KR20170024428A - Network security system and a method thereof - Google Patents

Abstract

The present invention relates to a network security system which comprises: a plurality of user terminals using an internal network; a system server configured to store a plurality of major information or document information generated from at least one of the plurality of user terminals; a manager terminal and a user terminal configured to manage the plurality of user terminals; and a security server configured to protect the manager terminal and the system server.

Description

[0001] NETWORK SECURITY SYSTEM AND A METHOD THEREOF [0002]

The present invention relates to a network security system security method, and more particularly, to a network security system and a security method capable of coping with an unknown unknown hacking risk.

Cyber attacks are organized and intelligent. Especially, APT (Intelligent Sustainable Threat) attack, which is a hacking organization for economic purposes and conducts covert and continuous intelligent attacks on specific attack targets, And it is becoming a serious social problem. In particular, the APT attack is the attack of hackers or hacking organizations to infiltrate malicious code into the attacking organization in order to illegally extract important information of the organization, then infecting the host of important information access authority with malicious code through continuous updating of malicious code , An attack method to leak important information.

In Korean Patent No. 10-0635130 ("Kernel Backdoor Detection System and Method Using Window Network Monitoring"), network packets passing through TDI (Transport Driver Interface) layer and NDIS (Network Driver Interface Specification) And detects the kernel backdoor by separating the network packets generated from the normal network activity and the network packets generated from the malicious network behavior such as the kernel backdoor and filters the network packets generated from the kernel backdoor Discloses a system and method for detecting a kernel backdoor that can prevent an intrusion caused by a kernel backdoor.

However, Korean Patent Registration No. 10-0635130 is a technique limited to prevent intrusion into a kernel backdoor, and does not disclose a technique for preventing document leakage or hacking through terminals connected to a system server or an internal network.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide a method and system for performing an operation system patch, an application patch, a software distribution and a medium control for effective defense of a client system, which is a primary attack target of APT (Advanced Persistent Threat) And to provide a network security system and a security method capable of responding to an unknown hacking threat by applying the technology.

Another problem to be solved by the present invention is to provide a network security system and security system capable of recognizing key information or document information leakage and removing risk elements by protecting and monitoring user and manager clients accessing key information or document information Method.

According to an aspect of the present invention, there is provided an information processing system including a plurality of user terminals using an internal network, a system server storing a plurality of pieces of important information or document information generated by at least one of the plurality of user terminals, And a security server for protecting the user terminal, the administrator terminal and the system server, the security server comprising: a security server for managing important documents to be attacked from external hacking among the plurality of important information or document information, A preventive control module for analyzing a risk element of the important document and setting an access restriction of the plurality of user terminals from external hacking servers known to control the external access; And a log file of a user terminal that has generated network traffic for accessing the important document is stored. When an abnormal behavior including hacking is monitored in the user terminal, A detection control module for terminating the detection module; And a restoration control module for restoring the backup system image when the abnormality of the plurality of user terminals is monitored, when the abnormality of the plurality of user terminals is monitored, And the like.

The prevention control module evaluates the importance of the main information or the document information by giving a score of confidentiality, integrity and availability of the plurality of important information or document information, and evaluates the importance of the information asset And an evaluation unit.

The preventive control module analyzes and detects a risk factor for a document having a high degree of importance among the key information or document information and performs a security check on all the important information or document information when the risk factor is detected And may further include an analysis section.

The prevention control module may further include a control policy management unit for sending a security announcement to the user terminal through the administrator terminal and for allowing the user terminal to feedback the security notice.

Wherein the prevention control module comprises: a terminal authentication unit for authenticating the user terminal using at least one authentication factor of the user ID and the OTP, the public key certificate, the ARS, and the QR code; A user terminal that has been authenticated by the terminal authentication unit accesses an external network through a C & C (Command & Control) server during the service, or monitors and manages the C & C server accessing the system server through the user terminal A server management unit; A user terminal controlling access to the P2P server or the harmful site, and when accessing the important information from the user terminal, checking the access time and the port to the user terminal in order to check whether the access is permitted or unauthorized access A server access control unit for sending an alert message to the administrator terminal after determining that the intruder or hacker is from an external server when there is no response to the notification message after sending the notification message; And a network traffic analyzing unit for collecting network traffic generated by the user terminal and setting a path.

Wherein the calibration control module includes: a TCP tagging and recognizing unit for tagging a unique ID in a network traffic or a network packet generated in the user terminal; A security agent management unit monitoring an installation of a security agent installed in the user terminal and transmitting the security agent to a user terminal that the security agent has not installed; A user terminal control unit for determining that the user information is an external attack when accessing the main information or document information without performing authentication at the user terminal and blocking access to the system server; And a system restoring unit for storing the backup image of the infected user terminal and restoring the infected user terminal to a pre-infection state, when it is determined that the user terminal is infected with at least one of the virus, malicious code, and spyware.

According to another aspect of the present invention, there is provided an information processing system including a plurality of user terminals using an internal network, a system server storing a plurality of pieces of important information or document information generated by at least one of the plurality of user terminals, A security method performed in a security server for protecting a user terminal, an administrator terminal, and a system server, the security method comprising the steps of: (a) defining a control policy for controlling access to an external network or an unconfigured server; (b) an authentication step of performing authentication for permitting access to the system server to perform a task in the user terminal; (c) monitoring access to the main server, the C & C server, the P2P server, and the harmful site at the user terminal when performing the service of the user terminal in the security server, and checking whether the user policy violates the control policy; (d) notifying the administrator terminal when the security policy violates the security policy; (e) blocking the network of the user terminal in violation of the control policy in the security server; (f) storing a backup image of the user terminal in violation of the control policy in the security server; (g) recovering the user terminal through the backup image at the security server; And (h) performing digital forensics from the backup image at the security server.

Prior to step (a), scores of confidentiality, integrity, and availability of a plurality of pieces of important information or document information stored in the system server are assigned to evaluate the importance of the main information or document information, Managing information; And analyzing and detecting a risk factor for a document having a high degree of importance among the main information or document information and performing a security check on all the main information or document information when the risk factor is detected .

The step (b) may be performed using at least one authentication factor of the user ID and the OTP, the authentication certificate, the ARS, and the QR code of the user terminal.

After the step (h), the digital forensic result may be reflected in the control policy.

The network security system and the security method according to the embodiment of the present invention may be implemented as an operating system patch, an application patch, a software distribution, and a media control for effective defense of a client system, which is a primary attack target of APT (Advanced Persistent Threat) In the event of suspected intrusion, recovery techniques can be applied to address unknown hacking threats.

Further, security can be enhanced through two-factor authentication when recognizing a user terminal, and information used in authentication can be protected by making a channel for authentication different from that of a service channel.

1 is a system diagram schematically illustrating a network security system according to an embodiment of the present invention;
FIG. 2 is a block diagram showing an internal configuration of the security server shown in FIG. 1. FIG.
3 is a block diagram showing the configuration of the preventive control module shown in FIG.
4 is a block diagram illustrating the detection control module shown in FIG. 2;
FIG. 5 is a block diagram showing the calibration control module shown in FIG. 2. FIG.
6 is a flowchart illustrating a network security method according to an embodiment of the present invention.

Hereinafter, the description of the present invention with reference to the drawings is not limited to a specific embodiment, and various transformations can be applied and various embodiments can be made. It is to be understood that the following description covers all changes, equivalents, and alternatives falling within the spirit and scope of the present invention.

In the following description, the terms first, second, and the like are used to describe various components and are not limited to their own meaning, and are used only for the purpose of distinguishing one component from another component.

Like reference numerals used throughout the specification denote like elements.

As used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. It is also to be understood that the terms " comprising, "" comprising, "or" having ", and the like are intended to designate the presence of stated features, integers, And should not be construed to preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1 to 6 attached hereto.

1 is a system diagram schematically illustrating a network security system according to an embodiment of the present invention.

Referring to FIG. 1, a network security system according to an embodiment of the present invention may include a user terminal 10, an administrator terminal 20, a security server 40, and a system server 30.

Specifically, the user terminal 10 may include a terminal used in a company, a school, an institution, etc., a computer, a notebook, and a smart phone.

The administrator terminal 20 may include a terminal such as a computer such as the user terminal 10, a notebook computer, a smart phone, and the like.

The system server 30 is connected to the user terminal 10 through an internal communication network and can store a plurality of pieces of important information or document information generated in the user terminal 10. [ The system server 30 can provide the usage environment of the user terminal 10 to be connected.

The security server 40 evaluates the importance of a plurality of pieces of important information or document information and sets an access right for each importance. For example, the security server 40 evaluates the importance of key information or document information by giving scores on confidentiality, integrity, and availability of a plurality of pieces of important information or document information, and assigns the evaluated important information or document information to the importance Make different access rights accordingly.

In addition, the security server 40 analyzes the risk factors and controls access to critical information or document information having a risk. The security server 40 controls access to key information or document information of the user terminal 10 according to the authority for access control of key information or document information.

The security server 40 registers an external server used for hacking and protects the user terminal 10 from accessing an external server that is a main route of hacking in order to protect key information or document information from external external hacking Or to access the user terminal 10 from an external server.

To this end, the security server 40 monitors the network traffic of the user terminal 10. The security server 40 stores the log file of the user terminal 10. When the abnormal operation including hacking through the user terminal 10 is monitored, the security server 40 terminates the task of the user terminal 10, ).

At this time, the security server 40 may generate and store a backup image of the user terminal 10, restore the backup image, and provide the backup image to the user terminal 10.

The security server 40 may update the risk factor for the risk of the hacking server or the like connected via the user terminal 10 prior to restoring the backup image and notify the user terminal 10 of the risk.

The security server 40 will be described in detail with reference to FIGS. 2 to 5. FIG.

FIG. 2 is a block diagram showing the internal configuration of the security server shown in FIG. 1, FIG. 3 is a block diagram showing the configuration of the preventive control module shown in FIG. 2, FIG. 5 is a block diagram illustrating the calibration control module shown in FIG. 2. Referring to FIG.

2 to 5, the security server 40 may include a prevention control module 100, a detection control module 200, and a calibration control module 300.

First, the prevention control module 100 may include an information asset evaluation unit 110, a risk analysis unit 120, and a control policy management unit 130.

Specifically, the information asset evaluation section 110 evaluates importance of a plurality of main information or document information. The information asset evaluation unit 110 evaluates the importance of key information or document information by giving scores on the confidentiality, integrity and availability of a plurality of pieces of important information or document information according to preset criteria. For example, the information asset evaluation unit 110 may classify major information or document information stored in the system server 30 into upper, middle, lower, or A, B, C, ... or 1, 2, ... and so on. For example, confidentiality is set high for personal information, financial information, and the like, and confidentiality is set relatively low for documents such as general business documents.

Then, the information asset evaluation unit 110 evaluates whether or not the document having the confidentiality evaluation is defective. Whether or not the document is defective is determined by classification such as confidentiality evaluation through whether the virus or malicious code is infected, whether the document is terminated or not, and whether it is encrypted. In addition, the information asset evaluation unit 110 sets a rating such as confidentiality evaluation on the availability of key information or document information.

The information asset evaluation unit 110 sets a rating by combining the confidentiality, integrity, and availability. The information asset evaluation unit 110 distinguishes major information or document information having a high overall grade and major information or document information having a low overall grade.

The information asset evaluation unit 110 may change the access right when accessing from the user terminal 10 or the administrator terminal 20 according to the rank of the main information or the document information. For example, when the level of the main information or the document information is high, access from the user terminal 10 is disabled, and access from the administrator terminal 20 is possible. In addition, when the level of the main information or the document information is lowered, the user terminal 10 can access the information.

The risk analysis unit 120 analyzes a vulnerability of the network or a vulnerability of key information or document information. The risk analysis unit 120 analyzes the potential risk factors of the main information or the document information using the vulnerability analysis tool and detects a new vulnerability in the administrator terminal 20 so as to perform a security check on the new vulnerability if it is found in the new vulnerability Provide information about

In addition, the risk analysis unit 120 may store a history related to the vulnerability checking and vulnerability detection information of the potential risk element, and may provide such a history to the administrator terminal 20.

The risk analysis unit 120 may provide vulnerability information or history provided to the administrator terminal 20 in a graph, a graphic form, a numerical value, or the like so as to visually recognize the vulnerability information or history.

The control policy management unit 130 controls access to the unauthorized web server of the user terminal 10 or the administrator terminal 20 in order to control access to the main information or document information. For this, the control policy management unit 130 sets the URL information of the connectable web server or the blocked web server in advance. The control policy management unit 130 may notify the user terminal 10 or the administrator terminal 20 to block the connection when accessing the URL of the web server disconnected from the user terminal 10 or the administrator terminal 20. [

In addition, the control policy management unit 130 may force the security announcement to the user terminal 10. For example, when the security policy management unit 130 transmits a security notice in the form of a web page from the administrator terminal 20 to the user terminal 10, the control policy management unit 130 blocks the connected web page of the user terminal 10, Page. ≪ / RTI >

The control policy management unit 130 transmits the security notice sent to the user terminal 10 to the administrator terminal 20 or the control policy management unit 20 in order to determine whether the user terminal 10 confirms the security notice sent from the administrator terminal 20. [ The control unit 130 may feed back the feedback signal.

Prevention control module 100 may include a terminal authentication unit 210, a server management unit 220, a server access control unit 230, and a network traffic analysis unit 240.

Specifically, the terminal authentication unit 210 may perform connection authentication of the system server 30 for the tasks of the user terminal 10 or the administrator terminal 20. At this time, the terminal authentication unit 210 may use a two factor authentication method that can authenticate using two or more authentication elements. For example, the terminal authentication unit 210 performs the primary authentication when the ID and the password are input from the user terminal 10 or the administrator terminal 20, and when the primary authentication is completed, Secondary authentication is performed by using public certificate, ARS, QR code, etc. This makes it possible to enhance the access security of the terminal.

At this time, it is preferable that the terminal authentication unit 210 performs authentication on a separate channel, and the authentication channel does not use any other service. Accordingly, the user terminal 10 or the administrator terminal 20 can fundamentally block the risk of an attacker's account hijacking during authentication.

When authentication is completed in the terminal authentication unit 210, the terminal authentication unit 210 notifies the system server 30 of the authentication and access from the user terminal 10 or the administrator terminal 20 to the system server 30.

The server management unit 220 manages an IP list of a C & C (Command & Control) server serving as a host of an intelligent target persistent attack (APT) and collects and analyzes related information. The server management unit 220 periodically updates the list of the new C & C servers provided as RSS services and accesses the user terminal 10 or the administrator terminal 20 through the C & C server or the user terminal 10 or the user terminal 10 through the C & It is possible to manage the connection of the administrator terminal 20 to the system server 30.

The server access control unit 230 can control access of the user terminal 10 or the administrator terminal 20 to the P2P server or the harmful site. The server access control unit 230 can control the access to the harmful site by using the URL information of the P2P server or the harmful site set in advance. At this time, the server access control unit 230 controls access to P2P servers or harmful sites other than the C & C server access.

When accessing the main information or the document information at the terminals, the server access control unit 230 transmits a notification message for determining the connection time and the port to the terminals in order to confirm whether the access is permitted or unauthorized access.

At this time, if there is no reply to the notification, the server access control unit 230 determines that it is an intrusion of the external server and transmits a warning message using the phone number, messenger, e-mail, etc. set in the administrator terminal 20 .

In addition, the server access control unit 230 detects the access to the main information or the document information at the user terminal 10, and notifies the administrator terminal 20 of the detection.

The network traffic analyzing unit 240 collects all the network traffic generated by the user terminal 10 and stores the path. In this case, when the connection of the main information or the document information which is not permitted in the user terminal 10 is monitored, the network traffic analyzing unit 240 analyzes the port, service active state, main window log And so on.

On the other hand, the network traffic analyzing unit 240 may not perform packet monitoring on a site or a server registered in advance using the dictionary matching of URL and IP.

Meanwhile, the network traffic analyzing unit 240 can monitor the secret packets transmitted through the encrypted communication for the detection of the IP-based C & C server.

The calibration control module 300 may include a TCP packet tagging and recognizing unit 310, a security agent managing unit 320, a central document managing unit 330, a user terminal controlling unit 340, and a system restoring unit 350.

Specifically, the TCP packet tagging and recognizing unit 310 may tag the unique IDs in all the TCP packets generated by the user terminal 10 in order to distinguish the network packets generated in the user terminal 10 using the router of the internal network have. Accordingly, the TCP packet tagging and recognizing unit 310 can classify the TCP packets and can easily analyze the network traffic collected by the network traffic analyzing unit 240.

The security agent management unit 320 monitors the installation of a security agent (for example, a security program or an anti-virus program) installed in the user terminal 10 and notifies the security agent To the user terminal (10).

Also, the security agent management unit 320 proceeds to update the latest version to the security agent installed in the user terminal 10.

The central document management unit 330 uses the file system driver to store the document processed in the user terminal 10 in the system server 30. Here, the file system driver may be a document creation standard file system of the user terminal 10. [

When accessing the main information or document information from the unauthorized user terminal 10, the user terminal control unit 340 determines that the attack is an external attack and transmits the network of the user terminal 10 to the main medium (system server, etc.) Access can be blocked. The user terminal control unit 340 accesses the user terminal 10 and forcibly terminates execution of a process or program classified as a dangerous element such as malicious code, spyware, virus, spybot, or the like, Can be prevented. The user terminal control unit 340 generates and transmits a one-time password so that the system server 30 can access the user terminal 10 in which the risk factor is not found, and transmits the one-time password to the system server 30 Allow access.

When it is determined that the user terminal 10 is infected with a virus, a malicious code, a spyware, or a spybot, the system restoring unit 350 stores a backup image of the corresponding user terminal.

The system restoring unit 350 restores the user terminal 10 to a state before infection with viruses, malicious codes, spyware, spybots, and the like. At this time, the system restoring unit 350 may perform digital forensic and notify the control policy management unit 130 of the forensic result.

6 is a flowchart illustrating a network security method according to an embodiment of the present invention.

Referring to FIG. 6, a network security method according to an exemplary embodiment of the present invention includes defining a control policy in a prevention control module of a security server (S150), performing authentication of a user terminal (S220) (S297) of monitoring the access of the main server, the C & C server, the P2P server, and the harmful site in the user terminal, checking whether the control policy is violated (S297), notifying the administrator terminal of the control policy violation , Blocking the network of the user terminal (S320), storing the image for the forensic process (S330), recovering the image (S340), forensic step (S335), and reflecting the control policy for the forensic result (S357) can do.

Specifically, the step of defining a control policy (S150) is a step performed in the prevention control module 100. [ Prior to the step of defining the control policy (S150), the information asset operation impact evaluation step (S110), the step of identifying the important assets (S120), the risk analysis step (S130) and the vulnerability analysis step (S140) are preceded.

The information asset operation impact evaluation step (S110) and the step of identifying the important assets (S120) evaluate the importance of important information or document information stored in the system server (30) according to the set criteria and identify the important asset according to the importance . As described above, the importance of the main information or the document information is evaluated by the information asset evaluation section 110 to evaluate the confidentiality, integrity and availability of key information or document information. At this time, high-level key information or document information is classified as important assets.

Next, the risk analysis step (S130) and the vulnerability analysis step (S140) analyze vulnerability of the internal network or vulnerability of key information or document information in the prevention control module (100). At this time, vulnerability analysis tools or programs are used to analyze the potential risks of key information or document information. In the risk analysis step (S130), if a risk element of the main information or the document information is found, the security check is performed and the administrator terminal (20) is notified of the risk.

The step of defining the control policy (S150) defines the URL of the accessible server and the URL of the prohibited server in order to control the access of the main information or the document information. Accordingly, when a user terminal or an administrator terminal accesses a URL of a server that is prohibited from accessing, it is possible to terminate the task performed by the user terminal 10 or the administrator terminal 20.

In addition, defining a control policy (S150) may include enforcing the security announcement to the user terminal (10). At this time, the preventive control module 100 instructs the administrator terminal 20 to transmit the security notice to the user terminal 10, and the user terminal 10 receiving the security notice blocks the connected web page, And can be connected to a known web page.

Performing the authentication of the user terminal (S220) performs 2 factor authentication in advance when the user terminal 10 accesses the system server 30. At this time, the two-factor authentication performs the primary authentication through the user ID and the password as described above, and performs the secondary authentication using the additional authentication means (for example, OTP, authorized certificate, ARS, QR code, etc.) do.

At this time, if the two-factor authentication is not performed, the user terminal 10 may be prevented from accessing the system server 30 or the user terminal 10 may be terminated (S225).

The authenticated user terminal 10 may store important information or document information generated after the job in the system server (S230, S235). In addition, the user terminal 10 may receive the main security notice from the administrator terminal 20 (S240). The administrator terminal 20 or the system server 30 can store the corresponding confirmation log. The user terminal 10 receives the security agent from the user terminal control unit 340 and performs a security check in the user terminal 10 (S250). At this time, the security agent is periodically updated. Thereafter, the result of the security check may be stored in the system server 30 or the security server 40 (S255). After the security check, the user terminal 10 can continue the task execution (S260).

Meanwhile, the detection control module 200 monitors an abnormal behavior from the user terminal 10 during the service of the user terminal 10 (S270). At this time, if the abnormal operation is not detected in the user terminal 10, the normal operation is performed and the operation ends after the operation is performed. Here, after the job is completed, the calibration control module 300 checks whether there is a security patch sent to the user terminal 10 (S350). As a result of checking the security patch, if there is no need for a security patch, the window of the user terminal 10 can be finally terminated. And stores an image of the user terminal 10 when a security patch is required. Then, a security patch is installed in the user terminal 10 (S370), and a log file of the installation information is stored. Subsequently, after storing the system image of the user terminal 10 (S375), the system image is restored (S360).

If the abnormal operation is monitored in the detection control module 200, the main server connection is confirmed (S275). At this time, the information about the main server may be a URL or an IP address of a predetermined server.

If it is determined that the main server connection is established, the detection control module 200 sends a user confirmation notice message to the corresponding user terminal (S280). In addition, authentication is requested to the user terminal 10 (S300). The above-described two-factor authentication can be performed for authentication with the user terminal 10. At this time, the user terminal 10 and the security server 40 can perform authentication through a dedicated channel for authentication. When the authentication is completed, the task execution is continued (S260).

However, if the authentication is not confirmed, the administrator terminal 20 is notified and the log file is stored for restoring the system image of the user terminal (S310).

If it is determined that the main server connection is not established, the detection control module 200 checks whether the C & C server is accessed (S290). In addition, if the C & C server access is not confirmed, the P2P server access is confirmed (S295). If P2P server access is not confirmed, P2P server access is confirmed (S299). If it is confirmed through C & C server, P2P server or harmful site access as above, it is determined whether the policy is violated (S297). At this time, if the detection control module 200 determines that the policy of the user terminal 10 is violated, it notifies the administrator terminal 20 and stores the log file (S310).

Then, the network of the user terminal is blocked (S320).

Thereafter, the system image of the user terminal 100 is stored for the forensic operation (S330). At this time, for the digital forensic operation of the user terminal 10, the final system overall image of the user terminal is stored.

Next, the system image of the user terminal 10 is recovered using the stored image (S340).

Thereafter, the digital forensic process of the user terminal 10 is performed (S335), and the control policy for the digital forensic result is reflected (S357).

The security server described above may be combined with the system server, and may be an OS or a program operating in the system server.

In addition, although the terminal authentication unit has been described as being included in the detection control module, the terminal authentication unit is not limited thereto, and may be included in the calibration control module or the system server.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, It will be understood. The embodiments described above are therefore to be considered in all respects as illustrative and not restrictive.

10: User terminal
20:
30: System server
40: security server
100: Preventative Control Module
110: Information Asset Evaluation Department
120: Risk Analysis Department
130: Control Policy Management Department
200: Detection Control Module
210:
220:
230: Server Access Control Section
240: Network traffic analysis unit
300: Calibration control module
310: TCP packet tagging and recognition unit
320: Security Agent Management
330: central document management unit
340: User terminal control unit
350:

Claims (10)

A system server for storing a plurality of pieces of important information or document information generated by at least one of the plurality of user terminals, an administrator terminal for managing the plurality of user terminals, 1. A network security system comprising a security server for protecting a terminal and a system server,
The security server
Identifying a critical document to be attacked from an external hacking among the plurality of pieces of important information or document information, analyzing a risk element in the important document, extracting, from external hacking servers known to control the external access, A preventive control module configured to restrict access to the terminal;
And a log file of a user terminal that has generated network traffic for accessing the important document is stored. When an abnormal behavior including hacking is monitored in the user terminal, A detection control module for terminating the detection module; And
A calibration control module that generates and stores a backup system image when the plurality of user terminals are connected to the system server and performs a restoration operation through the backup system image when the abnormality of the plurality of user terminals is monitored, Includes a network security system.
The method according to claim 1,
The preventative control module
A network that includes an information asset evaluation unit that evaluates the importance of the main information or the document information by giving a score of confidentiality, integrity, and availability of the plurality of important information or document information, and performs information management according to the evaluated importance, Security system.
3. The method of claim 2,
The preventative control module
Further comprising a vulnerability analysis unit for analyzing and detecting a risk factor for a document having a high degree of importance among the main information or document information and performing a security check on all major information or document information when the risk factor is detected Network security system.
The method of claim 3,
The preventative control module
Further comprising a control policy management unit for sending a security announcement to the user terminal through the administrator terminal and for allowing the user terminal to feedback whether the security notice is read or not.
The method according to claim 1,
The preventative control module
A terminal authentication unit for authenticating the user terminal using at least one authentication factor, the user ID of the user terminal and the OTP, the public key certificate, the ARS, and the QR code;
A user terminal that has been authenticated by the terminal authentication unit accesses to an external network through a C & C (Command & Control) server during a task, or monitors and manages the connection of the C & C server to the system server through the user terminal Management;
A user terminal controlling access to the P2P server or the harmful site, and when accessing the important information from the user terminal, checking the access time and the port to the user terminal in order to check whether the access is permitted or unauthorized access A server access control unit for sending an alert message to the administrator terminal after determining that the intruder or hacker is from an external server when there is no response to the notification message after sending the notification message; And
And a network traffic analyzing unit for collecting network traffic generated by the user terminal and setting a path.
The method according to claim 1,
The calibration control module
A TCP tagging and recognizing unit for tagging a unique ID in a network traffic or a network packet generated in the user terminal;
A security agent management unit monitoring an installation of a security agent installed in the user terminal and transmitting a security agent to a user terminal not installed by the security agent;
A user terminal control unit for determining that the user information is an external attack when accessing the main information or document information without performing authentication at the user terminal and blocking access to the system server; And
Further comprising a system restoring unit for storing a backup image of the infected user terminal and restoring the infected user terminal to a pre-infection state, when the user terminal is determined to be infected with at least one of the virus, malicious code, and spyware.
A system server for storing a plurality of pieces of important information or document information generated in at least one of the plurality of user terminals, an administrator terminal for managing the plurality of user terminals, And a security server for protecting a system server,
(a) defining a control policy for controlling access to an external network or an unconfigured server in the security server;
(b) an authentication step of performing authentication for permitting access to the system server to perform a task in the user terminal;
(c) monitoring access to the main server, the C & C server, the P2P server, and the harmful site at the user terminal when performing the service of the user terminal in the security server, and checking whether the user policy violates the control policy;
(d) notifying the administrator terminal when the security policy violates the security policy;
(e) blocking the network of the user terminal in violation of the control policy in the security server;
(f) storing a backup image of the user terminal in violation of the control policy in the security server;
(g) recovering the user terminal through the backup image at the security server; And
(h) performing digital forensic from the backup image at the secure server.
8. The method of claim 7,
Prior to step (a)
Evaluating importance of the main information or document information by giving a score of confidentiality, integrity and availability of a plurality of important information or document information stored in the system server, and managing information according to the evaluated importance; And
Analyzing and detecting a risk factor for a document having a high degree of importance among the main information or document information and performing a security check on all major information or document information when the risk factor is detected, Security method.
8. The method of claim 7,
The step (b)
Wherein the authentication is performed using at least one authentication element of the user ID and the OTP, the public key certificate, the ARS, and the QR code of the user terminal.
8. The method of claim 7,
After step (h)
And reflecting the result of the digital forensics to the control policy.

Images