KR20040051744A - System for evaluating risk value of network property and method thereof - Google Patents

Abstract

PURPOSE: A system for calculating a risk level of network assessment and a method therefor are provided to reduce the cost necessary for risk evaluation by introducing a concept of references and differentially applying risk evaluation. CONSTITUTION: A risk level setup device(130) evaluates risk of network assessment firstly and secondly, and calculates first and second risk levels, and a total risk level, and detail levels. A reference setup device(120) calculates first and second references which is references when dividing the first and second risk levels. A security information storage(110) stores the calculated first and second risk levels, and a total risk level, and detail levels, stores the first and second references, stores basic investigation contents necessary for risk evaluation and intermediate data produced in risk evaluation, and stores information of network assessment.

Description

System for evaluating risk value of network property and method

The present invention relates to a system and method for calculating a risk rating of a network asset. The present invention relates to a risk rating calculation system for a network asset that performs a risk evaluation by differentially evaluating a risk assessment level of a network asset and reflects the previous risk evaluation result in a next evaluation. And to a method thereof.

The standardization of risk assessment technology for network assets is still underway, and the representative standardization agency is the Risk Assessment (RA) part of the International Organization for Standardization (ISO), but it does not standardize the risk assessment technology itself, but rather between risk assessment and security management. It is to establish the concept of.

Moreover, due to the nature of the risk assessment, basic environmental analysis is used to classify the target facility assets, apply appropriate risk analysis to each asset, process the risk analysis results to calculate the risk rating, and calculate the risk rating of the calculated assets. How to evaluate and calculate the security level of the entire network is not a formal situation.

Therefore, an in-depth study of this area is required, and verification through actual application is also required.

It is an object of the present invention to calculate a risk rating by differentiating the risk assessment level of a network asset.

Another object of the present invention is to calculate a risk level by setting a reference value at each risk assessment level of a network asset.

1 is a block diagram of a system for calculating a risk rating of a network asset according to the present invention.

FIG. 2 is a flowchart of a process of calculating a primary reference value of risk assessment in the data processor of FIG. 1.

3 is a flowchart of a process of calculating a second reference value of risk assessment in the data processor of FIG. 1;

4 is an operational flow of risk assessment in accordance with the present invention.

To this end, the risk rating calculation system of network assets according to the present invention evaluates the risk assessment of the network assets by dividing them into primary and secondary risks, and according to the primary and secondary assessments, the primary and secondary risk classes and overall risks. A risk class setting device for calculating a class and a detailed class respectively; A reference value setting device that calculates primary and secondary reference values, which serve as a reference for dividing the primary and secondary risk classes, respectively, in the primary and secondary risk evaluations; And primary and secondary risk levels and overall risk and detail ratings calculated during each risk assessment, primary and secondary baseline values, basic investigations required for risk assessment, and intermediate data generated during risk assessment. And a security information storage device for storing the information of the network asset.

In addition, the risk rating calculation method of the network asset according to the present invention may include a first step of calculating a detailed rating by referring to basic survey contents of a network asset that has been previously investigated; A second step of calculating first and second risk values using the calculated detailed grades; A third step of calculating a primary risk level using the calculated primary risk value; Comparing the calculated primary risk rating to the primary threshold, the criteria for screening the subjects of risk assessment, and if the primary risk rating is greater than the primary threshold, a fourth risk rating is calculated using the secondary risk value. process; Calculating a total risk level of the network asset; And a sixth process of comparing the calculated overall risk level with a second reference value that is a criterion for determining the security investment, and determining that the asset requires security processing if the overall risk level is greater than the second reference value. do.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In the risk rating calculation system of network assets according to the present invention, in order to perform a continuous risk assessment, a list of each asset is made, a risk analysis is performed, and the overall risk state is quantified by evaluating the risks. Determine the content.

To this end, the risk rating calculation system for network assets according to the present invention, as shown in Figure 1, comprises a security information database 110, a reference value setting device 120, and a risk rating setting device 130, The cycle evaluates the risk of network assets and calculates a rating.

The security information database 110 stores information necessary for calculating a risk level of such network assets. For this purpose, the risk information history database 112 and the current performance of the risk assessment history are stored to store basic network asset information and a risk assessment result performed every time. A risk diagnosis database 114 for storing the basic investigation contents necessary for the risk assessment to be performed and intermediate data and results of the current risk assessment, and a reference value management database 116 for storing the reference values necessary for calculating the risk level.

The basic network asset information stored in the risk assessment history database 112 is history information of the asset, together with the classification (human / physical) information about the asset and their detailed information (in the case of the physical asset, the introduction year and introduction cost). Information about which assets can be valued, including depreciation rates, etc.).

The result of each risk assessment is to reflect the previous risk assessment result in the next assessment for the continuity of the risk assessment. For example, the total risk rating, the first and second risk ratings for each asset, This includes detailed ratings such as revenue contribution, other asset correlation, risk implication, asset rating, vulnerability rating, and threat rating.

The risk diagnosis database 114 stores detailed data surveys and survey results for the purpose of calculating risk ratings for risk assessments to be performed in the future.

Therefore, the risk diagnosis database 114 is updated every time a risk assessment is performed, which includes basic survey contents for calculating profit contribution, other asset correlation, risk implication, asset rating, vulnerability rating, and threat rating. Is stored.

For this reason, the selection of detailed investigation items for risk assessment can be applied flexibly, depending on the organization's policies.

For example, in the case of revenue contribution and other asset-related diagrams, the survey may be conducted by the operator and the manager (grade check), and in the case of the risk implication, the operator and the manager's survey (the grade check) and past risks are generated Frequency surveys can be conducted and all of these surveys are performed on a per asset basis.

In addition, the risk diagnosis database 114 stores various intermediate data calculated while performing risk assessment using the detailed data survey and questionnaire results and the result value of the risk assessment.

The basic network asset information stored in the risk assessment history database 112 should be able to delete and add contents according to the disposal and purchase of the asset, and the result of the risk assessment performed every time is the organization's security policy. According to the principle of storing up to recent years, the risk diagnosis database 114 stores the information used to calculate the risk level of the risk assessment to be performed at present, as described above. Do.

The baseline management database 116 stores the primary and secondary baseline values calculated during n-1 risk assessments, and these n-1 primary and secondary baselines are used to calculate n primary and secondary baseline values. do.

Therefore, the reference value management database 116 stores the first and second reference values calculated each time and is used for calculating the next first and second reference values, and is updated when the first and second reference values are calculated each time.

In addition, the present invention performs risk assessment of assets by dividing the risk assessment level into two stages of primary risk assessment and secondary risk assessment, and filters assets that do not require secondary risk assessment through primary risk assessment. .

In other words, assets that are separated through the primary risk assessment and do not perform the secondary risk assessment are considered to be low-risk assets that do not require risk control, that is, security investment.

Therefore, a reference value for dividing the risk level of the asset through the first and second risk assessment is required, and this reference value is set in the reference value setting device 120.

The primary baseline for the primary risk assessment is the baseline for screening the subjects of the risk assessment, and the secondary baseline for the secondary risk assessment is the baseline for determining security investments based on the results of the risk assessment.

Both primary and secondary baseline values are calculated by processing the results of risk assessments that have been previously performed, and this method has the advantage that the risk assessment continuously reflects the change management results of the target network.

The reference value setting device 120 includes a data input unit 122, a data processing unit 124, and a data output unit 126.

The data input unit 122 obtains the first and second risk ratings and the overall risk rating information of the risk evaluation results performed n-1 times from the risk assessment history database 112 to calculate the first and second reference values. From the baseline management database, the secondary baseline information is retrieved.

Then, using the imported n-1 times primary and secondary risk ratings and overall risk rating information, the proportion of assets with primary risk rating <secondary risk rating, primary risk rating> secondary risk rating, overall Calculate values such as Risk Rate <Secondary Baseline Asset Ratio, and Overall Risk Class> Secondary Baseline Asset Ratio.

The calculated information is a statistical value of the previous risk assessment data, and is a value that calculates the difference in risk grades of assets that have performed both the first and second risk assessments.

When the statistical data calculated by the data input unit 122 is input, the data processing unit 124 calculates the first reference value and the second reference value of the n-time risk assessment using the same.

2 is a flowchart of a process of calculating a first reference value of n-time risk assessment by the data processor 124.

First, the first baseline down ratio of the n-time risk assessment is calculated (S210).

The risk rating obtained as a result of the second risk assessment is the first among the risk assessment records that were performed n-1 times using the value of the ratio of the assets having the first risk rating <the second risk rating input through the data input unit 122. It is calculated by calculating the percentage of assets above the risk class.

In operation S220, the first baseline increase rate of the risk assessment is calculated.

This is based on the value of the asset ratio of the first risk level> the second risk level, which is input through the data input unit 122, and the risk level obtained as a result of the second risk evaluation is the first among the risk evaluation records performed n-1 times. It is calculated by calculating the proportion of assets below the risk class.

If the calculated first baseline down ratio exceeds a predetermined level (T1) (S230), the first baseline of the n-time risk assessment is adjusted down (S240).

However, if the calculated first baseline rate of increase exceeds a predetermined level (T1) (S250), the first baseline of the n-time risk assessment is adjusted (S260).

If the above two conditions are not satisfied, the existing primary reference value is maintained as it is (S270).

3 is a flowchart of a process of calculating a second reference value of n-time risk assessment by the data processor 124.

First, a rate of decreasing the second reference value of the n-time risk assessment is calculated (S310).

This is the case when the total risk rating calculated as a result of the risk assessment performed at n-1 times is smaller than the second reference value by using the value of the asset ratio which is the total risk rating <the second reference value input through the data input unit 122. Calculated by calculating the ratio of assets to

In operation S320, a rate of raising the second reference value of the n-time risk assessment is calculated.

This is the case when the total risk rating calculated as a result of the risk assessment performed at n-1 times is greater than the second reference value by using the value of the asset ratio which is the total risk level> the second reference value input through the data input unit 122. Calculated by calculating the ratio of assets to

If the calculated second threshold fall ratio exceeds a predetermined level (T2) (S330), the second threshold of the n-time risk assessment is adjusted downward (S340).

However, if the calculated second baseline rate of increase exceeds a predetermined level (T2) (S350), the second baseline of the n-time risk assessment is adjusted (S360).

If the above two conditions are not satisfied, the existing secondary reference value is maintained as it is (S370).

In addition, the first baseline down and up rates and the second base line down and up rates for calculating the n primary and secondary base values as described above are temporarily stored in the risk diagnosis database 114 as intermediate data for performing risk assessment. It is stored and used to calculate the primary and secondary reference values.

The data output unit 126 stores the n times the first and second reference values calculated in the reference value management database 116 so that the risk rating of the network asset based on the reference value may be calculated in the risk class setting device 130 later.

The risk rating device 130 includes a risk analyzer 132, a risk evaluator 134, and a risk controller 136.

The function and operation of the risk class setting device 130 for n-time risk evaluation will be described with reference to FIG. 4.

The risk analysis unit 132 analyzes the risk at each level based on a list of data on network assets, such as equipment such as routers and switches, operation and management personnel, and documentation.

In this case, the risk analysis is performed by dividing the asset into primary and secondary, and the primary analysis is to calculate the primary risk value for each asset by scoring the profit contribution, other asset correlation, and risk intrinsicness. The secondary risk value for each asset is calculated by analyzing the ratings, vulnerability ratings, and threat ratings in detail.

To this end, the risk analysis unit 132 first refers to the basic investigation contents which have been pre-investigated and stored for the risk assessment n times from the risk diagnosis database 114, and the basis for calculating the primary and secondary risk values. As data, the degree of profit contribution, the degree of association with other assets, the degree of risk implications, the asset class, the vulnerability rating, and the threat rating are calculated (S410).

In particular, the equation for calculating asset class, vulnerability class, and threat class is as shown in Equation 1.

<Equation 1>

Asset class = actual asset value Revenue contribution Other asset association diagram Risk implications

Vulnerability Rating = Vulnerability Factor Weighted Vulnerability Severity

Threat class = weight of threat factor Threat frequency

Actual asset value, revenue contribution, other asset correlation, risk intrinsic, vulnerability weighting, vulnerability severity, threat factor weighting, and threat frequency for calculating asset class, vulnerability class, and threat class in Equation 1 The information included in the basic investigation content which is previously investigated and stored for n risk assessments from (114).

As described above, when the basic data of revenue contribution, other asset association, risk impliedness, asset class, vulnerability rating, and threat rating are calculated to calculate the primary and secondary risk values, The second and second risk values are calculated (S420).

<Equation 2>

1st risk figure = revenue contribution Other asset association diagram Risk implications

2nd risk figure = asset class Vulnerability level Threat rating

As described above, the asset-specific revenue contribution, other asset correlation, risk implication, asset class, vulnerability rating, and threat rating, and the first and second risk values for each asset are calculated by the risk analysis unit 132. It is stored in the risk diagnosis database 114 as intermediate data for performance.

The risk evaluation unit 134 first calculates a primary risk level for each asset by referring to the primary risk value calculated by the risk analysis unit 132 from the risk diagnosis database 114 (S430).

The calculation of the primary risk level is carried out by determining whether the primary risk value is included in the risk level according to a predetermined rule.

When the primary risk level is calculated, the primary risk is compared with the primary reference value, which is a criterion for selecting the target risk level and the object of the risk assessment, by referring to the primary reference value of the baseline management database 116 (S440). If the evaluation grade is larger, a second risk rating for each asset is calculated (S450).

Similar to the calculation of the primary risk rating, the calculation of the secondary risk rating refers to the secondary risk value calculated by the risk analysis unit 132 from the risk diagnosis database 114 and is included in the corresponding risk level according to a predetermined rule. This is done by determining if it is a numerical value.

After the secondary risk rating is calculated, the overall risk rating for the risk assessment of the asset is calculated (S460).

The asset-specific primary and secondary risk grades and the overall risk grade calculated by the risk assessment unit 134 are stored in the risk diagnosis database 114 as intermediate data for performing the risk assessment.

Once the overall risk rating is calculated, the risk control unit 136 refers to the secondary reference value of the baseline management database 116 and compares the calculated secondary risk value with the secondary reference value, which is a reference value for determining the security investment based on the risk assessment result. If (S470), if the overall risk level is greater than the second reference value, it is determined that the asset is required for security as a result of risk assessment, and control is performed accordingly (S480).

As described above, the present invention has an effect of reducing the cost required for risk assessment by differentially applying risk assessment by introducing the concept of a baseline.

Furthermore, by using the results of the risk assessment that has been previously performed to establish the baseline, it continuously reflects changes in the network, thereby reducing the cost of security management in the mid to long term, and enabling continuous and systematic security management.

In addition, it is possible to provide basic data for improving the risk assessment system in the future, and to establish a basic infrastructure of the security service part of a service level agreement (SLA) project.

Claims (13)

A risk rating apparatus for evaluating a risk assessment of a network asset by dividing it into primary and secondary, and calculating primary and secondary risk grades, overall risk grades, and detailed grades respectively according to the primary and secondary assessments; A reference value setting device that calculates primary and secondary reference values, respectively, as a reference for dividing the primary and secondary risk levels, when the primary and secondary risks are evaluated; And The primary and secondary risk levels and the overall risk level and detail level, which are calculated at each risk assessment, are stored, and the primary and secondary reference values are stored. And a security information storage device for storing intermediate data to be stored and for storing information of the network asset. The method of claim 1, The level of detail, the risk rating calculation system of the network asset, characterized in that it comprises the revenue contribution, other asset association, risk intrinsic degree, asset rating, vulnerability rating, and threat rating of the network asset. The method of claim 2, The basic survey contents required for the risk assessment include the survey of the manager and the survey of the frequency of past risk occurrences to calculate the revenue contribution, other asset association, risk implication, asset rating, vulnerability rating, and threat rating. A risk rating calculation system for network assets, characterized in that it is used. The method of claim 1, The information of the network asset, the risk rating calculation system of the network asset, characterized in that the physical asset and the asset, the introduction year, the introduction cost, and the depreciation rate for the network asset. The method of claim 1, The reference value setting device, A data input unit for receiving the first and second risk levels, the overall risk level, and the second reference value from the security information storage device to calculate statistical data of a risk assessment previously performed; The first and second reference values may be calculated by calculating down and up ratios of the first reference value and calculating the down and up ratios of the second reference value with reference to the statistical data of the risk assessment previously performed. A data processor; And And a data output unit for storing the primary and secondary reference values in the security information storage device. The method of claim 5, wherein The statistical data of the risk assessments performed previously, Information about asset ratios of primary risk class <secondary risk class, ratio of assets with primary risk class> secondary risk class, total risk class <percentage of assets with secondary baseline, and overall risk class> percentage of assets with secondary baseline And a risk rating calculation system for the network asset. The method of claim 5, wherein And the down and up rates of the first baseline and the down and up rates of the second baseline are intermediate data calculated during the risk assessment. The method of claim 1, The risk rating device, A risk analysis unit for calculating the detailed grade and calculating first and second risk values using the calculated detailed grade; A risk evaluation unit for calculating the first and second risk levels and calculating the overall risk level using the first and second risk values; And And a risk controller for comparing whether the security risk is required for the corresponding network asset by comparing the calculated overall risk level with the second reference value. A first step of calculating a detailed grade by referring to basic survey contents of a network asset which has been previously investigated; A second step of calculating first and second risk values using the calculated detailed grades; A third step of calculating a primary risk level using the calculated primary risk value; Comparing the calculated primary risk level with a primary reference value that is a criterion for selecting a target for risk assessment, and if the primary risk level is larger than the primary reference value, the secondary risk level is used by using the secondary risk value. A fourth process of calculating; Calculating a total risk level of the network asset; And Comprising a sixth step of comparing the calculated overall risk rating with a second reference value that is a criterion for determining the security investment, if the overall risk rating is greater than the second reference value, it is determined that the asset requires security treatment Characterized by the risk rating method of the network asset. The method of claim 9, The basic survey content, the risk rating calculation method of the network asset, characterized in that it comprises a survey of the administrator and the frequency of past risk occurrence. The method of claim 9, The level of detail, the risk contribution calculation method of the network asset, characterized in that it comprises the revenue contribution, other asset association, risk intrinsic degree, asset rating, vulnerability rating, and threat rating. The method of claim 9, The primary reference value, A first step of calculating a down rate and an up rate of the first reference value using previously calculated first and second risk levels; A second step of lowering the previously calculated primary reference value when the down ratio of the primary reference value is a predetermined value or more; A third step of adjusting a previously calculated primary reference value when the ratio of the primary reference value is higher than a predetermined value; And If the down ratio and the up ratio of the primary reference value in the second step and the third step is less than a predetermined value, it is calculated by a process comprising a fourth step of maintaining a previously calculated primary reference value How to calculate the risk rating of your network assets. The method of claim 9, The secondary reference value, Calculating a downward ratio and an upward ratio of the secondary reference value using the previously calculated overall risk level and the secondary reference value; A second step of lowering a previously calculated secondary reference value if the ratio of the downward reference value is greater than or equal to a predetermined value; A third step of adjusting a previously calculated secondary reference value when the rate of increase of the secondary reference value is greater than or equal to a predetermined value; And If the down ratio and the up ratio of the secondary reference value in the second step and the third step is less than a predetermined value, it is calculated by a process comprising a fourth step of maintaining a previously calculated secondary reference value How to calculate the risk rating of your network assets.