KR20160004791A - System and method for evaluating risk of information assets - Google Patents

Abstract

Disclosed are a system and a method for evaluating the risk of information assets. The system for evaluating the risk of information assets may comprise: an asset value calculation unit for quantifying asset classes inputted by each asset by using an asset class table to calculate an asset value; a vulnerability calculation unit for quantifying vulnerability classes inputted for each vulnerability item set by each asset by using a vulnerability class table to calculate a vulnerability value; a threat calculation unit for quantifying threat classes inputted for each of the vulnerability items set by each asset by using a threat class table to calculate a threat value; and a risk calculation unit for selecting an application rate for each of the vulnerability items set by each asset in response to an inputted selection signal, and performing an arithmetic operation with the vulnerability value, a value that reflects the application rate, the threat value, and the asset value so as to calculate a risk value.

Description

A system and method for evaluating information assets,

The present invention relates to a risk assessment system and method for information assets, and more particularly, to a risk assessment system and method for information assets that can provide users with priorities of objects to be managed according to their risks.

Risk assessment of information assets is an essential process for performing security management, and it is a key process of risk management that analyzes the risks and proposes cost-effective countermeasures to plan the implementation of security policies and countermeasures. Threats to information assets can be divided into physical, administrative, and technical threats. Physical threats are threats from physical intrusions such as disasters, catastrophic threats or destruction by terrorism. Administrative threats include eavesdropping / tapping by humans, and social engineering threats. Technological threats are threats through networks of insiders or outsiders.

The risk analysis process can be generally divided into an asset assessment process, a threat assessment process, a vulnerability assessment process, and a risk assessment process. The asset assessment process identifies the assets to be protected and identifies the importance of each asset. The process of threat assessment is the process of identifying various threats to information assets. The vulnerability assessment process identifies the vulnerability of each identified asset against the identified threat and identifies the extent of the ripple effect. The risk assessment process is a process of assessing the level of risk for an entire asset and establishing priorities for establishing protective measures. An example of such a risk analysis is disclosed in Korean Patent No. 10-0524649.

However, in the risk assessment, the risk is assessed at the same level of importance without determining the importance level of the vulnerability items by asset. In fact, the user can see the risk assessment result clearly and prioritize the establishment of the management and protection measures There is a problem that is difficult to set.

The problem to be solved by the present invention is to analyze the asset value, the vulnerability and the threat, and to calculate the risk of the asset, by setting the application rate differently for the vulnerability items according to the asset, And to provide a risk evaluation system of information assets that can provide priorities of management targets.

Another problem to be solved by the present invention is to provide a risk assessment method that can evaluate the risk of an asset using the risk assessment system.

According to an aspect of the present invention, there is provided a risk evaluation system including an asset value calculation unit for calculating an asset value by digitizing an asset class inputted for each asset using an asset class table, A vulnerability calculation unit for calculating a vulnerability value by quantifying the vulnerability class inputted for each vulnerability table using the vulnerability table, and a threat level inputted for each vulnerability item set for each asset, And selecting the application rate for each of the vulnerability items set for each asset in response to the input selection signal, and selecting a value reflecting the application rate to the vulnerable value, the threat value and the asset value And calculating a risk value by calculating the risk value.

The asset class may be a rating entered for each of the availability, integrity, and confidentiality of the asset, and the asset class table may have a relationship between the level of availability, integrity, and confidentiality and the asset value for each asset.

The vulnerability rating is a rating inputted for each of the vulnerability items for each of the exposure and severity, and the vulnerability rating table may have a relation between the degree of vulnerability and the degree of vulnerability and the vulnerability value for each vulnerability item.

The threat grade is a rating inputted for the influence of each item of the vulnerability item, and the threat grade table may have a relationship between the degree of the influence and the threat value for each item of the vulnerability item.

The risk assessment system may further include a determination unit that compares the risk value with a reference value and determines that the corresponding vulnerability item is a management target when the risk value is greater than or equal to the reference value.

The assets may be one or more of data, documents, software, servers, networks, information protection systems, PCs and laptops, other media, additional facilities and additional facilities.

The risk assessment system may be configured to calculate a vulnerability score using the vulnerability values calculated for each asset or to calculate a risk score using the risk value calculated for each asset or to calculate an asset value, And a statistical value calculating unit for calculating an overall risk score using the risk score.

According to another aspect of the present invention, there is provided a risk evaluation method comprising: setting an asset value by quantifying an asset class input for each asset using an asset class table; Setting a vulnerability value by numerically expressing the vulnerability rating inputted to the vulnerability table using the vulnerability table, and setting a threat value by numerically calculating the threat level inputted for each vulnerability item set for each asset using the threat level table Selecting an application rate for each vulnerability item set for each asset in response to the input selection signal; calculating a value reflecting the application rate to the vulnerable value, the threat value and the asset value to calculate a risk value; And a step of calculating the number of steps.

Wherein the step of setting the asset value is to set the asset value using the input grade and the asset grade table for each of availability, integrity and confidentiality of the asset, and the step of setting the vulnerability value comprises: And setting the vulnerability value using the vulnerability rating table and the input rating for each of the vulnerability and severity, wherein the step of setting the threat value comprises: Wherein the step of calculating the risk value comprises the step of multiplying the vulnerability value, the application ratio and the threat value, and adding the value of the asset to the risk value, . ≪ / RTI >

The risk assessment method may further include comparing the risk value with a reference value, and determining that the corresponding vulnerability item is a management subject if the risk value is greater than or equal to the reference value.

According to the technical idea of the present invention, the risk assessment system and the method of the information asset according to the embodiment of the present invention are designed to calculate the risk of the asset by analyzing the asset value, vulnerability and threat, And provides the calculated risk to the user, thereby providing the user with the priority of the management subject according to the risk. That is, according to the technical idea of the present invention, the risk assessment system and method according to one embodiment of the present invention performs risk assessment according to the importance set according to the user, and the result is provided as a numerical value, It is easy to determine the priorities of vulnerability items by assets to be managed.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
1 is a block diagram of a risk assessment system according to an embodiment of the present invention.
2 is a flow chart of a method for assessing risk using the risk assessment system of FIG.
FIGS. 3A and 3B are diagrams for explaining the operation of the asset value calculation unit of FIG. 1. FIG.
4A and 4B are diagrams for explaining the operation of the vulnerability calculating unit of FIG.
5A and 5B are diagrams for explaining the operation of the threat calculation unit of FIG.
6A and 6B are diagrams for explaining the operation of the risk calculation unit of FIG.
FIG. 7 is a diagram for explaining an embodiment for calculating the risk value in the risk calculating unit of FIG. 1; FIG.
Figs. 8 and 9 are diagrams for explaining the operation of the statistical value calculating unit of Fig.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the preferred embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

FIG. 1 is a block diagram of a risk assessment system 100 in accordance with one embodiment of the present invention. FIG. 2 is a flow chart of a method for assessing risk using the risk assessment system 100 of FIG.

1 and 2, the risk assessment system 100 includes an asset value calculation unit 110, an asset rating table 115, a vulnerability calculation unit 120, a vulnerability rating table 125, a threat calculation unit 130 ), A threat level table 135 and a risk degree calculation unit 140. [ The risk assessment system 100 may further include a determination unit 150 and a statistic value calculation unit 160 in addition to the components.

The asset value calculating unit 110 may calculate the asset value by converting the asset class inputted for each asset into a numerical value using the asset class table (S210). Such assets can be divided into technical assets, administrative assets, physical assets, and the like, for example, data, documents, software, servers, networks, information protection systems, PCs and laptops, other media, Or may be a subcategory thereof. For example, the detailed items of the software may be package software, application software, system software, solution, OS, OA, etc., and the details of the server may be a web server, A mail server, an FTP server, a DB server, and other servers. However, the assets of the present invention are not limited to those described above, and they may be included in the scope of the assets if they are subject to risk evaluation. The asset class may be a rating entered through input means such as a keyboard, a mouse, a touchpad, etc., and may be, for example, a rating of the availability of the asset, a rating of integrity and a rating of confidentiality. The availability means the degree to which the asset is accessible to the authorized party at the appropriate time and the integrity means the degree to which the asset can be altered in a manner authorized by the authorized party, But only to the extent that it is guaranteed to be accessed only by the parties. In the asset class table 115, the relationship between the above-mentioned availability, integrity and confidentiality grade and the asset value is set for each of the assets. The operation of the asset value calculation unit 110 will be described in more detail with reference to FIGS. 3A and 3B. FIG.

The vulnerability calculating unit 120 may calculate a vulnerability value for each of the vulnerability items set for each of the assets by using the vulnerability table 125 to numerically calculate the vulnerability value (S220). The vulnerability items may be physical, administrative or technological items to be checked for vulnerability, and the vulnerability items may be items entered by the user or items set for the respective assets. The vulnerability rating may be a rating inputted through an input means such as a keyboard, a mouse, a touch pad, and the like, for example, the rating level of the vulnerability item and the severity of the vulnerability item. The degree of vulnerability refers to the degree of possibility of external exposure of the vulnerability item, and the severity may indicate the degree of damage in case of an accident caused by the vulnerability item. In the vulnerability table 125, the relationship between the degree of vulnerability and severity and the vulnerability value is set for each vulnerability item. The operation of the vulnerability calculation unit 120 will be described in more detail with reference to FIGS. 4A and 4B.

The threat calculation unit 130 can calculate the threat value by quantifying the threat level inputted for each of the vulnerability items set for each asset using the threat grade table 135 at step S230. As described above, the vulnerability items refer to physical, administrative, or technological vulnerability checks. The vulnerability items may be items entered by the user or items set for the respective assets. The threat grade may be a rating inputted through an input means such as a keyboard, a mouse, a touch pad, or the like, and may be a rating of the influence of the vulnerability item, for example. This influence may mean the extent of the ripple effect in the event of an accident. In the threat level table 135, the relationship between the level of the influence and the threat value is set for each of the vulnerability items. The operation of the threat calculation unit 130 will be described in detail with reference to FIGS. 5A and 5B.

The risk calculation unit 140 may select the application ratio of each of the vulnerability items in response to the input selection signal at step S240. The risk value calculation unit 140 may calculate an asset value, a vulnerability calculation unit The vulnerability value calculated by the threat calculation unit 130 and the application ratio may be used to calculate the risk value (S250). The selection signal may be a signal inputted through an input means such as a keyboard, a mouse, a touch pad, or the like, and may be a signal capable of selecting a different application ratio according to the importance of the corresponding vulnerability item. The risk calculator 140 may calculate the risk value by calculating the threat value and the asset value by reflecting the application rate selected in response to the selection signal to the vulnerability value. A method of selecting the application rate and a method of calculating the risk value will be described in detail with reference to FIGS. 6A to 7.

The determination unit 150 compares the risk value calculated by the risk calculation unit 140 with a reference value and determines that the corresponding vulnerability item is a management target when the risk value is equal to or greater than the reference value (S260). The reference value may be a preset value, a value input through the input means, or a value that is a criterion for determining whether the vulnerability item is to be managed.

The statistic value calculating unit 160 may calculate the vulnerability score using a ratio of a sum of all the maximum values that the vulnerable values have for each of the assets and a sum of the calculated vulnerabilities for each of the assets . Alternatively, the statistic value calculating unit 160 may calculate the risk score using a ratio of a sum of all the maximum values that the risk values can have for each of the assets and a sum of the calculated risk values for each of the assets . The statistical value calculator 160 operates to provide a statistical value to the user, and the operation of the statistical value calculator 160 will be described in more detail with reference to FIGS. 8 and 9. FIG.

3A and 3B are diagrams for explaining the operation of the asset value calculation unit 110 of FIG.

Referring to FIGS. 1 to 3B, an asset class 310 may be input for each asset, and 310 of FIG. 3A may be an input grade for availability, integrity, and confidentiality in order from the left. When the asset class 310 is input in this manner, the asset value calculation unit 110 can calculate the asset value quantified using the input asset class 310 and the asset class table 115 shown in FIG. 3B. For example, when the availability, integrity, and confidentiality levels are all entered as 'High' as shown in FIG. 3A, the asset value calculation unit 110 uses the asset value table 115 of FIG. 3B, ), The asset value of the asset at the point where the availability, integrity, and confidentiality ratings are all 'High' can be set as the asset value of the asset. Referring to the class on the left side of FIG. 3B, the class 320 of the asset value may be set to 'High'. 3A and 3B are merely examples for explaining the asset value calculation unit 110 of the present invention. In the asset class table 115, the relation between the grade of availability, integrity and confidentiality and the asset value is different It may be set to the form. The relationship between the availability level, integrity level, and confidentiality level of the asset level table 115 and the asset value may be set using information input from the outside or predetermined for each asset. In this way, the asset value calculation unit 110 can set asset values for all of the assets.

4A and 4B are diagrams for explaining the operation of the vulnerability calculation unit 120 of FIG.

Referring to FIGS. 1 to 4B, a vulnerability level 410 may be input for each vulnerability item set for each asset, and the level 410 of FIG. 4A may be an input rating for severity and exposure . When the vulnerability class 410 is input as described above, the vulnerability calculation unit 120 can calculate the weakened value quantified using the vulnerability class 410 as shown in FIG. 4B and the vulnerability class table 125 as shown in FIG. 4B. For example, when the degree of severity is 'Low' and the degree of exposure is 'Middle' as shown in FIG. 4A, the vulnerability table 120 shown in FIG. The weakness value of the vulnerability item can be set to two points, which is the vulnerability value at the point where the severity level is 'Low' and the exposure level is 'Middle'. And referring to the class on the left side of FIG. 4B, the class 320 of the weak value may be set to 'Low'. 4A and 4B are merely examples for explaining the vulnerability calculating unit 120 of the present invention, and the vulnerability table 125 sets the severity and the degree of vulnerability to the vulnerability value in a different form . The relationship between the severity and the degree of vulnerability and the vulnerability value of the vulnerability class table 125 may be set using information input from the outside or preset for each vulnerability item. In this way, the vulnerability calculating unit 120 can set vulnerable values for all the vulnerability items by the asset.

5A and 5B are diagrams for explaining the operation of the threat calculation unit 130 of FIG.

Referring to FIGS. 1 to 5B, a threat grade 510 may be input for each vulnerability item set for each asset, and 510 of FIG. 5A may be an input rating for the influence. When the influence class 510 is input in this way, the threat calculation unit 130 can calculate the threat value quantified using the input influence class 510 and the threat grade table 135 of FIG. 5B. For example, when the influence level is inputted as 'Middle' as shown in FIG. 5A, using the threat level table 135 shown in FIG. 5B, the threat level calculation unit 130 calculates the degree of influence The threat value of the 'Middle' point can be set as the threat value of the vulnerability item. Referring to the left side of FIG. 4B, the threat level 520 may be set to 'Middle'. 5A and 5B are merely examples for explaining the threat calculation unit 130 of the present invention. The threat level table 135 may be configured such that the relationship between the level of the influence and the threat value is set differently It is possible. The relationship between the level of influence of the threat level table 135 and the threat value may be set using information input from the outside or may be set in advance for each vulnerability item. In this way, the threat calculation unit 130 can set the threat values for all of the vulnerability items by the asset.

6A and 6B are diagrams for explaining the operation of the risk calculation unit 140 of FIG. 1, and FIG. 7 is a diagram for explaining an embodiment of calculating the risk value by the risk calculation unit 140 of FIG. 1 to be.

Referring to FIGS. 1 to 7, the risk calculation unit 140 calculates a risk value using the asset value calculated by the asset value calculating unit 110, the vulnerability calculating unit 120, and the threat calculating unit 130, Value and the threat value can be used to calculate the risk value. 6A to 610 show an example of the vulnerability value calculated by the vulnerability calculation unit 120 for each of the vulnerability items, and 620 is a graph showing an example of the vulnerability value calculated by the threat value calculation unit 130 for each of the vulnerability items FIG. Since the vulnerability items shown in FIG. 6A are vulnerability items for one asset, the asset values calculated by the asset value calculation unit 110 in relation to the vulnerability items in FIG. 6A may all have the same value.

FIG. 6B is a diagram illustrating a case where the application ratio 630 is selected in FIG. 6A, a value 640 reflecting the application ratio to the vulnerability value 610 is calculated, and the risk value 650 is calculated. In other words, the risk calculation unit 140 can select the application ratio 630 of each of the vulnerability items in response to the input selection signal. In FIG. 6B, the selection signal is 'O', 'X' As shown in FIG. 6B, the application ratio is 100% when the selection signal is' 0 ', the application ratio is 0% when the selection signal is' X', the application ratio is 50% when the selection signal is' However, the present invention is not limited to this case, and it is also possible to set the selection signal so as to select another application ratio as needed. The risk calculation unit 140 may obtain the value 640 by reflecting the selected application ratio 630 to the weak point value 610 according to the vulnerability item. According to this method, the user can set different weights to the vulnerable values according to the importance of each of the vulnerability items, thereby providing the user with the priority of the managed object according to the risk.

The risk calculation unit 140 calculates the value 640 reflecting the application ratio 630 to the vulnerability value 610, the threat value 620 and the asset value calculated as described above, The risk value 650 can be calculated and the rating can be set. One embodiment for calculating the risk value 650 in the risk calculation unit 140 is the same as that shown in Fig. For example, the risk calculation unit 140 may be a value obtained by multiplying the weak value 610, the application ratio 630, and the threat value 620 by the vulnerability item and the asset value, The natural number is assumed to be '4' in FIG. 7, but the present invention is not necessarily limited to this case. In addition, as shown in FIG. 7, the asset value is not always added to the value obtained by multiplying the vulnerability value, the application ratio, and the threat value, and the risk value may be calculated through other operations as needed.

In FIG. 7, a portion indicated by 'DoA' corresponds to the reference value, and the risk calculation unit 140 may compare the risk value with the reference value to determine whether the vulnerability item is a management target. For example, when the reference value is '5' as shown in FIG. 7, in the embodiment of FIG. 6B, the risk calculating unit 140 calculates the number of vulnerability items (No. 1, 4, 6, and 10) can be determined as objects to be managed. The higher the risk value, the more the objects to be managed can be determined.

8 and 9 are views for explaining the operation of the statistical value calculating unit 160 of FIG.

1 to 9, the statistic value calculating unit 160 may calculate the vulnerability score 810 using the vulnerabilities calculated for each asset, or may calculate the risk score 820 using the risk value calculated for each asset, ), Or calculate the total risk score 910 using the asset value, the vulnerability score, and the risk score for the entire assets.

For example, the statistic value calculator 160 may calculate the vulnerability score using a ratio of a sum of the maximum values that the vulnerable values can have for each of the assets and a sum of the calculated vulnerabilities for each of the assets Can be calculated. In the case of FIG. 8, the statistic value calculation unit 160 calculates a sum 811, which is a sum of the maximum values that the vulnerable values can have for each of the assets, as a denominator and adds the calculated weakened values The vulnerability score 810 can be calculated by converting a value obtained by subtracting the value 815 as a numerator as a percentage. The statistic value calculating unit 160 may calculate the risk score using a ratio of a sum of all the maximum values that the risk values can have on the respective assets and a sum of the calculated risk values for each of the assets have. In the case of FIG. 8, the statistic value calculating unit 160 calculates a statistic value 821, which is a sum 821 of all the maximum values that the risk values can have, The risk score 820 can be calculated by converting the value obtained by subtracting the value 825 from the numerical value as a percentage. In addition, the statistic value calculating unit 160 may calculate the total risk score 910 using the asset value, the vulnerability score, and the risk score for the entire assets as shown in FIG.

The operation and the statistic value calculation unit 160 of the statistic value calculation unit 160 described above are only examples of the present invention and the statistical value calculation unit 160 of the present invention It is not necessary to perform the above operation, but it is possible to calculate the statistical value by using other statistical methods as necessary.

As described above, an optimal embodiment has been disclosed in the drawings and specification. Although specific terms have been employed herein, they are used for purposes of illustration only and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will appreciate that various modifications and equivalent embodiments are possible without departing from the scope of the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (13)

An asset value calculation unit for calculating an asset value by converting the asset class inputted by each asset into a numerical value using an asset class table;
A vulnerability calculating unit for calculating a vulnerability value by quantifying the vulnerability rating inputted for each vulnerability item set for each asset using the vulnerability rating table;
A threat calculation unit for calculating a threat value by quantifying the inputted threat grade for each of the vulnerability items set for each asset using a threat grade table; And
The method of claim 1, further comprising: selecting an application rate for each vulnerability item set for each asset in response to the input selection signal; calculating a risk value by calculating the threat value and the asset value, And a calculating unit for calculating a risk of the risk. The method of claim 1,
An input rating for each of the availability, integrity and confidentiality of the asset,
The asset class table includes:
And a relationship between the rating of availability, integrity and confidentiality and the asset value is set for each of the assets. The method of claim 1,
The degree of vulnerability is classified according to the vulnerability item,
The vulnerability rating table includes:
Wherein a relationship between the degree of vulnerability and severity and the vulnerability value is set for each of the vulnerability items. The method according to claim 1,
A rating inputted for the influence of each item of the vulnerability,
The threat level table includes:
And a relationship between the rating of the influence and the threat value is set for each of the vulnerability items. The risk assessment system according to claim 1,
Wherein the risk value is calculated by dividing the value obtained by multiplying the vulnerability value, the application ratio, and the threat value by the asset value, and dividing the value by a natural number. The risk assessment system according to claim 1,
And selects an application ratio of one of 100%, 50%, and 0% in response to the selection signal. The risk assessment system according to claim 1,
Further comprising a determination unit for comparing the risk value with a reference value and determining that the corresponding vulnerability item is a management subject if the risk value is greater than or equal to the reference value. The method of claim 1,
Data, documents, software, servers, networks, information protection systems, PCs and laptops, other media, additional facilities and additional facilities. The risk assessment system according to claim 1,
The vulnerability score is calculated using the vulnerabilities calculated for each asset or the risk score is calculated using the risk value calculated for each asset, or the asset value, the vulnerability score, and the risk score And calculating a total risk score based on the total score calculated by the total score calculating unit. The apparatus according to claim 9,
The vulnerability score may be calculated using a ratio of a sum of the maximum values that the vulnerabilities may have to the sum of the calculated vulnerabilities for each of the assets, And calculating the risk score using a ratio of a value obtained by summing all the maximum values and a sum of the calculated risk values for each of the assets. Setting an asset value by converting the asset class input by each asset into a numerical value using an asset class table;
Setting a weak value by quantifying the vulnerability class inputted for each vulnerability item set for each asset using a vulnerability class table;
Setting a threat value by quantifying the threat grade inputted for each of the vulnerability items set for each asset using a threat grade table;
Selecting an application rate for each of the vulnerability items set for each asset in response to the input selection signal; And
And calculating a risk value by calculating a value reflecting the application rate to the vulnerable value, the threat value, and the asset value. 12. The method of claim 11, wherein the setting of the asset value comprises:
Setting the asset value using the input grade and the asset grade table for each of availability, integrity and confidentiality of the asset,
The step of setting the weak value comprises:
Setting the vulnerability value using the vulnerability rating table and the vulnerability rating table for each of the vulnerability items,
Wherein the setting of the threat value comprises:
Setting the threat value using the input grade and the threat grade table for each of the vulnerability items,
The step of calculating the risk value includes:
And calculating a value obtained by multiplying the vulnerability value, the application ratio, and the threat value, and then adding the asset value plus a natural number to the risk value. The risk assessment method according to claim 11,
Comparing the risk value with a reference value, and determining that the corresponding vulnerability item is a management subject if the risk value is greater than or equal to the reference value.

Images