KR20090013099A - Method and system for managing information technology risk based on safety index calculated - Google Patents

Abstract

A method and a system for managing information technology risk based on calculated are provided to make an administrator recognizes current danger and weak point by indicating quantifying degree of danger toward software weak point of service, host, sub-network and total network into safety index. An assets DB(500) stores history and weighted value of IT assets of a total network. A weak point DB(600) stores the weak point information about the IT assets. A assets detecting device(300) detects the packet transmitted and received in sub-network and investigates the IT assets included in sub-network. A danger management device inquires the assets, inputted from the assets detecting device, to the weak point DB and reads the weak point. The danger management device(400) inquires the assets to the assets DB and reads the weighted value and calculates the safety index of the total network by using the weighted value in case weak point exists.

Description

Method and system for managing information technology risk based on safety index calculated

The present invention relates to a method and system for managing the risk of IT assets by calculating the enterprise safety index based on the IT assets used by the enterprise and software vulnerabilities of the IT assets.

 As enterprise IT environments become more complex, a variety of threats are increasing, and these threats pose serious risks for many companies in practice. Denial of service attacks, Trojan horses, worms, and viruses are just a few of those threats, but they can be very serious risks for businesses and must be managed efficiently in a timely manner.

IT security threats are constantly growing, rapidly spreading and constantly changing. The nature of these threats puts a strain on corporate security management and causes substantial economic damage to companies.

The reason for this is that companies' IT infrastructures are very complex and they use a variety of systems, so the security threats faced by companies are so diverse that it is not enough for them to take adequate action against all threats.

In the case of large enterprises, for example, they use a number of different operating systems, systems, databases, and clients, each with different versions, and different patch levels.

In contrast, threats are designed to exploit software vulnerabilities in a particular version of a particular piece of code, and the types are also very complex, with dozens of new vulnerabilities discovered every week, and this information is scattered across the Internet. Effective management of threats is nearly impossible.

In order for organizations to protect their IT infrastructure from a variety of threats, companies need to be aware of the nature of the various threats that exist within the enterprise, the software vulnerabilities they can use, and detailed information about the enterprise infrastructure assets they need to protect. Only when such detailed information is matched against the characteristics of the enterprise IT infrastructure can it be perceived as a risk.

However, detailed information about the entire software vulnerability and infrastructure is very large and constantly changing, so identifying these details is a difficult task. In addition, it is very difficult to identify the software security vulnerabilities and IT assets with the vulnerabilities and manage them quantitatively. Due to these difficulties, conventional methods have been used qualitatively.

For effective IT security risk management, it is possible to identify assets of the entire enterprise, identify software security weaknesses of the assets, and manage them through patches and security measures.

However, in the past, qualitative IT security risk calculation and management based on three factors of asset value, threat to asset, and software security vulnerability to make the threat become a real mainstream.

Traditionally, investments in security, such as the number of security staff, the introduction of new security solutions, and the rapid application of patches for new vulnerabilities have been made in a qualitative manner and are not managing IT security risks efficiently.

This approach cannot measure the exact extent of IT security threats and cannot quantify IT security threats, so it is not possible to know what the level of IT security risks is and therefore how much IT security risks are driven by security investments. There was no way to pinpoint whether it had shrunk.

For example,

● Assets: Software Used by the Enterprise

● Threats: Discover new software security vulnerabilities for these assets

● Vulnerabilities: Code that attacks these software security vulnerabilities

In the above case, it is very difficult for IT security staff to collect information about the appearance of these vulnerabilities spread across the Internet, to wait for signatures from intrusion prevention system vendors, and to apply patches when the presence of the vulnerability is known. There is no other way.

This way, IT security personnel apply individual patches for individual vulnerabilities. In addition, IT security staff generally have no expertise in the value of IT assets with software vulnerabilities, and therefore there is no basis for whether there are too many or too few IT security staff, and this approach is an effective overall IT security risk. It is far from official. The advantages and disadvantages of the qualitative IT security risk measurement method are summarized in Table 1 below.

Advantages Disadvantages Easy risk calculation The result is subjective No economic value estimate Economic value cannot be calculated for security measures and application results No need to estimate security measures against threats Cost effectiveness cannot be estimated Generalization of risks and ease of response No objective way to identify risk Unable to identify business impact

In order to efficiently manage IT security risks by efficiently investing in IT security, such as manpower investment in IT security and investment in security solutions, it is necessary to express and manage the security risks of the entire IT environment in a quantitative manner. It is necessary. Meanwhile, the advantages and disadvantages of the quantitative IT risk index measurement method are summarized in Table 2 below.

Advantages Disadvantages Objective Risk Index Calculation Complicated calculation Economic value for risk and security measures Need to put value on assets Comparable security risk scores by time of day and action Risk index calculation and change over time Identify high risk IT assets Possible to calculate return on investment for security measures Identify business impact Capable of identifying and managing IT risks across the enterprise

Therefore, it is possible to efficiently manage IT security risks that cannot be efficiently managed by existing qualitative IT security risk management techniques by calculating quantitative risk values, and continue to reflect the risk values immediately reflected when security measures are taken. It is a reality that a method and a system that can be managed by a company are urgently needed.

The present invention provides an IT risk management method based on calculating a quantitative safety index that can efficiently manage overall IT security risk by calculating and managing a quantitative IT security risk index based on software vulnerabilities of existing IT assets of the entire enterprise. To provide a system.

An IT risk management system of the present invention for achieving the above technical problem, Asset DB for storing the details and weights of the IT assets of the entire network; A vulnerability database that stores vulnerability information about IT assets; An asset detection device connected to one or more sub-networks included in the entire network and inspecting the packets transmitted and received in the sub-networks to investigate the IT assets included in the sub-networks; And read the vulnerability by querying the asset DB inputted from the asset detection device to the vulnerability DB, and if the vulnerability exists, read the weight by querying the asset DB for the asset, and calculate the safety index of the entire network using the weight. It includes a risk management device.

In addition, the risk management device described above calculates the safety index of services performed by using the assets surveyed by the asset detection device for software vulnerabilities, and the safety of hosts providing the services using the safety index of the services. The index may be calculated, the safety index of the sub-networks including the hosts may be calculated using the safety index of the hosts, and the safety index of the entire network may be calculated using the safety index of the sub-networks.

상기 수식에서 C 는 기준 상수를 나타내고, ST는 서비스 안전 지수를 나타내며, VW는 소프트웨어 취약점의 심각도에 따른 가중치를 나타내고, VH는 취약점 치유 여부를 각각 나타낼 수 있다.In addition, the above-described risk management apparatus calculates a safety index for the service according to the following formula,

In the above formula, C represents a reference constant, ST represents a service safety index, VW represents a weight according to the severity of the software vulnerability, and VH may represent whether the vulnerability is healed.

In addition, the above-described risk management apparatus calculates a safety index for the host according to the following formula, and HT = ∑ (ST * SUMT (VW)) / ∑ (SUMT (VW)) where HT is the safety index of the host. ST represents the safety index of each service provided by the host, SUMT (VW) may represent the sum of the vulnerability weight of each service provided by the host.

In addition, the above-described risk management apparatus calculates a safety index for the subnetwork according to the following formula, and GT = ∑ (HT * SUMH (VW)) / ∑ (SUMH (VW)) where GT is the The safety index represents the safety index, and the HT represents the safety index of each host included in the subnetwork, and the SUMH (VW) may represent the sum of vulnerability weights of services provided by each host included in the corresponding subnetwork.

In addition, the above-described risk management apparatus calculates the safety index for the entire network according to the following formula, and TT = ∑ (GT * SUMG (VW)) / ∑ (SUMG (VW)) where TT is GT represents the safety index, GT represents the safety index of each sub-network included in the entire network, SUMG (VW) may represent the sum of the vulnerability weight of the services included in each sub-network.

In addition, the above-described asset management apparatus outputs the safety index of the service, the safety index of the hosts, the safety index of the sub-networks and the safety index of the entire network to the administrator terminal, when the healing information on the vulnerability is input from the administrator terminal, The safety index of the services, the safety index of the hosts, the safety index of the sub-networks, and the safety index of the entire network may be sequentially updated by reflecting the healing information.

On the other hand, the IT risk management method of the present invention for achieving the above-described technical problem, (a) the asset detection device to investigate the IT assets included in the sub-network by examining the packets transmitted and received in the sub-network; (b) the risk management device inquiring the IT asset in a vulnerability DB to read the vulnerability, and inquiring the asset DB to read the weight; And (c) calculating, by the risk management apparatus, the safety index of the entire network using the weight.

In addition, step (c) described above may include (c1) calculating a safety index of services performed by using the assets surveyed by the asset detection device for the software vulnerability; (c2) calculating a safety index of hosts providing the services using the safety index of the services; (c3) calculating a safety index of sub-networks including the hosts using the safety index of the hosts; And (c4) calculating the safety index of the entire network using the safety index of the sub-networks.

상기 수식에서 C 는 기준 상수를 나타내고, ST는 서비스 안전 지수를 나타내며, VW는 소프트웨어 취약점의 심각도에 따른 가중치를 나타내고, VH는 취약점 치유 여부를 각각 나타낼 수 있다. In addition, the step (c1) described above calculates the safety index for the service according to the following formula,

In the above formula, C represents a reference constant, ST represents a service safety index, VW represents a weight according to the severity of the software vulnerability, and VH may represent whether the vulnerability is healed.

In addition, step (c2) described above calculates a safety index for the host according to the following equation, and HT = ∑ (ST * SUMT (VW)) / ∑ (SUMT (VW)) where HT is the safety of the host. The index represents an index, ST represents the safety index of each service provided by the host, SUMT (VW) may represent the sum of the vulnerability weight of each service provided from the host.

Further, step (c1) described above calculates the safety index for the subnetwork according to the following equation, and GT = ∑ (HT * SUMH (VW)) / ∑ (SUMH (VW)) where GT is the subnetwork HT represents the safety index of each host included in the sub-network, SUMH (VW) may represent the sum of vulnerability weights of services provided by each host included in the sub-network.

In addition, step (c1) described above calculates the safety index for the entire network according to the following equation, and TT = ∑ (GT * SUMG (VW)) / ∑ (SUMG (VW)) where TT is the entire network The GT represents the safety index of the GT, GT represents the safety index of each sub-network included in the entire network, SUMG (VW) may represent the sum of the vulnerability weight of the services included in each sub-network.

In addition, the above-described IT risk management method, (d) outputs the safety index of the service, the safety index of the host, the safety index of the sub-network and the safety index of the entire network to the administrator terminal, the healing information for the vulnerability from the administrator terminal If is input, the method may further include sequentially updating the safety index of the services, the safety index of the hosts, the safety index of the sub-networks, and the safety index of the entire network by reflecting the healing information.

The present invention detects the IT assets used in the entire network, calculates the safety index of services performed using the IT assets for software vulnerabilities, and uses the safety index of the services to determine the safety index of hosts providing services. The safety index of the sub-networks including the hosts is calculated using the safety index of the hosts, and the safety index of the entire network is calculated and displayed to the manager using the safety index of the sub-networks. In addition, when the administrator heals the vulnerability, the safety indexes are recalculated and displayed to the administrator by reflecting the contents of the healing.

In this way, the threat level of software vulnerabilities of each service, host, sub-network, and entire network is quantified and displayed, so that administrators can intuitively recognize the current risk level and the areas to be compensated for. Appears.

Hereinafter, an IT risk management method and system according to a preferred embodiment of the present invention will be described with reference to the accompanying drawings. 1 is a block diagram showing the overall configuration of an IT risk management system according to a preferred embodiment of the present invention.

Referring to FIG. 1, the risk management system of the present invention includes a plurality of asset detection apparatus 300, a risk management apparatus 400, an asset DB 500, and a vulnerability DB 600.

First, the plurality of asset detecting apparatuses 300 are connected to the plurality of sub-networks 200, respectively, and detect the assets used in the sub-network 200 by examining packets transmitted and received in the sub-network 200. To perform. Specifically, the asset detection device 300 examines the contents of packets transmitted and received within the sub-network 200, and investigates the OS, the type of service, and the like used by each host 100 included in the sub-network 200. Output to the management device 400.

The risk management apparatus 400 inquires the assets of each sub-network 200 input from the asset detection device 300 of each sub-network 200 to the asset DB 500, and checks the vulnerability of the corresponding assets for the vulnerability DB 600. ).

In addition, the risk management apparatus 400 uses the weight information retrieved from the asset DB 500 and the vulnerability information of each asset retrieved from the vulnerability DB 600 to obtain a safety index for each service provided by the sub-network 200. Calculate

Thereafter, the risk management apparatus 400 calculates a safety index for each host using a safety index for each service, calculates a safety index for each subnetwork using a safety index for each host, and uses a safety index for each subnetwork. The safety index of the entire network is calculated, and the calculated safety index for each service, safety index for each host, safety index for each sub network, and the total safety index are provided to the manager terminal 700.

In addition, the risk management device 400 updates the above-mentioned safety indexes by reflecting when new assets are added, and when the vulnerability to the items included in the previously calculated safety index is cured, the risk management device 400 reflects such a situation for each service. The safety index is recalculated and provided to the manager terminal 700.

The asset DB 500 stores a list of assets such as a service list (web service, mail service, DB service, etc.) and OS list provided in the entire network. In particular, the asset DB 500 is stored in association with the weight given according to the importance of each asset or the severity of the damage of the software vulnerability.

Vulnerability DB 600 stores a list of software vulnerabilities of various IT assets. The list of software stored in the vulnerability DB 600 is not limited to the list of software used in the network to which the risk management apparatus 400 is connected, and may be updated in real time through the Internet.

The manager terminal 700 displays the safety index input from the risk management device 400 to the manager, and when the vulnerability healing information for each asset is input from the manager, the manager terminal 700 outputs the corresponding information to the risk management device 400, thereby providing a risk. Allow the management device 400 to update the safety index.

In the following description, a method of calculating the safety index in the risk management apparatus 400 will be described.

As described above, the present invention calculates a quantitative safety index based on software IT weaknesses of enterprise IT assets and assets. To this end, the present invention calculates the safety index by grasping the IT asset and asset value, by identifying the software vulnerability and severity (importance) of the IT asset and calculating a quantitative IT security risk value.

In the present invention, the safety index is calculated by giving a high weight to an IT asset having a high risk of vulnerability and giving a low weight to an IT asset having a relatively low risk of vulnerability.

In addition, the present invention calculates the safety index for each step from a lower level to a higher level. For example, the present invention may calculate the safety index by weighting the IT assets of each department of a large organization such as an enterprise or a government office, and calculate the safety index of the entire organization by using the safety index of each department. In addition, the present invention assigns a weight to each of the plurality of sub-networks 200 (for example, networks of each department) according to the severity (importance) of the software vulnerability for each service provided by each sub-network 200 to each service. The safety index is calculated, the safety index for each host providing a service using the safety index for each service, and the safety index for each sub-network including the hosts 100 by using the safety index of each host (100). After the calculation, the safety index of the entire network is calculated using the safety index of each sub-network 200.

In addition, the risk management system and method of the present invention by using the software vulnerability information that is updated in real time to update the previously calculated safety index for each service, the security by service reflecting the fact that the network administrator heals the software vulnerability Update the index. When the safety index for each service is updated, the safety index for each host, the safety index for each sub-network, and the overall network safety index are sequentially updated. Therefore, the administrator can determine from the current software vulnerability of each host, sub-network, and entire network in real time. The safety of can be determined regularly.

Hereinafter, the risk management apparatus 400 will be described how to calculate the safety index as follows.

First, the safety index (ST) for each service is calculated by the following equation (1).

In Equation 1, C represents a reference constant, ST represents a service safety index (has a value of C to 2C), VW represents a weight expressing the severity of a software vulnerability as 1 to 10, and VH represents whether the vulnerability is cured. (Set to 0 for vulnerabilities and 1 for vulnerabilities).

At this time, when the vulnerability safety index 100 is to be shown in a completely secure state, the reference constant C is set to 50, and the safety index ST has a value of 50 to 100. Here, the state of ST 50 indicates that the service is very vulnerable, and the state of ST 100 indicates that the service is very secure.

In addition, when the vulnerability in the service is healed in Equation 1, the VH is set from 1 to 0 to update the safety index, and when all the vulnerabilities are healed, the sum of the vulnerabilities is 0 and the safety index is 2C (= 100). .

Meanwhile, the safety index for each host is calculated using the safety index of the services provided by the host 100 according to Equation 2 below.

HT = ∑ (ST * SUMT (VW)) / ∑ (SUMT (VW))

In Equation 2, HT represents the safety index of the host 100, ST represents the safety index of each service provided by the corresponding host 100 obtained in Equation 1 above, SUMT (VW) is the host 100 ) Shows the sum of the vulnerability weights of each service provided by.

For example, in the case where the host 100 provides five services, the denominator of Equation 2 is the sum of the sum of the vulnerability weights of each of the five services, and the numerator is the safety index of each service and the corresponding. The sum of the sum of the weights of the services is added together.

In Equation 2, the safety index HT of the host 100 has a value of C to 2C of Equation 1 described above. In the above example, when C is set to 50, HT has a value of 50 to 100. , 50 indicates that the host 100 is very vulnerable, and 100 indicates that the host 100 is very secure from software vulnerabilities.

On the other hand, as described above, the plurality of hosts 100 constitute a sub-network 200, the safety index of the sub-network 200 is obtained by the following equation (3).

GT = ∑ (HT * SUMH (VW)) / ∑ (SUMH (VW))

In Equation 3, GT represents a safety index of the sub network 200, HT represents a safety index of each host 100 included in the corresponding sub network 200 obtained in Equation 2 above, SUMH (VW) Denotes the sum of vulnerability weights of services provided by the respective hosts 100 included in the corresponding sub-network 200.

For example, when the corresponding sub-network 200 is composed of four hosts 100, the corresponding hosts 100 provide five services, and each service has six vulnerabilities, the above-described Equation 3 The denominator of is the sum of the weights of all 120 vulnerabilities, and the numerator is the sum of the sum of the sum of the weights of the vulnerabilities included in the host 100 and the safety index of each host 100.

In Equation 3, the safety index GT of the sub network 200 has a value of C to 2C of Equation 1 described above. In the above example, when C is set to 50, GT represents a value of 50 to 100. 50 indicates that the sub-network 200 is very vulnerable, and 100 indicates that the sub-network 200 is very safe from software vulnerabilities.

Meanwhile, the safety index of the entire network of the organization including the plurality of sub-networks 200 may be calculated by Equation 4 as follows.

TT = ∑ (GT * SUMG (VW)) / ∑ (SUMG (VW))

In Equation 4, TT represents the safety index of the entire network, GT represents the safety index of each sub-network 200 obtained in Equation 3 above, SUMG (VW) is a service included in each sub-network 200 The sum of their vulnerability weights.

Therefore, in Equation 4, the denominator represents the sum of the weights of the vulnerabilities of the services of the entire network, and the numerator is the security of the sub-network 200 to the sum of the weights of the vulnerabilities of the services included in each sub-network 200. It is the sum of the products of the exponents.

In Equation 4, the safety index TT of the entire network has a value of C to 2C of Equation 1 described above. In the above example, when C is set to 50, GT has a value of 50 to 100, and 50 Indicates that the entire network is very vulnerable, and 100 indicates that the entire network is very secure from software vulnerabilities.

2 is a flowchart illustrating a risk management method according to a preferred embodiment of the present invention. Referring to FIG. 2, the asset detection apparatus 300 installed in each sub network 200 first examines the packets included in the sub network 200 by examining the packets transmitted and received within the sub network 200. Output to the risk management device (400) (S200).

The risk management apparatus 400 inquires the asset history to the vulnerability DB 600 to investigate the vulnerability of the asset, and inquires the asset DB 500 to read the vulnerability weight of the corresponding asset (S210).

Thereafter, the risk management apparatus 400 calculates the safety index by applying the read weight (S220). In detail, the risk management apparatus 400 calculates a safety index for each service according to Equation 1 above (S221), and calculates a safety index for each host according to Equation 2 using the safety index for each service (S223). In step S225, the safety index for each subnetwork is calculated according to Equation 3 using the host safety index, and the safety index of the entire network is calculated according to Equation 4 using the safety index for each subnetwork (S227). Since the method of calculating the safety index at each step has been described above, a detailed description thereof will be omitted.

When the risk index of the entire network is calculated, the risk management apparatus 400 outputs the safety index of each service, host, subnetwork, and entire network to the manager terminal 700 together with vulnerability list information. And, the manager terminal 700 displays the list of vulnerabilities input from the risk management device 400 to the administrator (S230).

On the other hand, the administrator receiving the vulnerability information to heal the vulnerability to input the healing history information to the administrator terminal 700, the risk management device 400 continuously whether or not the vulnerability healing history information is input from the administrator terminal (700) If the healing information is input after the investigation, the process proceeds to step S220 and sequentially updates from the safety index for each service to the entire network safety index (S240).

In addition, if the vulnerability healing information is not input at step S240, the risk management apparatus 400 queries the vulnerability DB 600 to investigate whether a newly discovered vulnerability exists for assets currently included in the entire network. If a new vulnerability is found, the process proceeds to step S220 to calculate a safety index considering the new vulnerability (S250).

However, for the convenience of description, it has been described that step S250 is performed after step S240 is performed, but it should be noted that step S240 and step S250 may be executed independently of each other in any order.

On the other hand, the risk management method of the present invention can also be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which are also implemented in the form of a carrier wave (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

1 is a block diagram showing the overall configuration of an IT risk management system according to a preferred embodiment of the present invention.

2 is a flowchart illustrating a risk management method according to a preferred embodiment of the present invention.

Claims (15)

An asset DB for storing details and weights of IT assets of the entire network; A vulnerability database that stores vulnerability information about IT assets; An asset detection device connected to one or more sub-networks included in the entire network and inspecting the packets transmitted and received in the sub-networks to investigate the IT assets included in the sub-networks; And Inquiry of the asset input from the asset detection device to the vulnerability DB to read the vulnerability, and if there is a vulnerability, the asset is referred to the asset DB to read the weight, and calculate the safety index of the entire network using the weight An IT risk management system comprising a risk management device. The method of claim 1, wherein the risk management device For software vulnerabilities, calculate safety indexes of services performed using the assets surveyed by the asset detection device, calculate safety indexes of hosts providing the services using the safety indexes of the services, Calculating a safety index of the sub-networks including the hosts using a safety index, and calculating a safety index of the entire network using the safety index of the sub-networks. The method of claim 2, The risk management device calculates a safety index for the service according to the following formula,

In the above formula, C represents a reference constant, ST represents a service safety index, VW represents a weight according to the severity of the software vulnerability, and VH represents whether the vulnerability is healed. The method of claim 2, The risk management device calculates a safety index for the host according to the following formula, HT = ∑ (ST * SUMT (VW)) / ∑ (SUMT (VW)) In the above formula, HT represents a safety index of a host, ST represents a safety index of each service provided by the host, and SUMT (VW) represents a sum of vulnerability weights of each service provided from the host. IT risk management system. The method of claim 2, The risk management device calculates the safety index for the sub-network according to the following equation, GT = ∑ (HT * SUMH (VW)) / ∑ (SUMH (VW)) In the above formula, GT represents the safety index of the sub-network, HT represents the safety index of each host included in the sub-network, and SUMH (VW) is the sum of vulnerability weights of services provided by each host included in the sub-network. IT risk management system, characterized in that representing. The method of claim 2, The risk management device calculates a safety index for the entire network according to the following formula, TT = ∑ (GT * SUMG (VW)) / ∑ (SUMG (VW)) In the above equation, TT represents the safety index of the entire network, GT represents the safety index of each sub-network included in the entire network, and SUMG (VW) represents the sum of vulnerability weights of the services included in each sub-network. IT risk management system. The apparatus of claim 2, wherein the asset management apparatus The safety indexes of the services, the safety index of the hosts, the safety index of the sub-networks and the safety index of the entire network are output to the administrator terminal, and when healing information on the vulnerability is input from the administrator terminal, the healing information is reflected and And a security index of the hosts, the safety index of the sub-networks, and the safety index of the entire network are sequentially updated. (a) inspecting, by the asset detecting apparatus, an IT asset included in the sub-network by examining packets transmitted and received in the sub-network; (b) the risk management device inquiring the IT asset in a vulnerability DB to read the vulnerability, and inquiring the asset DB to read the weight; And (c) calculating, by the risk management apparatus, the safety index of the entire network using the weights. The method of claim 8, wherein step (c) (c1) calculating a safety index of services performed by using the assets surveyed by the asset detection device, for a software vulnerability; (c2) calculating a safety index of hosts providing the services using the safety index of the services; (c3) calculating a safety index of sub-networks including the hosts using the safety index of the hosts; And (c4) calculating the safety index of the entire network using the safety index of the sub-networks. The method of claim 9, Step (c1) calculates a safety index for the service according to the following formula,

In the above formula, C represents a reference constant, ST represents a service safety index, VW represents a weight according to the severity of the software vulnerability, and VH represents whether the vulnerability is healed. The method of claim 9, Step (c2) calculates the safety index for the host according to the following formula, HT = ∑ (ST * SUMT (VW)) / ∑ (SUMT (VW)) In the above formula, HT represents a safety index of a host, ST represents a safety index of each service provided by the host, and SUMT (VW) represents a sum of vulnerability weights of each service provided from the host. How to manage IT risk. The method of claim 9, Step (c1) is to calculate the safety index for the sub network according to the following equation, GT = ∑ (HT * SUMH (VW)) / ∑ (SUMH (VW)) In the above formula, GT represents the safety index of the sub-network, HT represents the safety index of each host included in the sub-network, and SUMH (VW) is the sum of vulnerability weights of services provided by each host included in the sub-network. IT risk management method characterized in that. The method of claim 9, Step (c1) is to calculate the safety index for the entire network according to the following formula, TT = ∑ (GT * SUMG (VW)) / ∑ (SUMG (VW)) In the above equation, TT represents the safety index of the entire network, GT represents the safety index of each sub-network included in the entire network, and SUMG (VW) represents the sum of vulnerability weights of the services included in each sub-network. IT risk management methods. The method of claim 9, (d) outputting safety indexes of services, safety indexes of hosts, safety indexes of sub-networks, and safety indexes of entire networks to an administrator terminal, and when healing information on a vulnerability is input from the administrator terminal, the healing information is reflected And sequentially updating a safety index of the services, a safety index of the hosts, a safety index of the sub-networks, and a safety index of the entire network. A recording medium in which the IT risk management method according to any one of claims 8 to 14 is recorded in a computer readable and executable program code.

Images