200 can prepare supporting materials for information security management status evaluation (administrative security, technical security, crisis response capabilities) and manage the information security status. . In other words, in response to the information security status assessment, the level of information security can be improved by registering evaluation items by evaluation item and query, and managing supporting materials and evaluation scores.

This information security evaluation management system 200 has menus such as a dashboard section 210, an evaluation item register 220, an evidence and evaluation management section 230, an evaluation score management section 240, and an evidence provision section 250. It can be included.

The dashboard unit 210 can output self-score summary, inspection score summary, final evaluation score calculation, etc.

As an embodiment, referring to FIG. 2, the dashboard unit 210 shows ① the self-score summary showing self-assessment scores for managerial, technical, and crisis response capabilities, and ② the due diligence score summary showing managerial, technical, and crisis response capabilities. It shows the due diligence evaluation score for the competency part, and ③ The final evaluation score is calculated based on the due diligence score, self-assessment poorness score (a value calculated and automatically entered by the system), and additional information security activity score (a value entered by the evaluator after the due diligence evaluation). ), if you are an institution participating in response training, enter the training score confirmed by the evaluator (1 point to 5 points), and if you are an infrastructure management institution, enter the training score confirmed by the evaluator (1 point to 20 points) can do.

In addition, the dashboard unit 210 outputs scores for each self-inspection and on-site inspection in the areas of ④ managerial security, technical security, and crisis response capabilities in a circular graph, ⑤ waits for evaluation preparation status for the current year, It is divided into progress and completion and output as a bar graph. ⑥ Annual evaluation results for the last three years are output as a bar graph.

Meanwhile, if the progress status is saved in the evidence and evaluation management unit 230 menu, which will be described later, and the self-score/inspection score is registered in the evaluation score management unit 240 menu, it can be immediately reflected in the dashboard unit 210.

The evaluation item register 220 classifies and registers inspection items and inquiry items. At this time, supporting materials may be attached and evaluated for the registered items.

As an embodiment, referring to FIG. 3, the evaluation item register 220 registers/deletes the inspection item to be managed by ① registering/deleting the inspection item, and ② registering/deleting the inquiry item registers the inquiry item corresponding to the inspection item. /Delete, ③ View inquiry item shows the details of the inquiry item, ④ Open inquiry item edit/comparison edits the inquiry item, and ⑤ Compare previous year's item shows it in comparison with the previous year's item.

The evidence and evaluation management unit 230 can attach supporting materials to registered security evaluation items and detailed query items and manage the evaluation.

As an embodiment, referring to FIG. 4, the evidence and evaluation management unit 230 performs ① downloading of supporting data to download stored supporting data, and ② saving progress status to storing the progress status (waiting/progress/complete) for each query item. , ③ View commentary shows explanations for each question item, and ④ Open registration/details registers explanations/evaluation opinions for each supporting document/question. ⑤ View previous year’s data shows the previous year’s data.

The evaluation score management unit 240 can manage evaluation scores for registered security evaluation items and detailed query items.

As an embodiment, referring to FIG. 5, the evaluation score management unit 240 shows ① self-score summary/inspection score summary in summary of the self-score and inspection score, and ② inspection item is the score of the inquiry item belonging to the inspection item. It shows the total, ③ query item shows the score for each query item, and ④ open score details shows the details for each query item and checks the score.

The supporting data providing unit 250 can download supporting data by year.

Meanwhile, the information security evaluation management system 200 is automatically linked to the regular security management system (Korea Security Content Automation Protocol; KSCAP) 300 to automatically check system (server, PC) vulnerabilities specialized for evaluating information security management status. You can. Here, the regular security management system 300 may include menus such as a dashboard section 310, an inspection target section 320, an inspection management section 330, an inspection result section 340, and an inspection tool section 350. there is.

The dashboard unit 310 can output asset summary, inspection group summary, inspection results, etc.

As an embodiment, referring to FIG. 6, the dashboard unit 310 classifies ① asset summary into server (UNIX·WINDOWS), PC, network separation inspection, and service inspection and displays inspection results for each asset, and ② inspection group The summary groups assets and shows the maintenance schedule status, ③ the inspection result shows the inspection results of the most recent month in a graph, and ④ the inspection tool shows the inspection results using the inspection tool in a graph.

The inspection target unit 320 can register assets through asset management and group/reservation management, and manage the registered assets by grouping them.

As an embodiment, referring to FIG. 7, the inspection target unit 320 ① shows a list of assets that can be registered and deleted, ② shows a list of assets inspected using an inspection tool, and ③ displays the registered assets. It shows a list of group/reservation management where you can group and register inspection reservations. ④ If you select the group/reservation management above, it shows a list of assets included in the selected group.

The inspection management unit 330 can register, modify, and delete inspection items and vulnerability action methods and displays the registered list.

As an embodiment, referring to FIG. 8, the inspection management unit 330 can ① register inspection items and display a registered list, and ② can register, modify, and delete vulnerability action methods and display the entire list.

The inspection result section 340 can view the inspection results of registered assets by asset (IP) and inquiry item.

As an embodiment, referring to FIG. 9, the inspection result unit 340 ① summarizes the inspection results for each registered inspection group, ② shows the inspection results for each asset list included in the registered group, and ③ summarizes the inspection group. It shows it in a graph, and shows the inspection results for each query item ④⑤.

The inspection tool unit 350 can register and delete inspection results using the inspection tool and displays the results.

As an embodiment, referring to FIG. 10, the inspection tool unit 350 ① summarizes the inspection results for each registered asset, ② shows the inspection results for each asset, ③ summarizes each inspection asset and displays it in a graph, ④⑤ Displays inspection results for each inquiry item.

What has been described above is only an example for explaining the integrated information security evaluation system according to the present invention, and the present invention is not limited to the above-described embodiment, and the scope of the following patent claims goes beyond the gist of the claimed invention. Anyone with ordinary knowledge in the field to which the relevant invention pertains will say that the technical spirit of the present invention exists to the extent that various modifications can be made.

100: Information security evaluation system 110: Evaluation information management department
120: Evaluation organization and management department 130: Evaluation preparation management department
140: Evaluation performance and verification department 150: Evaluation result management department
160: Evaluation result utilization department 200: Information security evaluation management system
210: User authentication and authority management unit 210: Dashboard unit
220: Evaluation item register 230: Evidence and evaluation management department
240: Evaluation score management department 250: Evidence provision department
300: Permanent security management system 310: Dashboard unit
320: Inspection target department 330: Inspection management department
340: Inspection result section 350: Inspection tool section

Claims (5)

An information security evaluation and management system that prepares supporting materials for evaluating information security management status and manages information security status;
An information security evaluation system that is linked online with the information security evaluation management system to evaluate the information security management status in advance and manage the status of evaluation results by organization and year; and
Including a constant security management system that is automatically linked to the information security evaluation management system and automatically checks server and PC vulnerabilities,
The information security evaluation system is,
An evaluation information management department that performs management and performance measurement for each management status evaluation item, analysis of various statistical data by inspection agency, and annual evaluation schedule and schedule management;
An evaluation organization composition and management department that sets and manages the organization and work standards for each evaluation agency,
An evaluation preparation management department that performs registration and download of information security-related work, evaluation section, evaluation items, evaluation criteria, evaluation score distribution, and provision of evaluation standard guidelines;
An evaluation performance and verification department that performs automatic and manual registration for each evaluation item, search and detailed inquiry of evaluation items, registration of evaluation scores by evaluation criteria, submission and preview of evaluation results, and evaluation of evaluation personnel and evaluation managers;
Evaluation result management department that performs evaluation status inquiry by indicator, comprehensive evaluation result by indicator, detailed evaluation result by evaluation person and evaluation item, upload and download of evaluation result information, and
It includes an evaluation results utilization department that performs information security status of the institution, detailed inquiry and download of evaluation results, inquiry of overall statistical status by evaluation organization and item, and evaluation status statistics by performance period and organization.
The information security evaluation management system is,
A dashboard unit that outputs self-score summary, actual score summary, and final evaluation score calculation,
An evaluation item register that classifies and registers inspection items and inquiry items,
An evidence and evaluation management department that attaches supporting materials and evaluates and manages registered security evaluation items and detailed inquiry items, and
It includes an evaluation score management unit that manages evaluation scores for the registered security evaluation items and detailed query items,
The self-score summary in the dashboard section shows the self-assessment scores for the managerial, technical, and crisis response capabilities sections, the due diligence score summary shows the due diligence evaluation scores for the managerial, technical, and crisis response capabilities sections, and the final evaluation. The score calculation is the due diligence score, poor self-assessment score, and additional information security activity score. If the organization participates in response training, enter the training score confirmed by the evaluator (1 to 5 points), and if it is an infrastructure management organization, enter the training score. An integrated information security evaluation system characterized by entering the score confirmed by the evaluator (1 to 20 points). delete According to paragraph 1,
The dashboard section outputs scores for each self-inspection and on-site inspection in the areas of managerial security, technical security, and crisis response capabilities, and divides the evaluation preparation status into waiting, progress, and completion to output the evaluation preparation status for the current year. An integrated information security evaluation system characterized by outputting annual evaluation results for each year. delete According to paragraph 1,
The permanent security management system is,
A dashboard unit that outputs asset summary, inspection group summary, server and PC automatic inspection results, and inspection tool inspection results,
An inspection target section where you can register and delete assets to be inspected, group assets, and schedule inspections,
An inspection management department that can register inspection items and vulnerability action methods, and
An integrated information security evaluation system that includes an inspection result section where inspection results can be viewed by classifying them by asset (IP) and inquiry item, and an inspection tool section where inspection results can be registered and viewed using an inspection tool.