KR20100118422A - System and method for tracing signature security information - Google Patents

Abstract

PURPOSE: A system and a method for tracing signature security information are provided to monitor the leakage of user information by generating and using a rule for monitoring log information collected from a service server. CONSTITUTION: A log information collector(220) collects log information from a service server, and a rule relation analyzer(230) merges the log information by each case to generate a rule for each case. The rule analysis unit classifies the rule to generate a reference rule, and monitors the log information based on the reference rule. A scenario relation analyzer(240) generates scenario according to the relationship between rules based on the rule for each case, and monitors the log information in real time based on the scenario.

Description

System and Method for Tracing Signature Security Information

The present invention relates to a system and method for tracking information security evidence, and more particularly, to collect log information from a plurality of servers in order to prevent leakage of internal information, and to set an analysis criterion using the same, and according to the set analysis criteria. Information security evidence tracking system and method for monitoring the log information to obtain evidence data and to monitor the suspected information leakage more intensively.

Internal information leakage prevention is an active concept in recent years, and various product groups exist under the same name.

For example, the document security suite uses the name internal information leakage prevention, and PC security, mail monitoring and even USB are referred to as internal information leakage prevention.

However, the internal information referred to by a company can be viewed as all the information generated by the members in the enterprise if interpreted broadly in a broadly broad sense, and, if interpreted more passively, of the information generated by the members in the enterprise. It can be seen as a document that includes more than the non-credit.

Currently, a technique for more systematically monitoring the above-described information and generating a corresponding basis when an abnormality occurs is not provided.

The present invention has been made to solve the above-described problem, and generates a rule for monitoring the log information based on the log information collected from a plurality of different types of service server, and monitors the information leakage of the user based on this There is a technical problem to provide a system and method for tracking information security evidence.

In addition, the present invention is to create a scenario based on the relationship between a plurality of rules, and to monitor the log information based on the generated scenario.

In addition, the present invention is to enable a quick and accurate derivation of the cause when a security incident occurs.

In addition, the present invention is to enable to monitor the abnormal work pattern of the security outsourcing personnel, and to provide evidence by collecting relevant evidence data when the abnormal signs are detected or information leakage is identified.

The present invention is intended to be able to detect the leakage of information from the inside, not the intrusion from the outside from the point of view of the different types of unit security equipment to be collected information.

The information security evidence tracking system of the present invention for achieving the above object is to collect the log information transmitted from a plurality of service servers, combine by case, create a case-by-case rule, and generates a scenario based on the relationship between a plurality of rules After that, the information security evidence tracking server for monitoring the log information collected in real time using the generated case-specific rules and scenarios; And

And an operator terminal that manages a plurality of service servers based on analysis results transmitted from the information security evidence tracking server.

Another information security evidence tracking server of the present invention includes a communication interface for performing communication through a communication network;

A log information collecting unit collecting log information from a plurality of service servers;

After combining the log information collected by the log information collecting unit for each case to generate a case-by-case rule, and to generate the reference rule by classifying the generated rule, using this rule to monitor the log information collected in real time A related analysis unit; And

It includes a scenario-related analysis unit for generating a scenario according to the relationship between the rules by using the case-by-case rule, and monitoring the log information collected in real time using the generated scenario.

The information security evidence tracking server,

An analysis result processing unit for analyzing and processing the entire result including policy violation items and policy violation details according to preset items based on monitoring results of the rule related analysis unit and the scenario related analysis unit; And

Preferably, the analysis result providing unit for providing the analysis result generated by the analysis result processing unit to the operator terminal.

The rule related analysis unit,

Rule generating means for generating a rule for each case by combining the log information collected by the log information collecting unit for each case and classifying the generated rule to generate a reference rule;

Monitoring means for monitoring log information according to the monitoring criteria for each rule based on the reference rule generated by the rule generating means and extracting log information having an abnormality; And

Evidence generating means for matching and managing the log information extracted by the monitoring means and the service server information that is the source of the log information, policy violation items and policy violation details;

The reference rule is preferably classified into information leakage prevention, information leakage indication monitoring, information leakage detection.

The reference rule includes a document security abnormal user rule, and the monitoring means, according to the monitoring criteria of the document security abnormal user rule, the login / logout record exceeds a threshold or logs in for a specific period of time. It is a good idea to check for violations of document security policies when a log exists but the log out log does not exist above the threshold.

The reference rule includes a security release authority holder rule with an excessive security release frequency, and the monitoring means generates a security document release history more than a threshold value according to the monitoring criteria of the security release authority holder with an excessive security release frequency. It is advisable to check a user for a breach frequency policy violation.

The reference rule includes a security document output number rule, and the monitoring means outputs a security document more than a reference number of times during business hours according to the monitoring criteria of the security document output number rule, and secures a reference number more than a non-business time It is desirable to check the number of security document output policy violations when the document is printed, the security document is output through VPN access, and the security document is output more than the number of times for the centralized management target.

The reference rule includes an IP change attempt rule, and the monitoring means checks any one of IP change prohibition subjects who have arbitrarily attempted an IP change more than a reference number as a violation of the IP change policy according to the monitoring criteria of the IP change attempt rule. It is preferable.

The reference rule includes a VPN user login error rule, and the monitoring means checks a user account for which a login error occurs more than the reference number of VPN accounts as a policy violation according to the monitoring criteria of the VPN user login error rule. For example, it is desirable to transmit the contents to the operator terminal.

The reference rule includes an abnormal time zone VPN access rule, and the monitoring means, according to the monitoring criteria of the abnormal time zone VPN access rule, a predetermined abnormal time zone VPN worker extraction central management subject accesses the main system through the VPN It is a good idea to check for violations of policies when you perform abnormal work and when the work is performed by accessing the VPN to a system that does not require access to a specific time zone.

The reference rule includes a VPN connection excess data transceiver rule, and the monitoring means accesses a specific system among VPN users based on the monitoring criteria of the VPN connection excess data transmitter / receiver rule. It is desirable to check the user for policy violations more than once.

The reference rule includes an overtime / external capacity of the task and an external sender rule attached to the file, and the monitoring means provides a specific recipient according to the monitoring criteria of the overtime / extended capacity of the external / externally attached file rule. It is preferable to check a sender who sends a mail by dividing it into a plurality of mails and attaching a file of a certain size or more as a policy violation.

The reference rule includes a file transfer excess rule, and the monitoring means transmits and receives a file including a specific keyword among users who transmit a file having a standard capacity or more using a messenger according to the monitoring criteria of the file transfer excess rule. It is advisable to check a user for policy violations.

The reference rule includes a specific site access excess rule, and the monitoring means policies a user who caused the specific site access count more than the reference number and the user who caused the abnormal traffic according to the monitoring criteria of the specific site access excess rule. It is desirable to check for violations.

The reference rule includes an overtime / external capacity of the task and an external sender rule attached to the file, and the monitoring means provides a specific recipient according to the monitoring criteria of the overtime / extended capacity of the external / externally attached file rule. It is recommended to check the sender who sent mail with the file attached to a certain size by dividing into multiple mails for policy violation.

The reference rule includes an outgoing link attachment download transient rule, wherein the monitoring means includes, according to the monitoring criteria of the outgoing link attachment download transient rule, the outgoing link attachment download is more than a reference number of times, and the plurality of download IPs is multiple. It is advisable to check individual cases for policy violations.

The reference rule includes an overtime / external capacity and an attached file download rule, and the monitoring means includes an uploaded file having a standard capacity or more according to the monitoring criteria of the overtime / extended time / external file download rule. It is preferable to check the user who downloaded the downloaded file, the case where the user is the centralized management target or when a large amount of unnecessary download is performed as a violation of policy.

The scenario related analysis unit may include scenario generation means for generating a scenario for detecting a policy violation based on correlation between rules included in the case-by-case rule;

Monitoring means for monitoring log information collected by a log information collecting unit using the scenario; And

Evidence generating means for matching and managing the log information checked by the monitoring means and the service server information that is the source of the log information, policy violation items and policy violation details;

The scenario includes the information protection criteria consisting of PC security environment violation area, information leakage area, human area,

The violation area of the PC security environment indicates a rule for deriving a violation of the PC security environment, and the information leakage area indicates a violation of security in an environment in which information is moved to an insider's PC or an outsider's PC. The derived solution represents a rule, and the human area preferably represents a rule that finds the human resources to be managed and monitored for all potential users.

The scenario includes a severity criterion,

The severity criterion is based on the PC security environment violation area and information when the same person is detected in a rule belonging to the PC security environment violation area when the same person is detected in a rule belonging to the information leakage area when the same person is detected in the rule of each case. It is classified into the case where it is detected in the rule belonging to the leaked area and the person area, and the case that is detected in the rule set that corresponds to the scenario where the actual information leakage is possible by the rules belonging to the PC security environment violation area, the information leakage area, and the human area respectively. It is preferable.

Another embodiment of the present invention is a method for tracking information security evidence in an information security evidence tracking server connected to a plurality of service servers to perform information security,

a) collecting, by the information security evidence tracking server, log information from the plurality of service servers;

b) generating a case-by-case rule after combining the collected log information for each case by the information security evidence tracking server, and classifying the generated rule to generate a reference rule;

c) monitoring log information collected in real time based on the reference rule; And

and d) analyzing and transmitting the entire result including the policy violation item and the policy violation detail according to the preset item based on the monitoring result, and transmitting the result to the operator terminal.

After step b) and before step c), the information security evidence tracking server further comprises generating a scenario based on the relationship between rules using the case-by-case rule. In step c), the log information is monitored. In this case, it is preferable to apply the scenario as a monitoring criterion.

As described above, the information security evidence tracking system and method of the present invention generates a rule for monitoring log information based on log information collected from a plurality of different types of service servers, and based on this, information leakage of a user is detected. You can expect the effect of monitoring.

In addition, since the present invention generates a scenario based on the relationship between the plurality of rules and monitors log information based on the generated scenario, there is an advantage that more accurate monitoring can be performed.

In addition, the present invention has the advantage that the cause can be more quickly and accurately derived when a security incident occurs.

In addition, the present invention has the advantage that it is possible to monitor abnormal work patterns of security outsourcing personnel, and if evidence of abnormality is detected or information leakage is identified, the evidence may be collected and the evidence may be presented.

The present invention can be expected to have an effect that the types of unit security equipment to be collected information are different from each other and can detect information leakage from the inside rather than intrusion from the outside at the analysis point.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing the configuration of the information security evidence tracking system according to the present invention.

As shown, the information security evidence tracking system of the present invention collects the log information transmitted from the plurality of service server 100, combines by case, generates a case-by-case rule, and generates a scenario based on the relationship between the plurality of rules. After generating, based on the analysis results transmitted from the information security trail tracking server 200 and the information security trail tracking server 200 to monitor the log information collected in real time using the generated case-specific rules and scenarios It includes an operator terminal 300 for managing the service server 100.

The service server 100 disclosed in FIG. 1 is meant to include both an internal server or an external server related to a specific company to which the present invention is applied to different types of interworking target devices.

For example, the service server 100 may include a document security server, a policy change management server, an internal member personnel information management server (IMS), a personnel information server, a distributor customer information leakage audit server, a customer information transmission management server, a PC security server, and the like. to be.

On the other hand, log information collected by the information security evidence tracking server 200 from the service server 100 is as follows.

For example, the service server is a document security server as follows.

-Document security log (user document security utilization log): log time, log type ID_DRM classification, user ID_company number, PC ID, client IP, client address, file name, printer marking status, print text file name, original file name, Initial Creator ID_Number, Document First Generation Time, Log Upload Time, Document Viewer List, Process Name, Category Name, Document Type, Document Grade, Output Count, Offline Log Whether, Log Type Name_DRM

-Administrator document security log (administrative authority execution log): log time, log type ID, administrator ID_company number, administrator access IP, administrator access MAC address, target user ID, file name, original file name, document first creator ID, document first generation Time, list of recent viewers

-Security folder usage log: log date, log type ID, log type name, user ID, target user ID, target path, reason for export, original file name, target file name, document size

-Document Security Media Usage Log: Employee No._User ID, Log Date, MAC Address, IP Address, PC_ID, Media Type, Storage Path, Internal / External Classification, File Size, Log Creation Date

-Login information log: log time, user ID, user PC ID, user PC IP, user PC MAC address, log type ID, log type name

-Old version document security login information log: log time, user ID, user PC ID, user PC IP, user PC MAC address, log type ID, log type name

The above-described log information is an example, and according to each service server 100, it is possible to set, change, and delete log information to be arbitrarily collected by an operator.

2 is a diagram showing the configuration of the information security information security trace tracking management server according to the present invention.

As shown, the information security evidence tracking management server 200 is a communication interface 210, log information collection unit 220, rule-related analysis unit 230, scenario-related analysis unit 240, analysis result processing unit ( 250 and an analysis result providing unit 260.

In more detail, the communication interface 210 is a component for performing communication through a communication network.

The log information collecting unit 220 collects log information from a plurality of service servers.

The rule related analysis unit 230 combines the log information collected by the log information collecting unit 220 for each case, generates a case-by-case rule, classifies the generated rules, generates a reference rule, and then uses the same. Monitor log information collected in real time.

Scenario-related analysis unit 240 generates a scenario according to the relationship between the rules by using a case-by-case rule, and monitors the log information collected in real time using the generated scenario.

The analysis result processor 250 analyzes the entire result including the policy violation item and the policy violation detail according to a preset item based on the monitoring result of the rule related analysis unit 230 and the scenario related analysis unit 240.

In more detail, the analysis result processing unit 250 integrates the results analyzed and matched by the evidence generating means 235 and 245, respectively, and classifies them according to specific items to determine whether actual information leaks. Make it available as material.

For example, when the analysis result processing unit 250 is detected in one rule / scenario, it is possible to determine whether or not the actual information is leaked by confirming information leakage related records from a previous or another server by applying a specific period. .

The analysis result providing unit 260 provides the analysis result generated by the analysis result processing unit 250 to the operator terminal 300.

3 is a diagram illustrating a configuration of a rule related analysis unit according to the present invention.

As shown, the rule related analysis unit 230 includes a rule generating means 231, a monitoring means 233, and evidence generating means 235.

In more detail, the rule generating means 231 generates a case-by-case rule by combining the log information collected by the log information collecting unit 220 for each case, and classifies the generated rule to generate a reference rule.

For example, the rule generating unit 231 may infer a case where information leakage is possible in an infrastructure environment from case 1 to case 46 based on the plurality of log information collected by the log information collecting unit 220. Derived by combining the log information collected from each case and the service server 100 to generate 46 case-specific rules that can be satisfied in each case as shown in Table 1.

(Table 1)

이후, 룰 생성수단(231)은 생성된 케이스별 룰을 분류하여 기준 룰을 생성한다.

Thereafter, the rule generating unit 231 generates the reference rule by classifying the generated case-specific rules.

Here, the reference rules are classified into information leakage prevention, information leakage indication monitoring, and information leakage detection.

The information leakage prevention rule refers to the group's rule that induces measures to prevent information leakage throughout the enterprise by using the information detected in the rule. It is to provide.

In addition, the information leakage indication monitoring rule means the rule of the group to which the rule which derives the person to be managed and monitored by judging it as an information leakage indication when analyzing the information detected in the rule. It is intended to provide a basis for intensive monitoring.

In addition, the information leakage detection monitoring rule refers to the rule of the group to which the rule which derives the information with high possibility of information leakage when the information detected in the rule is analyzed. It is to provide evidence.

The monitoring means 233 monitors log information according to the monitoring criteria for each rule based on the reference rule generated by the rule generating means 231 and extracts log information in which an abnormality occurs.

For example, if the reference rule includes the document security abnormal user rule, the monitoring means 233 determines that the log-in / log-out record exceeds a threshold value for a specific period according to the monitoring criteria of the document security abnormal user rule, Alternatively, if the log-in log exists but the log-out log does not exist above the threshold, check for document security policy violation.

Also, the reference rule includes a security release authority holder rule with excessive security release frequency, and the monitoring means 233 according to the monitoring criteria of the security release authority holder rule with excessive security release frequency, the security document release history is more than a threshold value. The user is checked as a security frequency violation.

The reference rule includes a security document output number rule, and the monitoring means 233 outputs the security document more than the reference number of times during the business hours according to the monitoring criteria of the security document output number rule, and the security document more than the reference number of times during the non-business hours. If the security document is output through the VPN access, and the security document is output more than the number of times for the centralized management target, check the number of security document output policy violations.

The reference rule includes an IP change attempt rule, and the monitoring means 233 checks, as the IP change policy violation, any one of the IP change prohibited persons who attempted an IP change arbitrarily more than the reference number of times according to the monitoring criteria of the IP change attempt rule.

The reference rule includes a VPN user login error rule, and the monitoring means 233 checks a user account for which a login error occurs more than the reference number of VPN accounts as a policy violation according to the monitoring criteria of the VPN user login error rule. , To transmit the contents to the operator terminal (300).

The reference rule includes an abnormal time zone VPN access rule, and the monitoring means 233 according to the monitoring criteria of the abnormal time zone VPN access rule, the predetermined abnormal time zone VPN worker extraction central management subject accesses the main system through the VPN. Policy violations are checked for cases where abnormal work is performed and when work is performed by accessing a VPN to a system that does not require access to a specific time zone.

The reference rule includes a VPN connection excess data sender / receiver rule, and the monitoring means 233 accesses a specific system among VPN users according to the monitoring criteria of the VPN connection excess data sender / receiver rule to perform data upload / download more than the reference number of times. Check this user for policy violations.

The reference rule includes an overtime / external capacity of the task and an external sender rule attached to the file, and the monitoring means 233 is configured to send a plurality of data to a specific recipient according to the monitoring criteria of the overtime / extended capacity of the external / external filer rule. The sender who sent a mail with a file of more than a certain size divided by mail is checked for policy violation.

The reference rule includes a file transfer excess rule, and the monitoring means 233 transmits / receives a file including a specific keyword among users who transmit a file having a standard capacity or more using a messenger according to the monitoring criteria of the file transfer excess rule. Check the user for policy violations.

The reference rule includes a specific site access excess rule, and the monitoring means 233 policies a user who caused a specific site access count or more than a reference number and a user who caused an abnormal traffic according to the monitoring criteria of the specific site access excess rule. Check for violations.

The reference rule includes an overtime / external capacity of the task and an external sender rule attached to the file, and the monitoring means 233 is configured to send a plurality of data to a specific recipient according to the monitoring criteria of the overtime / extended capacity of the external / external filer rule. A sender who sends a mail with a file attached to a certain size by dividing into a mail is checked for policy violation.

The reference rule includes an outgoing link attachment download transient rule, and the monitoring means 233 according to the monitoring criteria of the outgoing link attachment download transient rule, the outgoing link attachment download is more than the reference number of times, and the plurality of download IPs are multiple. Check the case against the policy.

The standard rule includes an overtime / external capacity and an attached file download rule, and the monitoring means 233 uploads an attached file that is larger than or equal to the standard capacity according to the monitoring criteria of the overtime / external time / attached file download rule. The user who downloaded the file, the user who is the centralized management target, or performs a large amount of unnecessary downloads for work is checked as a policy violation.

The evidence generating means 235 matches and manages the log information extracted by the monitoring means 233 with the service server information which is the source of the log information, the policy violation item, and the policy violation detail.

4 is a diagram illustrating a configuration of a scenario related analysis unit according to the present invention.

As shown, the scenario related analysis unit 240 includes a scenario generating means 241, a monitoring means 243 and the evidence generating means 245.

In more detail, the scenario generating means 241 generates a scenario for detecting a policy violation based on correlation between rules included in a case-by-case rule.

The scenario includes an information protection standard consisting of a PC security environment violation area, an information leakage area, and a human area. The PC security environment violation area represents a rule for deriving a violation of the PC security environment, and the information leakage area is local. The insider's PC handled by the PC or the rule that draws a violation of security in the environment where the information is transferred to the outsider's PC, and the human area is the manpower that needs to be managed and monitored for all potential users. Indicates the rule to look for.

In this case, the scenario includes a severity criterion, and the severity criterion is also detected in a rule belonging to the information leakage area when a person belonging to the PC security environment violation area is detected when the same person is detected in a rule more than the standard number of times. In this case, it is applicable to the scenarios in which the PC security environment violation area, information leakage area, and human area rule are all detected, and the rules belonging to the PC security environment violation area, information leakage area, and human area are available for actual information leakage. It is divided into cases detected in the rule set.

For example, severity 3 is the case where the same person is detected in two or more rules out of 46 rules, and the same person is detected in two or more rules regardless of the area. This scenario is checked to be monitored.

Severity 2 is when a person detected in a rule belonging to the PC security environment violation area is also detected in a rule belonging to the information leakage area. The same person is detected in a rule belonging to the PC security environment violation area and also in a rule belonging to the information leakage area. In such a case, the user is selected as a centralized management target, and the scenario is checked to perform a procedure of verifying whether the leaked information actually includes customer or internal information.

Severity 1 is a case where a person detected in a rule belonging to the PC security environment violation area is also detected in a rule belonging to the information leakage area and a rule belonging to a person area. The same person is a PC security environment violation area and an information leakage area. In this case, it is detected in both human domains, which indicates the level of confidence that the information has been attempted to violate all domains, and provides a basis for conducting precise business analysis through Forensics. It is a possible scenario to provide.

Scenario-based severity 1 is a rule that belongs to the PC security environment violation area, information leakage area, and human area, and is detected by the rule set that corresponds to the scenario created considering the possibility of actual information leakage. It is a case of establishing a scenario where information can be leaked from the environment, and it is detected by a combination of rules belonging to three areas so that the information leaked in the scenario can be detected, which indicates the level of information that can be relied on that the information has been attempted. In this scenario, it is possible to provide a basis for conducting precise business analysis.

The monitoring means 243 monitors the log information collected by the log information collecting unit 220 using a scenario.

The evidence generating means 245 matches and manages the log information checked by the monitoring means 243, service server information which is the source of the log information, policy violation items, and policy violation details.

5 is a flowchart illustrating an example of a method for tracking information security evidence according to the present invention.

First, the information security evidence tracking server 200 collects log information from a plurality of service servers (S101).

Subsequently, the information security evidence tracking server 200 combines the collected log information on a case-by-case basis, generates a case-by-case rule, and classifies the generated rule to generate a reference rule (S103).

Thereafter, the information security evidence tracking server 200 generates a scenario based on the relationship between the rules by using a case-by-case rule (S105).

Information security evidence tracking server 200 monitors the log information collected in real time based on the reference rules and scenarios (S107).

Here, step S105 may be omitted as required by the operator. When step S105 is omitted, the information security evidence tracking server 200 applies only a reference rule when monitoring log information. On the other hand, if step S105 is not omitted, the information security evidence tracking server 200 also applies the scenario as monitoring criteria.

The information security evidence tracking server 200 analyzes the entire result including the policy violation item and the policy violation detail according to the preset item based on the monitoring result, and transmits the result to the operator terminal 300 (S109).

Here, the information security evidence tracking server 200 integrates the results matched to the policy violation items based on the monitoring result in step S107, and classified according to specific items to determine whether or not the actual information leakage Generate data.

As such, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical spirit or essential features thereof. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

As described above, the information security evidence tracking system and method of the present invention generates a rule for monitoring log information based on log information collected from a plurality of service servers, and monitors the leakage of user information based on the log information. It is suitable for creating a scenario based on the relationship between rules, and monitoring the log information based on the generated scenario to perform more accurate monitoring.

1 is a view showing the configuration of the information security evidence tracking system according to the present invention,

2 is a view showing the configuration of the information security evidence tracking management server according to the present invention;

3 is a view showing a configuration of a rule related analysis unit according to the present invention;

4 is a view showing a configuration of a scenario related analysis unit according to the present invention;

5 is a flowchart illustrating an example of a method for tracking information security evidence according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: service server 200: information security evidence tracking server

210: communication interface unit 220: log information collection unit

230: rule-related analysis unit 231: rule generation means

233 monitoring means 235 evidence generating means

240: scenario-related analysis unit 241: scenario generation means

243 monitoring means 245 means for generating evidence

250: analysis result processing unit 260: analysis result provider

300: operator terminal

Claims (23)

Collect log information transmitted from a plurality of service servers, combine them on a case-by-case basis, generate a case-by-case rule, generate a scenario based on the relationship between the plurality of rules, and collect them in real time using the generated case-specific rules and scenarios. An information security evidence tracking server that monitors log information generated; And An operator terminal for managing a plurality of service servers based on analysis results transmitted from the information security evidence tracking server; Information security evidence tracking system comprising a. A communication interface unit for performing communication through a communication network; A log information collecting unit collecting log information from a plurality of service servers; And After combining the log information collected by the log information collecting unit for each case to generate a case-by-case rule, and to generate the reference rule by classifying the generated rule, using this rule to monitor the log information collected in real time A related analysis unit; Information security evidence tracking server comprising a. The method of claim 2, The information security evidence tracking server, A scenario related analyzer configured to generate a scenario according to a relationship between rules using the case-by-case rule, and monitor log information collected in real time using the generated scenario; Information security evidence tracking server further comprising a. The method of claim 3, The information security evidence tracking server, An analysis result processing unit for analyzing and processing the entire result including policy violation items and policy violation details according to preset items based on monitoring results of the rule related analysis unit and the scenario related analysis unit; And An analysis result providing unit configured to provide an analysis result generated by the analysis result processing unit to an operator terminal; Information security evidence tracking server further comprising a. The method of claim 2, The rule related analysis unit, Rule generating means for generating a rule for each case by combining the log information collected by the log information collecting unit for each case and classifying the generated rule to generate a reference rule; Monitoring means for monitoring log information according to the monitoring criteria for each rule based on the reference rule generated by the rule generating means and extracting log information having an abnormality; And Evidence generating means for matching and managing the log information extracted by the monitoring means with service server information, a policy violation item, and a policy violation detail that are sources of log information; Information security evidence tracking server comprising a. The method of claim 5, The reference rule is an information security evidence tracking server, characterized in that classified into information leakage prevention, information leakage monitoring, information leakage detection. The method of claim 5, The reference rule includes a document security abnormal user rule, The monitoring means, According to the monitoring criteria of the document security abnormal user rule, a log-in / log-out record exceeds a threshold value or a log-in log exists but the log-out log does not exist above the threshold value for a specific period. An information security trail tracking server characterized by checking for violations. The method of claim 5, The reference rule includes a security release authority holder rule with an excessive security release frequency. The monitoring means, Information security evidence tracking server, characterized in that for checking the user who has a security document release history of more than a threshold value as a security release frequency policy violation, according to the monitoring criteria of the security release authority holder rule excessive security release frequency. The method of claim 5, The reference rule includes a VPN user login error rule, The monitoring means, According to the monitoring criteria of the VPN user login error rule, check the user account that the login error occurs more than the reference number of VPN accounts as a policy violation, and transmits the information to the operator terminal information security evidence tracking server, characterized in that . The method of claim 5, The reference rule includes an abnormal time zone VPN access rule, The monitoring means, According to the monitoring criteria of the abnormal time zone VPN access rule, when the predetermined abnormal time zone VPN worker extraction centralized management subject accesses the main system through the VPN to perform abnormal work, and accesses the system through which the specific time zone access is not required. An information security tracking server that checks for violations of policy when work is performed. The method of claim 5, The reference rule includes a VPN connection excessive data sender rule, The monitoring means, The information security evidence tracking server, characterized in that the user accesses a specific system among VPN users and checks the user as a policy violation more than the standard number of times of data upload / download based on the monitoring criteria of the VPN access excessive data transmitter / receiver rule. The method of claim 5, The reference rule includes an excessive amount of time within / outside the task and an external sender rule with an attached file. The monitoring means, According to the overtime capacity of the internal / external time and the monitoring criteria of the external sender rule of attachment, the sender who has sent a mail by dividing the message into a plurality of recipients and attaching a file having a certain capacity is checked as a policy violation. Information security trail tracking server. The method of claim 5, The reference rule includes a file transfer excess rule, The monitoring means, According to the monitoring criterion of the excessive file transfer rule, the information security evidence tracking server, characterized in that the user who has transmitted and received a file containing a specific keyword among the users who have sent a file of more than the standard capacity using a messenger as a policy violation. The method of claim 5, The reference rule includes a specific site access excess rule, The monitoring means, The information security evidence tracking server according to the monitoring criteria of the specific site access excessive rule, the user who caused the specific site access count more than the reference number of times and the user causing the abnormal traffic as the policy violation check. The method of claim 5, The reference rule includes an excessive amount of time within / outside the task and an external sender rule with an attached file. The monitoring means, According to the overtime capacity of the internal / external time and the monitoring criteria of the external sender rule of attachment, the sender who sends a mail by attaching a file more than a certain capacity by dividing it into a plurality of mails to a specific recipient and checking it as a policy violation Information security trail tracking server. The method of claim 5, The reference rule includes an outgoing link attachment download transient rule, The monitoring means, The information security evidence tracking server according to the monitoring criteria of the outgoing link attachment download transient rule, checks that the outgoing link attachment download is more than a reference number and there are a plurality of download IPs as a policy violation. The method of claim 5, The reference rule includes an overtime / external capacity of the task, an attachment download rule, The monitoring means, Policy violation for the user who downloaded the uploaded file with more than the standard capacity, the user is the centralized management target or performs unnecessary large-scale download in accordance with the overtime / external capacity of the work and the monitoring criteria of the attachment file download rule. Information security evidence tracking server, characterized in that the check. The method of claim 3, The scenario related analysis unit, Scenario generation means for generating a scenario for detecting a policy violation based on correlation between rules included in the case-by-case rule; Monitoring means for monitoring log information collected by a log information collecting unit using the scenario; And Evidence generating means for matching and managing the log information checked by the monitoring means with service server information, a policy violation item, and a policy violation detail that are the sources of log information; Information security evidence tracking server comprising a. The method of claim 18, The scenario includes the information protection criteria consisting of PC security environment violation area, information leakage area, human area, The violation area of the PC security environment indicates a rule for deriving a violation of the PC security environment, and the information leakage area indicates a violation of security in an environment in which information is moved to an insider's PC or an outsider's PC. The derivation represents a rule, and the human domain represents a rule for finding a manpower that needs to be managed and monitored for all potential users. The method of claim 19, The scenario includes a severity criterion, The severity criterion is based on the PC security environment violation area and information when the same person is detected in a rule belonging to the PC security environment violation area when the same person is detected in a rule belonging to the information leakage area when the same person is detected in the rule of each case. It is classified into the case where it is detected in the rule belonging to the leaked area and the person area, and the case that is detected in the rule set that corresponds to the scenario where the actual information leakage is possible by the rules belonging to the PC security environment violation area, the information leakage area, and the human area respectively. Information security evidence tracking server, characterized in that. A method for tracking information security evidence on an information security evidence tracking server connected to a plurality of service servers to perform information security. a) collecting, by the information security evidence tracking server, log information from the plurality of service servers; b) generating a case-by-case rule after combining the collected log information for each case by the information security evidence tracking server, and classifying the generated rule to generate a reference rule; c) monitoring log information collected in real time based on the reference rule; And d) analyzing and transmitting the entire result including the policy violation item and the policy violation detail according to the preset item based on the monitoring result and transmitting the result to the operator terminal; Information security evidence tracking method comprising a. The method of claim 21, After step b) and before step c), Generating, by the information security evidence tracking server, a scenario based on the relationship between rules using the case-specific rule; In step c), When the log information is monitored, the information security evidence tracking method, characterized in that for applying the scenario as a monitoring criteria. The method of claim 22, In step d), On the basis of the monitoring result in step c), the information security evidence tracking server integrates the results matched with the policy violation items, and classifies them according to specific items to generate evidence data to determine whether or not the actual information is leaked. Information security evidence tracking method, characterized in that.

Images